Remote logging with rsyslog – Cannot load module lmnsd_gtls.so

rsyslog

I have 2 servers and an office NAS on which I want the two servers to dump their logs. Only 1 server is successfully logging to the NAS. The other server continues to produce this error message in /var/log/messages:

May 16 09:01:01 elmer rsyslogd-2068: could not load module '/usr/lib64/rsyslog/lmnsd_gtls.so', rsyslog error -2078
 [try http://www.rsyslog.com/e/2068 ]

Both servers are running CentOS 7 (4.0.2-x86_64), and both servers have rsyslog-gnutls installed, with 1 minor exception (see below):

Installed Packages
Name        : rsyslog-gnutls
Arch        : x86_64
Version     : 7.4.7
Release     : 7.el7_0
Size        : 33 k
Repo        : installed
From repo   : updates
Summary     : TLS protocol support for rsyslog
URL         : http://www.rsyslog.com/
License     : (GPLv3+ and ASL 2.0)
Description : The rsyslog-gnutls package contains the rsyslog plugins that provide the ability to receive syslog messages via upcoming syslog-transport-tls IETF standard protocol.

Note that I DO notice a difference in the "From Repo" line … for the server that is successfully logging to the NAS, the "From Repo" line says "updates" and for the server that is giving off this error message, the "From Repo" line says "base".

Both servers have the exact same rsyslog.conf configuration:

$DefaultNetstreamDriverCAFile /etc/ssl/logging-cert.crt
$DefaultNetstreamDriver gtls # use gtls netstream driver
$ActionSendStreamDriverMode 1 # require TLS for the connection
$ActionSendStreamDriverAuthMode anon # server is NOT authenticated
*.* @@my-remote-NAS.com:51415

Both servers have the same exact file for /etc/ssl/logging-cert.crt, and that file has the same permissions on both servers.

Most results on Google suggest to make sure rsyslog-gnutls is installed, which it is. I'm pulling my hair out. Help!

Best Answer

As suggested in this mail thread, it is probably caused by a certificate error from gnutls (which in turn prevents the module from loading). I had a similar problem and was able to resolve it by providing a correct certificate. As one of your server is working, the other not, check if the certificate you provided via 

$DefaultNetstreamDriverCAFile /etc/ssl/logging-cert.crt

are identical. Getting the right cert should resolve the issue.

Related Topic