rsyslogd in Ubuntu 11.04 ignoring lines in conf file?

Question

Not too long ago, I posted this question, and got an answer that works perfectly in Ubuntu 10.10 and Linux Mint 10. What it did was send kernel messages as they occurred to a script. In my case, it redirected to a script that posted the kernel messages to my laptop's OLED screen. I did this by adding the following lines to my /etc/rsyslog.conf file:

$template OLEDformat,"%msg%0
kern.*  ^/opt/asusg50oled/utils/notify.sh;OLEDformat

Later, I restored the rsyslog.conf file to normal and moved the above lines to a new file at /etc/rsyslog.d/00-asusg50oled.conf to make it easier to adjust if needed. As /etc/rsyslog.conf loads everything from /etc/rsyslog.d anyway, this worked just as well.

The problem, however, is that this no longer works in Ubuntu 11.04 and Linux Mint 11 RC. Regardless of whether I place the lines in /etc/rsyslog.conf or in a file in /etc/rsyslog.d/, I only ever get one message forwarded right when rsyslog starts. Checking the files already referenced in /etc/rsyslog.conf shows that the system is logging kernel events, and dmesg works normally.

Has something changed in rsyslog between Ubuntu 10.10 and 11.04, and is there a workaround?

Edit

Here is the output of rsyslogd -v on Linux Mint 11 RC and Ubuntu 11.04, where the solution above does not work:

rsyslogd 4.6.4, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    FEATURE_NETZIP (message compression):   Yes
    GSSAPI Kerberos 6 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    Atomic operations supported:        Yes
    Runtime Instrumentation (slow code):    No

This is the output of rsyslogd -v on Linux Mint 10 and Ubuntu 10.10, where the above solution works perfectly:

rsyslogd 4.2.0, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          Yes
    FEATURE_NETZIP (message compression):   Yes
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    Atomic operations supported:        Yes
    Runtime Instrumentation (slow code):    No

According to www.rsyslog.com, the latest stable version of rsyslogd is actually 5.8.1, which does not seem to be available as an update for either Ubuntu 11.04 or Linux Mint 11RC at this time.

Edit 2

I just verified that openSUSE 11.4 is following my added config lines for rsyslogd properly. In openSUSE 11.4, the output of rsyslogd -v is:

rsyslogd 5.6.5, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    FEATURE_NETZIP (message compression):   Yes
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    Atomic operations supported:        Yes
    Runtime Instrumentation (slow code):    No

Sadly, I'm finding that I'm not crazy about openSUSE, and so I'll be going back to Linux Mint, where I'm still having trouble. I'm wondering now if there might be something different in the kernel (call it a hunch). Any ideas?

Update

I just built from source and installed rsyslogd 5.8.1 (latest stable). I can confirm that it installed correctly, because the one and only message that is forwarded reflects the new version number. Additionally, rsyslogd -v outputs:

rsyslogd 5.8.1, compiled with:
    FEATURE_REGEXP:             Yes
    FEATURE_LARGEFILE:          No
    GSSAPI Kerberos 5 support:      No
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:  Yes
    64bit Atomic operations supported:  No
    Runtime Instrumentation (slow code):    No

Answer 1

It sounds like, to me, like there is a bug (which may have already been fixed in later versions) in rsyslog itself. The Changelog notes for 4.6.5 mentioned a couple of bug fixes for the 'imfile' module, which may or may not apply. So there's that.

Scott Moser also has a PPA available which includes rsyslog version 5.8.1, which you can find here, if you don't mind using that repository.

Another idea is that you could look at using the 64 bit version if you're currently using 32 bit Ubuntu. The Changelog notes mentions some bug arising from doing so. Unlikely to help, since this doesn't seem like it has to do anything with the architectures, but it's an idea.