[CentOS] rsyslog not loading relp

[Mike Burger]

> On Tue, Oct 29, 2013 at 2:08 PM, Mike Burger <mburger at bubbanfriends.org>
> wrote:
>>> centos 6.4, setup to be syslog server. Doing remote syslog using tcp
>>> works fine, so now want to add relp. I installed the rsyslog-relp
>>> package and told rsyslog.conf to use it:
>>>
>>> # RELP Syslog Server:
>>> $ModLoad imrelp  # provides RELP syslog reception
>>> $InputRELPServerRun 20514
>>>
>>> when I restart rsyslog I am told it does not like my InputRELPServerRun
>>> line:
>>>
>>> Oct 28 13:43:54 scan rsyslogd: [origin software="rsyslogd"
>>> swVersion="5.8.10" x-pid="7102" x-info="http://www.rsyslog.com"] start
>>> Oct 28 13:43:54 scan rsyslogd: the last error occured in
>>> /etc/rsyslog.conf, line 23:"$InputRELPServerRun 20514"
>>>
>>> Any clues?
>>
>> Dumb question...do you have librelp installed?
>>
>    Never a dumb question! I've done that way too many times. The
> rsyslog-relp Should have installed it. Just to be sure, I went and
> looked for /lib64/rsyslog/imrelp.so:
>
> [root at scan ~]# ls -lh /lib64/rsyslog/imrelp.so
> -rwxr-xr-x. 1 root root 11K Sep  9 09:58 /lib64/rsyslog/imrelp.so
> [root at scan ~]#
>

Looking at http://www.rsyslog.com/doc/imrelp.html, I see two possible
configuration options. The option you're using:

$ModLoad imrelp # needs to be done just once
$InputRELPServerRun 20514

has some sort of note about being available in rsyslog 6.3.6+.

Since CentOS 6.4 comes with version 5.8.10-7, perhaps try using the other
listed option, instead:

module(load="imrelp") # needs to be done just once
input(type="imrelp" port="20514")

-- 
Mike Burger
http://www.bubbanfriends.org

"It's always suicide-mission this, save-the-planet that. No one ever just
stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1