3

I am using rsyslog version 8.16.0 on ubuntu 16.04.

Following is my configuration file :

module(load="imfile") #needs to be done just once

# File 1
input(type="imfile"
  mode="inotify"
  File="/var/log/application/hello.log"
  Tag="application-access-logs"
  Severity="info"
  PersistStateInterval="20000"
)

$PrivDropToGroup adm
$WorkDirectory /var/spool/rsyslog
$InputRunFileMonitor

#Template for application access events
$template ApplicationLogs,"%HOSTNAME% %msg%\n"


if $programname == 'application-access-logs' then @@xx.xx.xx.xx:12345;ApplicationLogs
if $programname == 'application-access-logs' then ~

I am getting the following error :

rsyslogd: version 8.16.0, config validation run (level 1), master config /etc/rsyslog.conf
rsyslogd: error during parsing file /etc/rsyslog.d/21-application-test.conf, on or before line 10: parameter 'mode' not known -- typo in config file? [v8.16.0 try http://www.rsyslog.com/e/2207 ]
rsyslogd: imfile error: no file name given, file monitor can not be created [v8.16.0 try http://www.rsyslog.com/e/2046 ]

What I am doing wrong here ? I am using inotify mode because I want to use wildcards in file name.

Salman Shaikh
  • 575
  • 1
  • 7
  • 24

1 Answers1

1

I know this is not a complete answer but an observation that can help others struggling with the same issue.

module(load="imfile" mode="inotify") is set globally so if any other .conf file has module property set it seems to throw this error for any future files.

Vishakha Lall
  • 1,178
  • 12
  • 33