1

Running rsyslog version 8.2412.0-1.el9 on Red Hat Enterprise Linux 9.6.

I'm trying to set a custom variable that I can check later in the configuration with this statement:

if $syslogtag == "MyTag" then {
    set $.mytag = true;
}

I got an error message:

error during parsing file .../rsyslog.conf, on or before line 111: syntax error on token ';'

I have tried with/without the "set" keywork, the trailing ';', etc. -- always end up with some kind of syntax error.

What is the correct syntax for setting a custom variable? Thanks for any pointers!

Wei Wang
  • 11
  • 4
  • If an answer solved your problem, including your own, consider accepting that answer. Just doing that, this question will fall off the unanswered queue. https://serverfault.com/help/someone-answers – John Mahowald Jul 24 '25 at 01:59

2 Answers2

0

Tested on another OS (Ubuntu), but it worked after moving your code from my rsyslog.conf to a .conf file within /etc/rsyslog.d folder.

RCDevs Security
  • 171
  • What rsyslog version do you run on Ubuntu? – Wei Wang Jul 15 '25 at 13:48
  • Version 8.2312.0-3ubuntu9.1. – RCDevs Security Jul 15 '25 at 13:51
  • Interesting. I did what you did on a Ubuntu system running the same rsyslog version. And I got the same error message: 
    root@mamabear:~# /usr/sbin/rsyslogd -N1 -f /etc/rsyslog.d/88-test.conf
rsyslogd: version 8.2312.0, config validation run (level 1), master config /etc/rsyslog.d/88-test.conf
rsyslogd: error during parsing file /etc/rsyslog.d/88-test.conf, on or before line 2: syntax error on token ';' [v8.2312.0 try https://www.rsyslog.com/e/2207 ]
rsyslogd: could not interpret master config file '/etc/rsyslog.d/88-test.conf'. [v8.2312.0 try https://www.rsyslog.com/e/2207 ]
    – Wei Wang Jul 15 '25 at 14:09
  • Running /usr/sbin/rsyslogd -N1 -f /etc/rsyslog.d/custom.conf, I get: rsyslogd: run failed with error -2103 (see rsyslog.h or try https://www.rsyslog.com/e/2103 to learn what that number means). -2103 means No active actions are configured (no output will be created)., which seems logic. Running /usr/sbin/rsyslogd -N1 -f /etc/rsyslog.conf gives me rsyslogd: End of config validation run. Bye. To validate my custom is well processed, if I introduce an error in custom.conf (i.e. add a at last line), I well get an error: rsyslogd: error during parsing [REDACTED] on or before line 4 – RCDevs Security Jul 15 '25 at 14:25
  • Tested with RockyLinux 9.6 run by Docker, and I get the same result as for my Ubuntu. Version of rsyslog is 8.2412.0-1.el9. – RCDevs Security Jul 15 '25 at 14:35
  • This is crazy! I just tested that on my Rocky Linux 9.6 PC, running rsyslog version 8.2412.0-1.el9. I got the exact same syntax error on token ';' error message. I am really confused. What else can contribute to this error? – Wei Wang Jul 15 '25 at 16:10
  • I have tested it on an actual Rocky Linux 9.6 and can now reproduce your issue. As it works for a Rocky Linux 9.6 run as a docker container, perhaps the issue is kernel-related. My Ubuntu kernel is 6.14.0-23-generic, whereas the kernel of the Rocky Linux 9.6 is 5.14.0-503.35.1.el9_5.x86_64. Perhaps the best approach would be to open an issue with the rsyslog development team. – – RCDevs Security Jul 16 '25 at 07:26
  • Thank you, @RCDevs_Security for all these tests and follow-up.

    I will do that and report back here. Have a wonderful day!

     – Wei Wang Jul 16 '25 at 14:50
0

As it turns out, true is not a valid RainerScript literal in rsyslog configuration. This statement below works:

if $syslogtag == "Tag1" then {
    set $.tag1 = 1;
} else if $syslogtag == "Tag2" then {
    set $.tag2 = "true";
}

/usr/sbin/rsyslogd -N1 -f ./custom.conf would still produce the rsyslogd: run failed with error -2103 message but that is expected.

I don't actually know how the statement in the original post worked for @RCDevsSecurity - but I guess I did get myself confused. My apologies!

Wei Wang
  • 11
  • 4