Thanks! It is working. I was missing the "-" and was using a comma instead of semicolon.
One more question... the way I have my dynamic log file creation configured it is creating new log files every hour. Is there a way to do it every 15 minutes? So something like: $template RemoteHost,"/var/log/rsyslog/ELI/%PROCID%/%syslogtag:R,ERE,1,DFLT:\[[^]]+\]\[([^]]+)\]\[[^]]+\]--end%/%HOSTNAME%/eli-%$YEAR%%$MONTH%%$DAY%%$HOUR%%MINUTE+15%.log" Or is this more of a logrotate configuration? -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Rainer Gerhards Sent: Friday, March 09, 2012 8:09 AM To: rsyslog-users Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... Cehck http://www.rsyslog.com/article60/ So roughly $template DynaFile,"/var/log/system-%HOSTNAME%.log" $template msg,"%msg%\n" *.* -?DynaFile;msg rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Martinez, Carlos R > Sent: Friday, March 09, 2012 4:05 PM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > Thank you... I have done that but it did not work... I'll keep > working with it... I'm sure I'll figure it out. > > Thanks again for your help... > > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Friday, March 09, 2012 7:56 AM > To: rsyslog-users > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > Use the example I provided for the message format part and combine it > with what you already have fort he filename (I don't know the exact > syntax out of my head and haeve no time to look it up). > > Rainer > > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Martinez, Carlos R > > Sent: Friday, March 09, 2012 3:52 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > > > Right... so how do I configure everything that goes into these > > dynamically created files to only show %msg%? > > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Rainer Gerhards > > Sent: Friday, March 09, 2012 7:45 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > > > Tjhis is the template for file name creation. It's a different one > for > > the format itself. > > > > rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Martinez, Carlos R > > > Sent: Friday, March 09, 2012 2:33 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > > > > > I guess I'm making it harder then what it needs to be.... I'm > > > building my directory structure (dynamically) based on the syslog > > > information being received and not too sure how to include the > %msg% > > > into the > > > template: > > > > > > $template > > > > > > RemoteHost,"/var/log/rsyslog/ELI/%PROCID%/%SYSLOGTAG:R,ERE,1,DFLT:\[[^ > > > ] > > > ]+\]\[([^]]+)\]\[[^]]+\]--end%/%HOSTNAME%/eli- > > > %$YEAR%%$MONTH%%$DAY%%$HOUR%.log" > > > > > > How do configure %msg% in the template I created above? I'm > > > probably missing something obvious or there additional > configuration required. > > > > > > Thanks! > > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Rainer Gerhards > > > Sent: Friday, March 09, 2012 12:22 AM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] rsyslog | how to remove syslog header.... > > > > > > Try > > > > > > $template msgonly,"%msg%\n" > > > *.* /path/to/testfile;msgonly > > > > > > If it works depends on what you actually mean with "just the > > message". > > > > > > rainer > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of Martinez, Carlos R > > > > Sent: Friday, March 09, 2012 2:07 AM > > > > To: [email protected] > > > > Subject: [rsyslog] rsyslog | how to remove syslog header.... > > > > > > > > I'm a very new rsyslog server user and I'm looking for a way to > > > > strip the header information of incoming syslog messages and > > > > only log just the message. > > > > > > > > It looks like I'll have to create a template of some sort. > > > > > > > > Thanks in advance! > > > > > > > > > > > > Carlos R. Martinez > > > > Charles Schwab & Co., Inc. > > > > Technology Infrastructure Services Distributed Services - > > > > Distributed Business Integration > > > > > > > > onsite: 602.977.8572 > > > > email: > > > > [email protected]<mailto:[email protected] > > > > > > > > > > > > > Charles Schwab | T E C H N O L O G Y I N N O V A T I O N > > > > WARNING: All email sent to or from the Charles Schwab corporate > > > > email system is subject to archiving, monitoring and/or review > > > > by Schwab personnel. > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com/professional-services/ > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
