Saturday, February 10, 2018

rsyslog and $MarkMessagePeriod

For a long time I had this rsyslog configuration to emit MARK messages every 10 minutes
$ModLoad immark
$MarkMessagePeriod 600
That config syntax was deprecated and finally broke in recent versions of rsyslog. That's fine... let's update to the new config syntax. The module load becomes
module(load="immark")
But what about the MarkMessagePeriod setting? I could not find any useful information about it.  Trying this
module(load="immark")
$MarkMessagePeriod 600
resulted in
liblogging-stdlog[881]: command 'MarkMessagePeriod' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.24.0 try http://www.rsyslog.com/e/2222 ]
and the information at the link was unhelpful.

My next attempt was
module(load="immark" MarkMessagePeriod="600")
and that resulted in this error
liblogging-stdlog[1084]: error during parsing file /etc/rsyslog.d/mark.conf, on or before line 1: parameter 'MarkMessagePeriod' not known -- typo in config file? [v8.24.0 try http://www.rsyslog.com/e/2207 ]

From there I finally found the correct name to use in the module-global parameters struct. It's called interval. So the working configuration is
module(load="immark" interval="600")
I wish the maintainer had published a list of conversions for the configuration of the plugins. In no way is it obvious that $MarkMessagePeriod should be changed to interval. *sigh*

2 comments:

Unknown said...

How difficult it is to find basic useful rsyslog information - a simple mapping of old "global" directives to new. It took some frustration before I decided to try the "Hoosier in Seattle" hit, and voila, exactly what I needed. Thanks.

Anonymous said...

Thanks for researching and posting this. Ran into the same issue.