On Mon, Jun 10, 2013 at 6:47 PM, Aleksandar Lazic <[email protected]>wrote:
> Hi, > > Am 10-06-2013 18:16, schrieb Rainer Gerhards: > > On Mon, Jun 10, 2013 at 4:40 PM, Aleksandar Lazic <[email protected] >> >wrote: >> >> Dear list-member. >>> >>> I try to write all unbound syslog messages into the file >>> /var/log/unbound.log >>> >>> ### cat /etc/rsyslog.d/21-unbound.conf >>> if $programname == "unbound" then /var/log/unbound.log >>> ### >>> >>> >>> I have to admit I do not fully understand the question. Do you actually >> have some program that logs with the name "unbounded"? Or do you mean >> everything that is not from a given set of program names? >> > > Sorry for not clear question. > > I use unbound ( http://unbound.net/ ) for dns resolving. > > This the syslog line > > #### > Jun 10 15:11:32 external unbound: [5017:2] info: 127.0.0.1 > 43.135.47.213.in-addr.arpa. PTR IN > #### > > I was not able to configure rsyslog that he write a seperate log for > unbound messages. > I thought that 'unbound' is the $programname but maybe I'am wrong. > > you should check what the fields actually contain. I finally blogged this FAQ-like entry on it: http://blog.gerhards.net/2013/06/rsyslog-how-can-i-see-which-field.html Rainer > Thx, >> Rainer >> > > BR > Aleks > > after a host www.none.at I have only the message in /var/log/syslog but >>> not in /var/log/unbound.log >>> >>> >>> My setup: >>> >>> ### >>> lsb_release -a >>> No LSB modules are available. >>> Distributor ID: Ubuntu >>> Description: Ubuntu 12.04.2 LTS >>> Release: 12.04 >>> Codename: precise >>> ### >>> >>> rsyslogd -v >>> rsyslogd 7.4.0, compiled with: >>> FEATURE_REGEXP: Yes >>> FEATURE_LARGEFILE: No >>> GSSAPI Kerberos 5 support: Yes >>> FEATURE_DEBUG (debug build, slow code): No >>> 32bit Atomic operations supported: Yes >>> 64bit Atomic operations supported: Yes >>> Runtime Instrumentation (slow code): No >>> uuid support: Yes >>> >>> See http://www.rsyslog.com for more information. >>> #### >>> >>> /usr/sbin/rsyslogd -dn > rsyslogd-debug_01.log >>> >>> http://download.none.at/**rsyslogd-debug_01.log<http://download.none.at/rsyslogd-debug_01.log> >>> <http://**download.none.at/rsyslogd-**debug_01.log<http://download.none.at/rsyslogd-debug_01.log> >>> > >>> >>> ### >>> >>> Thanks for any help. >>> >>> BR Aleks >>> >>> ______________________________****_________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> > >>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>> > >>> >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST >> if you DON'T LIKE THAT. >> > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
