> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Thursday, December 02, 2010 7:04 PM > To: rsyslog-users > Subject: Re: [rsyslog] Execute Alert script > > On Thu, 2 Dec 2010, Rainer Gerhards wrote: > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of [email protected] > >> Sent: Wednesday, December 01, 2010 10:14 PM > >> To: rsyslog-users > >> Subject: Re: [rsyslog] Execute Alert script > >> > >> On Wed, 1 Dec 2010, Mark Olliver wrote: > >> > >>> Hi, > >>> > >>> I am new to rsyslog but have found it very capable. I am using it > via > >> logger > >>> to log output of some of my scripts to local5. However I do want > >> rsyslog to > >>> alert me via an alert script should it encounter a warning or error > >> message > >>> sent to the log. > >>> > >>> I have tested my alert script and that works ok, i give it two > >> arguments > >>> subject and message. However I can not seem to work out how to make > >> this > >>> work from rsyslog. > >>> > >>> I tried the following: > >>> > >>> $template Alert,"'Rsyslog Alert' :msg" > >>> local5.info > >>> :msg, content "warning" > >>> ^/usr/bin/alert_script Alert > >>> > >>> > >>> Ideally i want the Subject to be what i set it to, the message to > be > >>> everything that comes after the word warning. I would also only > like > >> one > >>> alert every 24 hours. > >>> > >>> Any ideas or help would be gratefully received. > >> > >> rsyslog doesn't keep a history of what it's done, so it can't limit > you > >> to > >> one alert every 24 hours, you really want another tool (something > like > >> SEC) for that. > > > > It's actually possible: $ActionExecOnlyOnceEveryInterval allows you > do this > > kind of thing. This is the only sense of history rsyslog has, but > there are > > many uses for it. I think I introduced it when I wrote ommail, which > really > > needs such a capability. As such, a sample of its use can be found in > the > > ommail doc: > > > > http://www.rsyslog.com/doc/ommail.html > > I forgot about that, although I'll point out that that limits your > reports > to one per filter rule, while useing something like SEC can do the same > type of thing, but can also do things like doing the rate limiting on > the > message that is being sent.
sure, it's pretty limited. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
