On Thu, May 2, 2013 at 12:26 PM, Balamurugan Arumugam <[email protected]>wrote:
> > > ----- Original Message ----- > > From: "Rainer Gerhards" <[email protected]> > > To: "rsyslog-users" <[email protected]> > > Sent: Thursday, May 2, 2013 3:22:51 PM > > Subject: Re: [rsyslog] counting messages in a rule > > > > On Thu, May 2, 2013 at 11:39 AM, Balamurugan Arumugam > > <[email protected]>wrote: > > > > > > > > Hello list, > > > > > > I would like to count and set for given app-name and syslogseverity. > For > > > example, > > > > > > count = 0 > > > if $app-name == 'gluster' and $syslogseverity-text == 'crit' then { > > > count = count + 1 > > > set $!usr!count = count > > > > > > > set $!usr!count = $!usr!count + 1; > > > It doesn't work as expected. > > I didn't pay close enough attention. You want to have a message counter. Therfore you need global variables. They are not available yet. I did not implement them as I was/am very curios if they are actually needed. What's the use case behind this request? Thx, Rainer > > [2013-05-02T15:53:32.217691+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > [2013-05-02T15:53:32.217753+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > [2013-05-02T15:53:32.279690+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > [2013-05-02T15:53:32.279708+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > [2013-05-02T15:53:32.279822+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > [2013-05-02T15:53:32.279834+05:30] { "pid": 4188, "uid": 0, "gid": 0, > "appname": "gluster", "exe": "\/usr\/sbin\/gluster", "cmd": "gluster --xml > --mode=script volume info ", "usr": { "count": 1 } } > > Is this known issue in rsyslog-7.3.9 from fedora rawhide on fedora 18? > > Thanks, > Bala > > > > Rainer > > > > > } > > > > > > Could someone give me a pointer how I can achieve this? > > > > > > > > > Thanks in advance, > > > > > > Regards, > > > Bala > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T LIKE THAT. > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
