Aha! PStatSeverity instead of PStatsSeverity. Thanks Rainer!
Brian On Wed, May 2, 2012 at 7:23 AM, Brian Knox <[email protected]> wrote: > So I changed to this: > > > $ModLoad immark # provides -MARK- message capability > $ModLoad imuxsock # provides support for local system logging (e.g. > via logger command) > $ModLoad imklog # kernel logging (formerly provided by rklogd) > $ModLoad impstats # impstats > > $PStatsInterval 2 > $PStatsSeverity 7 > $PStatJSON on > > if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log > > if ($syslogfacility-text == 'authpriv') then { > action(type="omfile" file="/var/log/secure" name="authpriv") > > } > if ($syslogfacility-text == 'mail') then { > action(type="omfile" file="/var/log/maillog" name="mail") > > } > > if ($syslogfacility-text == 'cron') then { > action(type="omfile" file="/var/log/cron" name="cron") > > } > > if ($syslogpriority-text =='info') then { > action(type="omfile" file="/var/log/messages" name="info") > > } > > if ($syslogfacility-text == 'local7') then { > action(type="omfile" file="/var/log/boot.log" name="local7") > } > > And this is working: > > 2012-05-02T07:22:31.236265-04:00 localhost rsyslogd-pstats: @cee: > {"name":"action 1","processed":184,"failed":0} > 2012-05-02T07:22:31.236272-04:00 localhost rsyslogd-pstats: @cee: > {"name":"authpriv","processed":0,"failed":0} > 2012-05-02T07:22:31.236278-04:00 localhost rsyslogd-pstats: @cee: > {"name":"mail","processed":0,"failed":0} > 2012-05-02T07:22:31.236284-04:00 localhost rsyslogd-pstats: @cee: > {"name":"cron","processed":0,"failed":0} > 2012-05-02T07:22:31.236289-04:00 localhost rsyslogd-pstats: @cee: > {"name":"info","processed":185,"failed":0} > 2012-05-02T07:22:31.236295-04:00 localhost rsyslogd-pstats: @cee: > {"name":"local7","processed":0,"failed":0} > 2012-05-02T07:22:31.236303-04:00 localhost rsyslogd-pstats: @cee: > {"name":"main Q","size":7,"enqueued":193,"full":0,"discarded.full":0," > discarded.nf":0,"maxqsize":8} > > Although I've still got a bug somewhere in my conf: > > > [root@moneta log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf > rsyslogd: version 6.3.8, config validation run (level 1), master config > /etc/rsyslog.conf > rsyslogd: invalid or yet-unknown config file command - have you forgotten > to load a module? [try http://www.rsyslog.com/e/3003 ] > rsyslogd: End of config validation run. Bye. > [root@moneta log]# > > Getting closer though :) > > > On Wed, May 2, 2012 at 7:20 AM, Brian Knox <[email protected]> wrote: > >> Aha! The problem seems to by my omfile action is not correct to begin >> with. I'm basing the config off of this post: >> >> http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/ >> >> Here's what I'm trying: >> >> $ModLoad immark # provides -MARK- message capability >> $ModLoad imuxsock # provides support for local system logging (e.g. >> via logger command) >> $ModLoad imklog # kernel logging (formerly provided by rklogd) >> $ModLoad impstats # impstats >> >> $PStatsInterval 2 >> $PStatsSeverity 7 >> $PStatJSON on >> >> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log >> >> if ($syslogfacility-text == 'authpriv') then { >> action(type="omfile" target="/var/log/secure") >> } >> if ($syslogfacility-text == 'mail') then { >> action(type="omfile" target="/var/log/maillog") >> } >> >> if ($syslogfacility-text == 'cron') then { >> action(type="omfile" target="/var/log/cron") >> } >> >> if ($syslogpriority-text =='info') then { >> action(type="omfile" target="/var/log/messages") >> } >> >> if ($syslogfacility-text == 'local7') then { >> action(type="omfile" target="/var/log/boot.log") >> } >> >> and I'm getting: >> >> [root@moneta log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf >> rsyslogd: version 6.3.8, config validation run (level 1), master config >> /etc/rsyslog.conf >> rsyslogd: invalid or yet-unknown config file command - have you forgotten >> to load a module? [try http://www.rsyslog.com/e/3003 ] >> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given >> [try http://www.rsyslog.com/e/2211 ] >> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13 >> rsyslogd: warning: selector line without actions will be discarded >> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given >> [try http://www.rsyslog.com/e/2211 ] >> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16 >> rsyslogd: warning: selector line without actions will be discarded >> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given >> [try http://www.rsyslog.com/e/2211 ] >> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20 >> rsyslogd: warning: selector line without actions will be discarded >> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given >> [try http://www.rsyslog.com/e/2211 ] >> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24 >> rsyslogd: warning: selector line without actions will be discarded >> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given >> [try http://www.rsyslog.com/e/2211 ] >> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28 >> rsyslogd: warning: selector line without actions will be discarded >> rsyslogd: End of config validation run. Bye. >> >> >> >> On Wed, May 2, 2012 at 7:14 AM, Brian Knox <[email protected]> wrote: >> >>> It looks like maybe the ommongo output is accepting name and omfile may >>> not be - I'll start a debug log and take a look after I get some coffee! >>> >>> Brian >>> >>> >>> On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards < >>> [email protected]> wrote: >>> >>>> >>>> >>>> > -----Original Message----- >>>> > From: [email