Question, how would you track more than one count?
If the variable set was $!<appname> or $!<gf_code>, this would be obvious, but
it looks like you used $!mmcount, which is the module name.
Why do you have both an appname and a key?
Also, now that we have added the concept of local variables (things that won't
show up if you output $! or $!json-all), should these counts be moved from the
$! namespace to the $. local namespace?
David Lang
On Thu, 23 May 2013, Balamurugan Arumugam wrote:
Here is a new message modifier plugin (mmcount) attached as patch file which
counts each log messages by severity or json property of given app-name. Below
is more information from commit log
This module provides the capability to count log messages by severity
or json property of given app-name. The count value is added into the
log message as json property named 'mmcount'
Example usage of the module in the configuration file
module(load="mmcount")
# count each severity of appname gluster
action(type="mmcount" appname="gluster")
# count each value of gf_code of appname gluster
action(type="mmcount" appname="glusterd" key="!gf_code")
# count value 9999 of gf_code of appname gluster
action(type="mmcount" appname="glusterfsd" key="!gf_code" value="9999")
# send email for every 50th mmcount
if $app-name == 'glusterfsd' and $!mmcount <> 0 and $!mmcount % 50 == 0 then {
$ActionMailSMTPServer smtp.example.com
$ActionMailFrom [email protected]
$ActionMailTo [email protected]
$template mailSubject,"50th message of gf_code=9999 on %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
$ActionExecOnlyOnceEveryInterval 30
:ommail:;RSYSLOG_SyslogProtocol23Format
}
Please provide your feedback by reviewing the patch.
Thanks in advance,
Regards,
Bala
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
