> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Joel Merrick > Sent: Monday, August 02, 2010 1:14 PM > To: [email protected] > Subject: Re: [rsyslog] Problem with mysql template > > Do I take it from the lack of replies that this should work? :)
simply overlooked from my side ;) > > On Thu, Jul 29, 2010 at 11:53 AM, Joel Merrick <[email protected]> > wrote: > > Hi all, > > > > I'm trying to create a very quick mail log searching solution. The > > idea is to pre-hash the database by using the last 2 alpha-numeric > > characters on the message id. > > > > This isn't inserting to the database and I can't think why.. I've > > already built the tables with the structure logs-aa.. logs-ZZ etc.. > > > > > > $template OurDBLog,"INSERT INTO > > logs-'%msg:R,ERE,1,NULL:[A-Za-z0-9]{6}-[A-Za-z0-9]{6}-([A-Za-z0- > 9]{2})--end%' > > (messageid, host, \ > > send_host, created_at, payload, subject) values \ > > ('%msg:R,ERE,0,ZERO:[A-Za-z0-9]{6}-[A-Za-z0-9]{6}-[A-Za-z0-9]{2}- > -end%','%HOSTNAME%', > > '%msg:R,ERE,0,ZERO:H=.*\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0- > 9]{1,3}]--end%', > > \ > > '%timegenerated:::date-mysql%', '%msg%', > > '%msg:R,ERE,1,ZERO:T="(.+)"--end%')",SQL > > > > > > Any idea? > > > > > > On a side note, how can I get extra verbosity out of rsyslog so I'm > > not blindly trying to insert and then check via mysql Two ways to proceed: a) write to a file with the same template then you can check if the sql is like you intended it to be b) run rsyslog in debug mode (doc available in doc set and on site) It may also be worth trying out the regex checker on the rsyslog site. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