protected] [mailto:rsyslog- >>>> > [email protected]] On Behalf Of Brian Knox >>>> > Sent: Wednesday, May 02, 2012 1:02 PM >>>> > To: rsyslog-users >>>> > Subject: Re: [rsyslog] action names >>>> > >>>> > Hmm just tried that and not seeing it take effect, let me poke at it >>>> for a >>>> > few. >>>> >>>> Maybe you hit a bug... have a look at the debug file when the action is >>>> defined. It tells you which params it understood. >>>> >>>> Raienr >>>> > >>>> > Brian >>>> > >>>> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards >>>> > <[email protected]>wrote: >>>> > >>>> > > > -----Original Message----- >>>> > > > From: [email protected] [mailto:rsyslog- >>>> > > > [email protected]] On Behalf Of Brian Knox >>>> > > > Sent: Wednesday, May 02, 2012 12:59 PM >>>> > > > To: rsyslog-users >>>> > > > Subject: Re: [rsyslog] action names >>>> > > > >>>> > > > Oh! I must have missed that in the docs! >>>> > > >>>> > > Np >>>> > > >>>> > > > >>>> > > > Is this also settable via the new config 6 syntax? >>>> > > >>>> > > name="xxx" >>>> > > Rainer >>>> > > > >>>> > > > Brian >>>> > > > >>>> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards >>>> > > > <[email protected]>wrote: >>>> > > > >>>> > > > > > -----Original Message----- >>>> > > > > > From: [email protected] [mailto:rsyslog- >>>> > > > > > [email protected]] On Behalf Of Brian Knox >>>> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM >>>> > > > > > To: rsyslog-users >>>> > > > > > Subject: [rsyslog] action names >>>> > > > > > >>>> > > > > > I have an issue I'd like to solve concerning action names in >>>> the >>>> > > stats >>>> > > > > > module. While I could solve it in a local fork, if it can be >>>> solved >>>> > > in >>>> > > a >>>> > > > > > way that would be useful to others and incorporated back into >>>> rsyslog >>>> > > > > > that's my preference. >>>> > > > > > >>>> > > > > > Here's some current output from a test configuration, with >>>> JSON >>>> > > impstats >>>> > > > > > enabled: >>>> > > > > > >>>> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 1","processed":1696,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 2","processed":396,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 3","processed":1320,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 4","processed":1144,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 5","processed":1144,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 6","processed":68,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 7","processed":0,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 8","processed":26,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 9","processed":283,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 10","processed":0,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 11","processed":0,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 12","processed":520,"failed":0} >>>> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: >>>> @cee: >>>> > > > > > {"name":"action 12 >>>> > > > > > >>>> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0," >>>> discarded.nf >>>> > > > > > ":0,"maxqsize":5} >>>> > > > > > >>>> > > > > > My issue is that action names have spaces in them. This makes >>>> using >>>> > > the >>>> > > > > > action names as keys in some key value stores problematic. >>>> > > Ultimately, >>>> > > I >>>> > > > > > would love to be able to pass a configuration option to each >>>> action >>>> > > > > > explicitly naming it. >>>> > > > > >>>> > > > > $ActionName ;) >>>> > > > > >>>> > > > > So I think we can keep the default names, right? >>>> > > > > >>>> > > > > Rainer >>>> > > > > < Short term, my problem would be solved if the spaces >>>> > > > > > were replaced by an underscore. >>>> > > > > > >>>> > > > > > Off the top of my head I can think of a couple of ways to do >>>> this: >>>> > > > > > >>>> > > > > > 1 - simply change whatever routine is generating the names to >>>> produce >>>> > > > > > "action_1", etc. >>>> > > > > > 2 - add a property formatter that replaces spaces with >>>> underscores, >>>> > > that >>>> > > > > > could be used after passing this output to mmjsonparse. >>>> > > > > > >>>> > > > > > Thoughts? >>>> > > > > > >>>> > > > > > Brian >>>> > > > > > _______________________________________________ >>>> > > > > > rsyslog mailing list >>>> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > > > > > http://www.rsyslog.com/professional-services/ >>>> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> > > > > _______________________________________________ >>>> > > > > rsyslog mailing list >>>> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > > > > http://www.rsyslog.com/professional-services/ >>>> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> > > > > >>>> > > > _______________________________________________ >>>> > > > rsyslog mailing list >>>> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > > > http://www.rsyslog.com/professional-services/ >>>> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> > > _______________________________________________ >>>> > > rsyslog mailing list >>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > > http://www.rsyslog.com/professional-services/ >>>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> > > >>>> > _______________________________________________ >>>> > rsyslog mailing list >>>> > http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > http://www.rsyslog.com/professional-services/ >>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> >>> >>> >> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
