that I'm less sure of, but what I would assume based on what I understand
of rsyslog is that the way to do this would be to put another rate limit
after the line as well, resetting it to unlimited.
David Lang
On Thu, 17 Feb 2011,
Mark Olliver wrote:
Arh ok.
I that case how do i scope the rate limit so that it only effects the one
next line instead of everything from there on?
Thanks
Mark
On 16 Feb 2011 23:53, <[email protected]> wrote:
On Wed, 16 Feb 2011, Mark Olliver wrote:
The partial if was to try and clear the messages to stop them going to
other
logs.
Ok, but that would not do it.
If you eliminated the if line, then the &~ line would apply the match
criteria of the prior line and stop processing that log message
but with the partial if line, rsyslog will see a syntax error, and
depending on exactly how it handles that error it coudl affect things
after that in the config.
David Lang
On 16 Feb 2011 22:01, <[email protected]> wrote:
On Wed, 16 Feb 2011, Mark Olliver wrote:
Hi All,
I have several program that i am using to send data to local6 i am
using rsyslog to filter these to their own logs however, some data
seems to be written to multiple logs. Do you have any ideas?
if $programname == 'USERLOG' then /var/log/user.log
&~
if $programname == 'FILERR' then /var/log/filerr.log
$ModLoad ommail
$ActionMailSMTPServer localhost
$ActionMailFrom [email protected]
$ActionMailTo [email protected]
$template filerrSubject,"FILE ERROR %HOSTNAME%.example.com %timestamp%"
$template filerrBody,"There is a file Error on Host:
%HOSTNAME%.example.com\n%msg%"
$template smsBody,"%programname%, 44711111111, %hostname% %rawmsg%\n"
$ActionMailSubject filerrSubject
$ActionExecOnlyOnceEveryInterval 50
if $programname == 'FILERR' then :ommail:;filerrBody
$ModLoad omprog
$actionomprogbinary /usr/bin/alert
if $programname == 'FILERR' then :omprog:;smsBody
if $programname =='FILERR'
&~
this looks wrong
do you really mean to have this partial if statement?
David Lang
Now data from program USERLOG correctly only goes into user.log Data
from FILERR however, seems to go into filerr.log and also into my
later defined local6.log. Any ideas why?
Also $ActionExecOnlyOnceEveryInterval 50 seems to effect everything
after that statement for that facility, Can i restrict it to only
taking effect for this programname? Or just this one line below - then
i could have different times for sms to email?
Thanks
Mark
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
