Getting Data In

Having issue in collecting data from two of the hosts.e are using rsyslog to injest data

bbiswabhusan
Explorer

Hello all, I am facing issue in collecting data from two of the hosts.e are using rsyslog to injest data. Logs are getting updated in the logdump of the HF but im not able to see the logs in splunk. We can see logs from other hosts , but having issues with two particular hosts with high log volume. I dont see any error/warning related to queueing. While checking the status of rsyslog service, we can see the below errors.

invalid or yet-unknown config file command 'TCPServerAddress' - have you forgotten to load a module? [v8.24.0-57.el7_9 try http://www.rsyslog.com/e/3003 ]

Could not create tcp listener, ignoring port 515 bind-address (null). [v8.24.0-57.el7_9 try http://www.rsyslog.com/e/2077 ]

module 'imtcp.so' already in this config, cannot be added [v8.24.0-57.el7_9 try http://www.rsyslog.com/e/2221 ]

Any suggestions/feedback is welcomes.

Thanks

Labels (2)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Firstly, it's hard to say something without seeing your config.

Secondly, 8.24 is a very old version. It might have some security fixes backported into it if it's the distro-provided package but it doesn't have many features that current rsyslog versions have.

Thirdly, it's better to ask about rsyslog on rsyslog's mailing list than here.

And finally, neither imtcp nor imptcp (yes, there are two different modules for handling TCP inputs - each has slightly different functionality than the other) knows about TCPServerAddress config directive. So you clearly have some mistakes in your config. What kind of mistakes - look at my first remark.

Oh, and even though in simple cases it's ok to use legacy format config directives, it's usually limited to the selector-action notation. It's best to define inputs using rainerscript-style configuration to avoid ambiguity.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...