When rsyslog (v8.39.0) mmnormalize is not recognized. How can this be fixed?

0
votes

I am trying to use mmnormalize to structure text logs. Both with rsyslog 8.16.x and with 8.39.0 when trying to use mmnormalize as an action logs show that the module was not recognized. Below are details.

How can I set up to use mmnormalize with rsyslog?

remediation already tried

  • Installed separately liblognorm, libstr, json-c,libfastjson
  • Upgraded rsyslog from 8.16.x to 8.39.0

rsyslog .conf 

module(load="mmnormalize") # text parsing

syslog log messages

Dec 3 11:33:55 sys1 systemd[1]: Starting System Logging Service...

Dec 3 11:33:55 sys1 systemd[1]: Started System Logging Service.

Dec 3 11:33:55 sys1 rsyslogd: could not load module 'mmnormalize', errors: trying to load module /usr/lib/rsyslog/mmnormalize.so: /usr/lib/rsyslog/mmnormalize.so: cannot open shared object file: No such file or directory [v8.39.0 try http://www.rsyslog.com/e/2066 ]

Dec 3 11:33:55 sys1 rsyslogd: module name 'mmnormalize' is unknown [v8.39.0 try http://www.rsyslog.com/e/2209 ]

Dec 3 11:33:55 sys1 rsyslogd: error during parsing file /etc/rsyslog.d/52-tomcat.conf, on or before line 52: errors occured in file '/etc/rsyslog.d/52-tomcat.conf' around line 52 [v8.39.0 try http://www.rsyslog.com/e/2207 ]

1
rsyslog

1 Answers

0
votes

The following way to install mmnormalize worked for me. I was running this on Ububutu (Xenial)

sudo apt-get install rsyslog-mmnormalize

Rich Megginson (thank you) answered as below to the same question I posted to rsyslog mailing list ([email protected]). As mentioned above it worked for me.

"On RHEL/CentOS/Fedora and similar platforms, the rsyslog-mmnormalize is a separate RPM that must be installed separately e.g.

yum install rsyslog rsyslog-mmnormalize ....

"