On Fri, 19 Mar 2010, Tomasz Chmielewski wrote: > Am 19.03.2010 00:40, Tomasz Chmielewski wrote: >> Am 19.03.2010 00:23, [email protected] wrote: >>> On Fri, 19 Mar 2010, Tomasz Chmielewski wrote: >>> >>>> Am 19.03.2010 00:08, [email protected] wrote: >>>> >>>>> no, >>>>> >>>>> :programname, :isequal, "postgres" ~ >>>>> *.*;auth,authpriv.none -/var/log/syslog >>>>> >>>>> each of these is a seperate statement. the ~ as a destination tells >>>>> rsyslog not to proceed further through the rules for this log entry. >>>> >>>> Doesn't work for me. >>>> >>>> If I put it like above, nothing gets appended to /var/log/syslog >>>> anymore (or any other defined log file). >>>> >>>> rsyslogd is running as a process. >>>> >>>> If it matters, I'm using 64 bit Debian Lenny (rsyslog 3.18.6). >>> >>> try it with ' instead of " (I get those mixed up at least 50% of the >>> time, rsyslog accepts one and not the other and I can never remember >>> which one) >> >> OK, with ' it started to log again, but still postgres gets to both >> /var/log/syslog and /var/log/postgresql/postgresql_log. >> >> So, not as expected. > > And here is why: > > Mar 19 07:37:26 sun rsyslogd: error: invalid compare operation ':isequal' - > ignoring selector > Mar 19 07:37:26 sun rsyslogd: error -3003 compare value property - ignoring > selector > Mar 19 07:37:26 sun rsyslogd: the last error occured in /etc/rsyslog.conf, > line 58 > Mar 19 07:37:26 sun rsyslogd: warning: selector line without actions will be > discarded > > > So, if it's " - it doesn't log anything. > > If it's ' - it doesn't like the rule.
when all else fails, look at the documentation ;-) http://www.rsyslog.com/doc-rsyslog_conf_filter.html the line should have been :programname, isequal, 'postgres' ~ David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
