Not able to read the environmental variable in rsyslog config

[guptarishu]

Expected behavior

{
"@timestamp": "2018-05-23T21:05:46.919925+00:00",
"host": "10.11.1.1",
"severity": "INFO",
"syslog-tag": "test-Log:",
"tenant": "tenant 1",
"message": "some log"
}

Actual behavior

{
"@timestamp": "2018-05-23T21:05:46.919925+00:00",
"host": "10.11.1.1",
"severity": "INFO",
"syslog-tag": "test-Log:",
"tenant": "",
"message": "some log"
}

Steps to reproduce the behavior

#steps to set the env variable on linux

1. TEST_VAR='tenant 1'
2. export TEST_VAR
3. printenv | grep TEST_VAR
4. echo $TEST_VAR #should print tenant1

create file /opt/test.log whose contents are just "some log"

create rsyslog.conf as defined below and restart.
Reading this env variable in rsyslog.conf results in empty string

Environment

rsyslogd 8.24.0, compiled with:
PLATFORM: x86_64-redhat-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
Number of Bits in RainerScript integers: 64

###rsyslog.conf

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514

# define a template to specify which fields we send
template(name="jsonLogFormat" type="list" option.json="on") {
  constant(value="{")
  constant(value="\"@timestamp\":\"")
  property(name="timereported" dateFormat="rfc3339")
  constant(value="\",\"host\":\"")
  property(name="hostname")
  constant(value="\",\"severity\":\"")
  property(name="syslogseverity-text" caseConversion="upper")
  constant(value="\",\"syslog-tag\":\"")
  property(name="syslogtag")
  constant(value="\",\"tenant\":\"")
  property(name="$.tenantid")
  constant(value="\",\"message\":\"")
  property(name="msg")
  constant(value="\"}")
}

ruleset(name="logforwarder") {  
  #forward to syslog server
  action(template="jsonLogFormat" type="omfwd" target="10.11.2.251" port="514" protocol="tcp")
}

ruleset(name="testruleset") {
  #set $.tenantid="tenantId";
  set $.tenantid=getenv("TEST_VAR");
  call logforwarder
}

module(load="imfile" PollingInterval="5") #needs to be done just once
# File 1
input(type="imfile"
  File="/opt/test.log"
  Tag="test-Log:"
  Severity="info"
  Facility="local7"
  ReadMode="2"
  Ruleset="testruleset"
)
#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state

#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
#authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
#mail.*                                                  -/var/log/maillog


# Log cron stuff
#cron.*                                                  /var/log/cron

# Everybody gets emergency messages
#*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
#uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
#local7.*                                                /var/log/boot.log

[Karl90]

Same issue here, did you find a solution?

[rgerhards]

You need to set the variable in the service environment. This is different from your user session environment.

[rgerhards]

more precisely, check this: https://serverfault.com/questions/413397/how-to-set-environment-variable-in-systemd-service

[Karl90]

Hi Rainer, Truth, thanks for highlighting that! That is needed for services running on systemd based OS. In my case I just pass them as k8s secrets through env vars to the process running on my pods: rsyslog, this worked like a charm, As said, thanks a lot for your help. Regards, Karl PS: I found the same issue while publishing the comment (because of extra chars added by github’s comment format), I edited ‘till reflect the proper env vars value.

…

On Fri, 4 Oct 2019 at 10:10, Rainer Gerhards ***@***.***> wrote: more precisely, check this: https://serverfault.com/questions/413397/how-to-set-environment-variable-in-systemd-service — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2735?email_source=notifications&email_token=AIGY5RPKEKIMAANDUFP6PA3QM326RA5CNFSM4FBM2YQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEAK3KZY#issuecomment-538293607>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AIGY5ROBKNNHXPCOIWY67DDQM326RANCNFSM4FBM2YQA> .