> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Thursday, May 31, 2012 9:32 PM > To: rsyslog-users > Subject: Re: [rsyslog] beginner error? setting up raw message logging > > hmm, looking at this I am not seeing anything obviously wrong. > > one minor note, rsyslog reads the included files in inode order, not > filename order, so 30* is not necessarily before 50*, but I don't think > that matters in this case.
Actually, I am calling glob() so that it should return files in filename order. Rainer > > nothing in this configuration would cause the message to be discarded, > which means that it will get logged to every file where the criteria > matches, so even once we get it working to the mark-test file, it will > still appear in the messages file. > > could you configure a destination to use the RSYSLOG_Debug format and do > your logger test so that we can see for sure what it's getting logged as? > > David Lang > > > > On Tue, 29 May 2012, Mark Stosberg wrote: > > > On 05/25/2012 01:23 PM, [email protected] wrote: > >> On Fri, 25 May 2012, Mark Stosberg wrote: > >> > >>> Hello, > >>> > >>> I'm working on configuring rsyslog to simply log CSV lines that are > >>> passed to it. All I really want Rsyslog to do is to pass the string > >>> provided straight to a file. > >>> > >>> I tried many variations of this: > >>> > >>> $template Untouched,"%rawmsg%" > >>> local5.* /var/log/mark-test;Untouched > >>> > >>> But my test file is never logged to. Instead, logging goes to > >>> /var/log/messages and my template is ignored. > >>> > >>> I'm using rsyslog 4.2.0. > >>> > >>> What am I missing? > >> > >> I think we would need to see the rest of the config file. > > > > Thanks for the reply. That's included below. > > > >> Also, what do you do to set the facility to local5? > > > > I can't get it to work with just a basic call to logger: > > > > logger -p local5.info 123 "this is a test" > > > > I'm actually calling it through Perl and Log::Dispatch::Syslog, but I > > don't think the problem is there, as I modeled the new call on already > > successful calls to syslog, and the basic test with 'logger' is failing > > as well. > > > > Thanks for taking a second look. I appreciate the help! > > > > Mark > > > > ## Contents of /etc/rsyslog.conf > > ################################### > > # /etc/rsyslog.conf Configuration file for rsyslog. > > # > > # For more information see > > # /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html > > # > > # Default logging rules can be found in /etc/rsyslog.d/50-default.conf > > > > > > ################# > > #### MODULES #### > > ################# > > > > $ModLoad imuxsock # provides support for local system logging > > $ModLoad imklog # provides kernel logging support (previously done by > > rklogd) > > #$ModLoad immark # provides --MARK-- message capability > > > > $KLogPath /proc/kmsg > > > > # provides UDP syslog reception > > $ModLoad imudp > > $UDPServerRun 514 > > > > # provides TCP syslog reception > > #$ModLoad imtcp > > #$InputTCPServerRun 514 > > > > > > ########################### > > #### GLOBAL DIRECTIVES #### > > ########################### > > > > # > > # Use traditional timestamp format. > > # To enable high precision timestamps, comment out the following line. > > # > > $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat > > > > # Filter duplicated messages > > $RepeatedMsgReduction on > > > > # > > # Set the default permissions for all log files. > > # > > $FileOwner syslog > > $FileGroup adm > > $FileCreateMode 0640 > > $DirCreateMode 0755 > > $Umask 0022 > > $PrivDropToUser syslog > > $PrivDropToGroup syslog > > > > # > > # Include all config files in /etc/rsyslog.d/ > > > > $template Untouched,"%rawmsg%" > > # > > $IncludeConfig /etc/rsyslog.d/*.conf > > > > ############################################### > > # In a "30-app.conf" file, I have this: > > > > > > local5.* /var/log/mark-test;Untouched > > > > #################################################### > > # Then there is a 50-default.conf file, which contains this: > > > > # Default rules for rsyslog. > > # > > # For more information see rsyslog.conf(5) and /etc/rsyslog.conf > > > > # > > # First some standard log files. Log by facility. > > # > > auth,authpriv.* /var/log/auth.log > > *.*;auth,authpriv.none -/var/log/syslog > > #cron.* /var/log/cron.log > > daemon.* -/var/log/daemon.log > > kern.* -/var/log/kern.log > > lpr.* -/var/log/lpr.log > > mail.* -/var/log/mail.log > > user.* -/var/log/user.log > > > > # > > # Logging for the mail system. Split it up so that > > # it is easy to write scripts to parse these files. > > # > > mail.info -/var/log/mail.info > > mail.warn -/var/log/mail.warn > > mail.err /var/log/mail.err > > > > # > > # Logging for INN news system. > > # > > news.crit /var/log/news/news.crit > > news.err /var/log/news/news.err > > news.notice -/var/log/news/news.notice > > > > # > > # Some "catch-all" log files. > > # > > *.=debug;\ > > auth,authpriv.none;\ > > news.none;mail.none -/var/log/debug > > *.=info;*.=notice;*.=warn;\ > > auth,authpriv.none;\ > > cron,daemon.none;\ > > mail,news.none -/var/log/messages > > > > # > > # Emergencies are sent to everybody logged in. > > # > > *.emerg * > > > > # > > # I like to have messages displayed on the console, but only on a virtual > > # console I usually leave idle. > > # > > #daemon,mail.*;\ > > # news.=crit;news.=err;news.=notice;\ > > # *.=debug;*.=info;\ > > # *.=notice;*.=warn /dev/tty8 > > > > # The named pipe /dev/xconsole is for the `xconsole' utility. To use it, > > # you must invoke `xconsole' with the `-file' option: > > # > > # $ xconsole -file /dev/xconsole [...] > > # > > # NOTE: adjust the list below, or you'll go crazy if you have a reasonably > > # busy site.. > > # > > daemon.*;mail.*;\ > > news.err;\ > > *.=debug;*.=info;\ > > *.=notice;*.=warn |/dev/xconsole > > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards
