Hi rsyslog users,
I try to define a scheme which gives users a way to chose if messages
should be written on their server filesystem and if they should be
forwarded to syslog collectors.
Here is my test configuration :
---
module(load="imuxsock")
# Default: All messages should be written locally
set $!rsyslog_write = 1;
# Default: All messages should be forwarded to collectors
set $!rsyslog_forward = 1;
# When a message with the custom tag is matched,
# extract write and forwarding information.
#
# Tag syntax: FOO-appName-flag
#
# Flag values:
# - 0: drop message
# - 1: don't write message
# - 2: don't forward message
# - 3: write and forward message (default)
#
if re_match($app-name, "^FOO-[^-]+-([0123])") then {
set $!rsyslog_flag = cnum(field($app-name, 45, 3));
if $!rsyslog_flag == 0 then {
unset $!rsyslog_write;
unset $!rsyslog_forward;
} else if $!rsyslog_flag == 1 then {
unset $!rsyslog_write;
} else if $!rsyslog_flag == 2 then {
unset $!rsyslog_forward;
}
}
# Write all messages for debugging
template(name="cee-debug" type="string" string="msg: \"%msg%\", json:
%$!all-json%\n")
action(name="cee-debug" type="omfile" file="/tmp/cee-debug"
template="cee-debug")
---
And that's how I tested it :
# logger -t FOO-bar-0 test-0
# logger -t FOO-bar-1 test-1
# logger -t FOO-bar-2 test-2
# logger -t FOO-bar-3 test-3
# cat /tmp/cee-debug
msg: " test-0", json: { "rsyslog_write": 1, "rsyslog_forward": 1,
"rsyslog_flag": 0 }
msg: " test-1", json: { "rsyslog_write": 1, "rsyslog_forward": 1,
"rsyslog_flag": 1 }
msg: " test-2", json: { "rsyslog_write": 1, "rsyslog_forward": 1,
"rsyslog_flag": 2 }
msg: " test-3", json: { "rsyslog_write": 1, "rsyslog_forward": 1,
"rsyslog_flag": 3 }
Messages are matched by re_match(), $!rsyslog_flag is well extracted from
the tag, but none of the tests on $!rsyslog_flag seem to be evaluated
successfully.
I tested the same config without cnum() + testing $!rsyslog_flag with
strings => same results.
Is there something I'm missing regarding nested if statements ?
If that's the expected behavior, I would be grateful for clarification. :-)
Regards,
Philippe Muller
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
