So I changed to this:
$ModLoad immark # provides -MARK- message capability
$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)
$ModLoad impstats # impstats
$PStatsInterval 2
$PStatsSeverity 7
$PStatJSON on
if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
if ($syslogfacility-text == 'authpriv') then {
action(type="omfile" file="/var/log/secure" name="authpriv")
}
if ($syslogfacility-text == 'mail') then {
action(type="omfile" file="/var/log/maillog" name="mail")
}
if ($syslogfacility-text == 'cron') then {
action(type="omfile" file="/var/log/cron" name="cron")
}
if ($syslogpriority-text =='info') then {
action(type="omfile" file="/var/log/messages" name="info")
}
if ($syslogfacility-text == 'local7') then {
action(type="omfile" file="/var/log/boot.log" name="local7")
}
And this is working:
2012-05-02T07:22:31.236265-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 1","processed":184,"failed":0}
2012-05-02T07:22:31.236272-04:00 localhost rsyslogd-pstats: @cee:
{"name":"authpriv","processed":0,"failed":0}
2012-05-02T07:22:31.236278-04:00 localhost rsyslogd-pstats: @cee:
{"name":"mail","processed":0,"failed":0}
2012-05-02T07:22:31.236284-04:00 localhost rsyslogd-pstats: @cee:
{"name":"cron","processed":0,"failed":0}
2012-05-02T07:22:31.236289-04:00 localhost rsyslogd-pstats: @cee:
{"name":"info","processed":185,"failed":0}
2012-05-02T07:22:31.236295-04:00 localhost rsyslogd-pstats: @cee:
{"name":"local7","processed":0,"failed":0}
2012-05-02T07:22:31.236303-04:00 localhost rsyslogd-pstats: @cee:
{"name":"main Q","size":7,"enqueued":193,"full":0,"discarded.full":0,"
discarded.nf":0,"maxqsize":8}
Although I've still got a bug somewhere in my conf:
[root@moneta log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
rsyslogd: version 6.3.8, config validation run (level 1), master config
/etc/rsyslog.conf
rsyslogd: invalid or yet-unknown config file command - have you forgotten
to load a module? [try http://www.rsyslog.com/e/3003 ]
rsyslogd: End of config validation run. Bye.
[root@moneta log]#
Getting closer though :)
On Wed, May 2, 2012 at 7:20 AM, Brian Knox <[email protected]> wrote:
> Aha! The problem seems to by my omfile action is not correct to begin
> with. I'm basing the config off of this post:
>
> http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
>
> Here's what I'm trying:
>
> $ModLoad immark # provides -MARK- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g.
> via logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
> $ModLoad impstats # impstats
>
> $PStatsInterval 2
> $PStatsSeverity 7
> $PStatJSON on
>
> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>
> if ($syslogfacility-text == 'authpriv') then {
> action(type="omfile" target="/var/log/secure")
> }
> if ($syslogfacility-text == 'mail') then {
> action(type="omfile" target="/var/log/maillog")
> }
>
> if ($syslogfacility-text == 'cron') then {
> action(type="omfile" target="/var/log/cron")
> }
>
> if ($syslogpriority-text =='info') then {
> action(type="omfile" target="/var/log/messages")
> }
>
> if ($syslogfacility-text == 'local7') then {
> action(type="omfile" target="/var/log/boot.log")
> }
>
> and I'm getting:
>
> [root@moneta log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
> rsyslogd: version 6.3.8, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: invalid or yet-unknown config file command - have you forgotten
> to load a module? [try http://www.rsyslog.com/e/3003 ]
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: End of config validation run. Bye.
>
>
>
> On Wed, May 2, 2012 at 7:14 AM, Brian Knox <[email protected]> wrote:
>
>> It looks like maybe the ommongo output is accepting name and omfile may
>> not be - I'll start a debug log and take a look after I get some coffee!
>>
>> Brian
>>
>>
>> On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards <[email protected]
>> > wrote:
>>
>>>
>>>
>>> > -----Original Message-----
>>> > From: [email protected] [mailto:rsyslog-
>>> > [email protected]] On Behalf Of Brian Knox
>>> > Sent: Wednesday, May 02, 2012 1:02 PM
>>> > To: rsyslog-users
>>> > Subject: Re: [rsyslog] action names
>>> >
>>> > Hmm just tried that and not seeing it take effect, let me poke at it
>>> for a
>>> > few.
