On Wed, 12 Jun 2013, Aleksandar Lazic wrote:
Hi,
Am 12-06-2013 17:20, schrieb Rainer Gerhards:
On Mon, Jun 10, 2013 at 11:18 PM, Aleksandar Lazic
<[email protected]>wrote:
[snipp]
So the programname == 'unbound' the logfile is created.
sorry - so do you say it works (the rest of the message somehow does not
look so ;))?
Nope. it does not work. I just mean that the programname is unbound.
I have no moved more and more to RainerScript, but still I don't get what I
wanted.
Due to the fact that I'am try to come to a solution you can find my current
configs in this archive
http://download.none.at/rsyslog_confs.tar.gz
What I'am not understand is that in
/etc/rsyslog.d/50-default.conf
...
mail.* -/var/log/mail.log
...
works but in /etc/rsyslog.d/21-postfix.conf
###
input(type="imuxsock" Socket="/var/spool/postfix/dev/log")
if $programname == 'postfix' then {
action(type="omfile" name="postfix"
DirCreateMode="0755"
FileCreateMode="0644"
Sync="on"
FileOwner="syslog"
FileGroup="adm"
File=" /var/log/postfix.log")
stop
}
###
does not work.
what doesn't work about it?
i'll note that the logs I've seen from postfix don't have the programname ==
'postfix', they have things like 'postfix/master', so it's very possible that
your test is just wrong.
In addition, there are conflicts between setting file ownee/group and dropping
privilages in many cases. Since we don't have your full config we can't see if
that's what's happening.
I'll also note that turning sync on will drastically reduce your write
performance (down to ~100 messges/sec on a standard 7200 rpm drive)
in cases like this, the first thing to do is to simplify your config to see what
part is failing. Is the test working? if so, what of the other options makes it
quit working? If not, log with the RSYSLOG_DebugFormat to see what the the
fields really contain as per this post
http://blog.gerhards.net/2013/06/rsyslog-how-can-i-see-which-field.html
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
