如何配置rsyslog使用imfile模块以消除加载冲突错误？

算力阿峰

2026-7-3

问题描述

使用Red Hat 9.2系统，rsyslog版本为v8.2102.0-113.el9_2.1，采用默认的/etc/rsyslog.conf配置，同时在/etc/rsyslog.d/目录下有自定义配置文件vums.conf，内容如下：

module(load="imfile")
input(type="imfile"
      File="/opt/wildfly/standalone/log/server.log"
      Tag="wildfly")

重启rsyslog服务后，执行systemctl status rsyslog出现错误：

[root@konor2 rsyslog.d]# systemctl status rsyslog
● rsyslog.service - System Logging Service
     Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
     Active: active (running) since Wed 2023-12-20 07:32:55 CET; 1s ago
       Docs: man:rsyslogd(8)
             https://www.rsyslog.com/doc/
   Main PID: 574855 (rsyslogd)
      Tasks: 4 (limit: 36037)
     Memory: 1.4M
        CPU: 23ms
     CGroup: /system.slice/rsyslog.service
             └─574855 /usr/sbin/rsyslogd -n

Dec 20 07:32:55 konor2 systemd[1]: Starting System Logging Service...
Dec 20 07:32:55 konor2 rsyslogd[574855]: module 'imfile' already in this config, cannot be added  [v8.2102.0-113.el9_2.1 try https://www.rsyslog.com/e/2221 ]
Dec 20 07:32:55 konor2 rsyslogd[574855]: [origin software="rsyslogd" swVersion="8.2102.0-113.el9_2.1" x-pid="574855" x-info="https://www.rsyslog.com"] start
Dec 20 07:32:55 konor2 systemd[1]: Started System Logging Service.
Dec 20 07:32:55 konor2 rsyslogd[574855]: imjournal: journal files changed, reloading...  [v8.2102.0-113.el9_2.1 try https://www.rsyslog.com/e/0 ]

错误提示：module 'imfile' already in this config, cannot be added

若注释掉module(load="imfile")行，重启后又出现如下错误：

[root@konor2 rsyslog.d]# systemctl status rsyslog
● rsyslog.service - System Logging Service
     Loaded: loaded (/usr/lib/systemd/system/rsyslog.service; enabled; preset: enabled)
     Active: active (running) since Wed 2023-12-20 07:34:54 CET; 1s ago
       Docs: man:rsyslogd(8)
             https://www.rsyslog.com/doc/
   Main PID: 576081 (rsyslogd)
      Tasks: 3 (limit: 36037)
     Memory: 5.1M
        CPU: 23ms
     CGroup: /system.slice/rsyslog.service
             └─576081 /usr/sbin/rsyslogd -n

Dec 20 07:34:54 konor2 systemd[1]: Starting System Logging Service...
Dec 20 07:34:54 konor2 rsyslogd[576081]: input module name 'imfile' is unknown [v8.2102.0-113.el9_2.1 try https://www.rsyslog.com/e/2209 ]
Dec 20 07:34:54 konor2 systemd[1]: Started System Logging Service.
Dec 20 07:34:54 konor2 rsyslogd[576081]: error during parsing file /etc/rsyslog.d/vums.conf, on or before line 13: parameter 'Tag' not known -- typo in config file? [v8.2102.0-113.el9_2.1 try https:>
Dec 20 07:34:54 konor2 rsyslogd[576081]: error during parsing file /etc/rsyslog.d/vums.conf, on or before line 13: parameter 'File' not known -- typo in config file? [v8.2102.0-113.el9_2.1 try https>
Dec 20 07:34:54 konor2 rsyslogd[576081]: input module name 'imfile' is unknown [v8.2102.0-113.el9_2.1 try https://www.rsyslog.com/e/2209 ]
Dec 20 07:34:54 konor2 rsyslogd[576081]: error during parsing file /etc/rsyslog.d/vums.conf, on or before line 13: parameter 'Tag' not known -- typo in config file? [v8.2102.0-113.el9_2.1 try https:>
Dec 20 07:34:54 konor2 rsyslogd[576081]: error during parsing file /etc/rsyslog.d/vums.conf, on or before line 13: parameter 'File' not known -- typo in config file? [v8.2102.0-113.el9_2.1 try https>
Dec 20 07:34:54 konor2 rsyslogd[576081]: [origin software="rsyslogd" swVersion="8.2102.0-113.el9_2.1" x-pid="576081" x-info="https://www.rsyslog.com"] start
Dec 20 07:34:54 konor2 rsyslogd[576081]: imjournal: journal files changed, reloading...  [v8.2102.0-113.el9_2.1 try https://www.rsyslog.com/e/0 ]

错误提示：input module name 'imfile' is unknown

请问如何正确配置rsyslog，使其能够正常使用imfile模块及输入定义且不出现上述错误？

解决方案

问题根源是imfile模块重复加载+配置文件加载顺序错误，按以下步骤修复：

删除重复的模块加载指令
直接移除vums.conf中的module(load="imfile")行，默认配置已经加载了该模块，重复加载会触发报错。
调整自定义配置文件的加载顺序
Red Hat系统中，rsyslog会按文件名的字母顺序加载/etc/rsyslog.d/下的配置文件。默认情况下，系统基础配置（比如00-base.conf）会先加载模块，因此将你的vums.conf重命名为10-vums.conf，确保它在模块加载完成后再被解析，避免出现“模块未知”的错误。
验证配置并重启服务
- 检查配置语法：rsyslogd -N1
- 重启rsyslog服务：systemctl restart rsyslog
- 确认服务状态：systemctl status rsyslog

完成以上操作后，rsyslog就能正常读取WildFly的server.log文件，并为日志打上wildfly标签。

内容的提问来源于stack exchange，提问作者Ondřej Žižka