rsyslog is putting log entries into an included file

Question

I have an include directive in my rsyslog.conf file and rsyslog is appending data to it! I don't know why.

I am running rsyslog 8.24 on RHEL7.7: rsyslog-8.24.0-38.el7.x86_64, kernel 3.10.0-1062.el7.x86_64

These are the only lines I have in my rsyslog.conf:

module(load="imuxsock"
       SysSock.name="/run/systemd/journal/syslog")
module(load="imklog")
include(
    file=/etc/rsyslog.d/listen.conf
)

The listen.conf file contains only comments:

#Here is a comment
#and another

As soon as I start rsyslogd, logging data gets dumped into that file! And if I change the name at all, a file by that name is created.

Data is put into it instead of my /var/log/messages file. If I change the include to be:

include(
    file="/etc/rsyslog.d/listen.conf"
)

rsyslog will create a file named listen.conf" in the /etc/rsyslog.d directory. If I do:

include(
    file="/etc/rsyslog.d/*.conf"
)

Then I will get a file named literally *.conf"

I'm completely baffled. This include directive is not including anything. What am I missing?

Answer 1

The include() object was only implemented from version 8.33, so the file= line is probably being interpreted as a filter selector of some sort, with an output to the file. You should stick with $IncludeConfig for your version.

Always check for syntax error messages by running rsyslogd -N 1, and if this shows no errors but you still have problems you can get very verbose debug with -d (add -n to run in the foreground).