Hey all,
I'm using rsyslog to deal with the output from a rather large code-base
right now (log4j's syslog appender). I am forwarding messages to a remote
server and using templates to dynamically generate the filenames on my
server (/log/YYYYMMDD/.....). I have a lot of different components, so
they are all using the same selector, but are differentiated by their
%programname%.
The problem I'm having is that whenever I get a question mark '?'
character in the actual %msg% ( I also tried %rawmsg% ), it does the
following:
*) in the main log file
- TextUpToMark...
*) in the same dir (by hostname )
- a new file that is '....TextAfterMark'
- this file contains the rest of the line
I tried the latest stable release (5.8.10) and it still seems to do this
same thing, I'm not sure if this is a bug, or just bad configuration on my
part
rsyslog.conf excerpt:
$template
DynFile,"/log/%timegenerated:1:10:date-rfc3339%/%fromhost:1:2%/%programname%.log"
:fromhost-ip , !isequal , "127.0.0.1" ?DynFile
It's obvious to me that the '?' has significance here, Just wondering if
there is any way around it?
Thanks!
--Scott
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
