From: Rainer Gerhards <[email protected]>
Subject: Re: [rsyslog] filter logger tags from syslog
To: "rsyslog-users" <[email protected]>
Date: Friday, December 11, 2009, 9:54 AM
See this, especially "splitting local
and remote logging" (especially the
traditional approach)
http://www.rsyslog.com/doc-multi_ruleset.html
Rainer
-----Original Message-----
From: [email protected]
[mailto:rsyslog-
[email protected]]
On Behalf Of Jose Sanchez
Sent: Friday, December 11, 2009 4:41 PM
To: rsyslog-users
Subject: Re: [rsyslog] filter logger tags from syslog
Hello again,
Everything is running pretty smooth after the solution
applied, I have
noted just one thing, my /var/log/messages is
caughting all the logs
(including the statistics log from apache) on each
server and due this
the file goes up to 5-6GB every few days, is there
anyway to prevent
the apache statistics to go to this log file?
This is my syslog.conf
-------------
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*
/dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none
/var/log/messages
# The authpriv file has restricted access.
authpriv.*
/var/log/secure
# Log all the mail messages in one place.
mail.*
-/var/log/maillog
# Log cron stuff
cron.*
/var/log/cron
# Everybody gets emergency messages
*.emerg
*
# Save news errors of level crit and higher in a
special file.
uucp,news.crit
/var/log/spooler
# Save boot messages also to boot.log
local7.*
/var/log/boot.log
local1.* @rsyslog-server.domain.com
-------------
Thank you in advance.
--- On Sat, 11/28/09, [email protected] <[email protected]>
wrote:
From: [email protected] <[email protected]>
Subject: Re: [rsyslog] filter logger tags from
syslog
To: "rsyslog-users" <[email protected]>
Date: Saturday, November 28, 2009, 3:43 AM
On Fri, 27 Nov 2009, Jose Sanchez
wrote:
Hello David and Reiner,
First I would like to thank you for all the
help
offered, I was able to setup almost everything
because of
you guys.
I had some issues today, though. I found
that rsyslog
was removing the "logger" properly but it was
adding an
extra empty space not sure why so I had to cut if
off (by
watching how to do it on video tutorial first!)
by modifying
the template that David gave me, I currently have
it like
this,
$template line,"%msg:2:1000%\n"
The thing here is Im not sure if this is a
reliable
solution, I couldnt find if there is any setting
that will
tell rsyslog to simply remove the empty space or
to get
everything until the last letter so I configured
a very long
(1000) number in case rsyslog cuts some part of
the text.
Not sure if there is any negative impact on doing
it this
way, if there is any other better way, please let
me know.
if you use '$' instead of '1000' it will go to
the end of
the message, no
matter how long it is (1000 is not long enough
for some
messages)
I think that what you are doing is probably the
best way to
deal with
this space.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
