Hello again, Everything is running pretty smooth after the solution applied, I have noted just one thing, my /var/log/messages is caughting all the logs (including the statistics log from apache) on each server and due this the file goes up to 5-6GB every few days, is there anyway to prevent the apache statistics to go to this log file?
This is my syslog.conf ------------- # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log local1.* @rsyslog-server.domain.com ------------- Thank you in advance. --- On Sat, 11/28/09, [email protected] <[email protected]> wrote: > From: [email protected] <[email protected]> > Subject: Re: [rsyslog] filter logger tags from syslog > To: "rsyslog-users" <[email protected]> > Date: Saturday, November 28, 2009, 3:43 AM > On Fri, 27 Nov 2009, Jose Sanchez > wrote: > > > Hello David and Reiner, > > > > First I would like to thank you for all the help > offered, I was able to setup almost everything because of > you guys. > > > > I had some issues today, though. I found that rsyslog > was removing the "logger" properly but it was adding an > extra empty space not sure why so I had to cut if off (by > watching how to do it on video tutorial first!) by modifying > the template that David gave me, I currently have it like > this, > > > > $template line,"%msg:2:1000%\n" > > > > The thing here is Im not sure if this is a reliable > solution, I couldnt find if there is any setting that will > tell rsyslog to simply remove the empty space or to get > everything until the last letter so I configured a very long > (1000) number in case rsyslog cuts some part of the text. > Not sure if there is any negative impact on doing it this > way, if there is any other better way, please let me know. > > if you use '$' instead of '1000' it will go to the end of > the message, no > matter how long it is (1000 is not long enough for some > messages) > > I think that what you are doing is probably the best way to > deal with > this space. > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
