I have an odd issue where with a specific config I see triple of each
line in the log but using another config that should effectively be
doing the same thing it does not.
Doing something like the following produces three identical lines in the
log.
$template DbFormat,"%timegenerated% %HOSTNAME% %msg:::drop-last-lf%\n"
$template DbNotice,"<%= @log_dir
%>/%$YEAR%/%$MONTH%/%$DAY%/db/%programname%/%syslogseverity-text%"
local2.notice -?DbNotice;DbFormat
Example:
Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0
Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0
Jan 27 19:01:22 HOSTNAME [<0.28726.158>] IP undefined GET / 200 0
The following produces the expected one line in the log without duplication.
$template DbFormat,"%timegenerated% %fromhost% %msg:::drop-last-lf%\n"
$template DbNotice,"<%= @log_dir
%>/%$YEAR%/%$MONTH%/%$DAY%/db/%programname%/%syslogseverity-text%"
if \
( $syslogfacility-text == 'local2' ) \
and \
( $syslogseverity-text == 'notice' ) \
then -?DbNotice;DbFormat
For brevity in both examples I just showed an example for one severity
level, we have individual log templates and filters for all of them.
Any ideas what could be going on here? To me these should be equivalent.
Thanks.
-Joe
--
Name: Joseph A. Williams
Email: [email protected]
Blog: http://www.joeandmotorboat.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
