On Thu, 5 Apr 2012, Jo Rhett wrote:
On Wed, 4 Apr 2012, Jo Rhett wrote:
What I want to do is:
$template MyTemplate,"unique %FROMHOST% %MSG%"
$template SyslogHost,"@@hostname:514;MyTemplate"
local0.* ?SyslogHost
This is to replace a syslog-ng implementation which has a syntax that does this:
destination SyslogHost { tcp("hostname" port(514) template("unique $HOST
$MSGONLY\n")); };
On Apr 4, 2012, at 11:06 PM, [email protected] wrote:
the templates are used for either the message itself, or the local filename to
write to, not for other uses
so you would do
local0.* @@hostname;MyTemplate
to send via TCP to hostname using the message format in MyTemplate
the ? action is used for if you want to write to different file names based on
the contents of the message.
The issue is the repeating of identical information throughout the
rsyslog.conf. With a few hundred lines, and dozens of references to the
same loghost, same port, etc it becomes somewhat silly to make changes.
It would be very useful to be able to define the hostname, port and
potentially the format in a single place. (as syslog-ng allows)
rsyslog does not currently support the concept of combining the
destination with the format the way that syslog-ng does. Personally I've
had more headaches working around the syslog-ng way of doing things where
I end up having to repeat the same information many times in all the
templates :-)
that being said, you should probably look into the rulesets feature. It
would allow you to have filter criteria that direct the log to a specific
ruleset. That ruleset can then have additional filter criteria if needed,
and then can specify the destination and template.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
