could not load module rsyslog lmnsd_gtls.so

Question

The rsyslog module is showing up in system log /var/log/syslog as message repeated. rsyslog was also showing 99% cpu use in top at one point, possibly unrelated.

tail /var/log/syslog

Dec  1 22:18:16 here rsyslogd-2066: could not load module '/usr/lib/rsyslog/lmnsd_gtls.so', dlopen: /usr/lib/rsyslog/lmnsd_gtls.so: cannot open shared object file: No such file or directory
 [try http://www.rsyslog.com/e/2066 ]
Dec  1 22:18:56 here rsyslogd-2066: last message repeated 4 times

lsb_release -a

Description: Ubuntu 12.04.3 LTS Release: 12.04

sudo apt-cache showpkg rsyslog

Package: rsyslog Versions: 5.8.6-1ubuntu8.5

Related Question : How do I find that lmnsd_gtls.so is related to rsyslog-gnutls ?

Solution 1

Get the missing module by installing the rsyslog-gnutls package.

sudo apt-get install rsyslog-gnutls

see also http://virtuallyhyper.com/2013/06/install-splunk-and-send-logs-to-splunk-with-rsyslog-over-tcp-with-ssl/

see also http://help.papertrailapp.com/kb/configuration/encrypting-remote-syslog-with-tls-ssl

Check to see if the module file exists :

ls -la /usr/lib/rsyslog/lmnsd_gtls.so

Solution 2

This happened with me when I was trying to set up syslog with tls certificate similar to this. Rsyslog in few of the systems start as root and then fall to user syslog. There is a possibility that the certificate is not readable by the syslog user.

Check it using:

sudo -H -u syslog bash -l -c 'less <path to the certificate>'

if you get Permission Denied, add read permissions for your syslog user, and restart rsyslog.

Comments

[Pavel Chuchuva]

It was /usr/lib/x86_64-linux-gnu/rsyslog/lmnsd_gtls.so on Ubuntu 18.04