>>>
>>> Maybe you hit a bug... have a look at the debug file when the action is
>>> defined. It tells you which params it understood.
>>>
>>> Raienr
>>> >
>>> > Brian
>>> >
>>> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
>>> > <[email protected]>wrote:
>>> >
>>> > > > -----Original Message-----
>>> > > > From: [email protected] [mailto:rsyslog-
>>> > > > [email protected]] On Behalf Of Brian Knox
>>> > > > Sent: Wednesday, May 02, 2012 12:59 PM
>>> > > > To: rsyslog-users
>>> > > > Subject: Re: [rsyslog] action names
>>> > > >
>>> > > > Oh! I must have missed that in the docs!
>>> > >
>>> > > Np
>>> > >
>>> > > >
>>> > > > Is this also settable via the new config 6 syntax?
>>> > >
>>> > > name="xxx"
>>> > > Rainer
>>> > > >
>>> > > > Brian
>>> > > >
>>> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
>>> > > > <[email protected]>wrote:
>>> > > >
>>> > > > > > -----Original Message-----
>>> > > > > > From: [email protected] [mailto:rsyslog-
>>> > > > > > [email protected]] On Behalf Of Brian Knox
>>> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
>>> > > > > > To: rsyslog-users
>>> > > > > > Subject: [rsyslog] action names
>>> > > > > >
>>> > > > > > I have an issue I'd like to solve concerning action names in
>>> the
>>> > > stats
>>> > > > > > module. While I could solve it in a local fork, if it can be
>>> solved
>>> > > in
>>> > > a
>>> > > > > > way that would be useful to others and incorporated back into
>>> rsyslog
>>> > > > > > that's my preference.
>>> > > > > >
>>> > > > > > Here's some current output from a test configuration, with JSON
>>> > > impstats
>>> > > > > > enabled:
>>> > > > > >
>>> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 1","processed":1696,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 2","processed":396,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 3","processed":1320,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 4","processed":1144,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 5","processed":1144,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 6","processed":68,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 7","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 8","processed":26,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 9","processed":283,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 10","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 11","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 12","processed":520,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 12
>>> > > > > >
>>> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
>>> discarded.nf
>>> > > > > > ":0,"maxqsize":5}
>>> > > > > >
>>> > > > > > My issue is that action names have spaces in them. This makes
>>> using
>>> > > the
>>> > > > > > action names as keys in some key value stores problematic.
>>> > > Ultimately,
>>> > > I
>>> > > > > > would love to be able to pass a configuration option to each
>>> action
>>> > > > > > explicitly naming it.
>>> > > > >
>>> > > > > $ActionName ;)
>>> > > > >
>>> > > > > So I think we can keep the default names, right?
>>> > > > >
>>> > > > > Rainer
>>> > > > > < Short term, my problem would be solved if the spaces
>>> > > > > > were replaced by an underscore.
>>> > > > > >
>>> > > > > > Off the top of my head I can think of a couple of ways to do
>>> this:
>>> > > > > >
>>> > > > > > 1 - simply change whatever routine is generating the names to
>>> produce
>>> > > > > > "action_1", etc.
>>> > > > > > 2 - add a property formatter that replaces spaces with
>>> underscores,
>>> > > that
>>> > > > > > could be used after passing this output to mmjsonparse.
>>> > > > > >
>>> > > > > > Thoughts?
>>> > > > > >
>>> > > > > > Brian
>>> > > > > > _______________________________________________
>>> > > > > > rsyslog mailing list
>>> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > > > http://www.rsyslog.com/professional-services/
>>> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > > > _______________________________________________
>>> > > > > rsyslog mailing list
>>> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > > http://www.rsyslog.com/professional-services/
>>> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > > >
>>> > > > _______________________________________________
>>> > > > rsyslog mailing list
>>> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > http://www.rsyslog.com/professional-services/
>>> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > _______________________________________________
>>> > > rsyslog mailing list
>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > http://www.rsyslog.com/professional-services/
>>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > >
>>> > _______________________________________________
>>> > rsyslog mailing list
>>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > http://www.rsyslog.com/professional-services/
>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>
>>
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
