On Fri, 2 Aug 2013, Xu, Shouxin wrote:
Thanks David,
My rsyslog version is 7.4.0.
You mean that I could use template, if condition, set variables to
implement that case, such as:
if $syslogfacility == 16 then set $!cfac = 20 else set $!cfac = 1;
set $!cpri = ($!cfac)*8 + ($syslogseverity);
template(name="listFormat" type="list") {
constant(value="<")
property(name="$!cpri")
constant(value=">1")
constant(value=" ")
property(name="timestamp" dateFormat="rfc3339")
constant(value=" ")
property(name="hostname")
constant(value=" - - ")
property(name="msg")
constant(value="\n")
}
Is that correct? Thank you!
exactly the type of thing I was thinking of (note, I think you need a ';' before
the else as part of the set)
David Lang
Best regards,
Eason
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of David Lang
Sent: Wednesday, July 31, 2013 4:20 PM
To: rsyslog-users
Subject: Re: [rsyslog] need a help about configure file(template & modify)
On Wed, 31 Jul 2013, Xu, Shouxin wrote:
Hi, all
I want to modify the PRI or FACILITY for the specific message.
For example, I call syslog API with params that FACILITY equals
SECURITY, could rsyslog change it to LOCAL0(according to custom rules)
then send to the destination? (I compared syslog-ng which could modify
MESSAGE, HOST, etc, but could not modify FACILITY, LEVEL which is
syslog API's params.)
If it could, how to write the rsyslog configuration file?
Yes you can (indire ctly), there are several possible ways to do this.
In any case, you will need to create a different template to output the message.
With earlier versions, you will need to create a set of templates, one for each
severity level, and then output with the correct template.
With version 7 you can use the variables that you can define to calculate the
new pri value and have that in the template for the outbound message
Could also recommend some reference about using rsyslog except its doc. Thank
you!
I'm not aware of a lot of other references other than the documentation
included with the packages and on the website, what sort of thing are you
looking for?
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
============================================================
The information contained in this message may be privileged
and confidential and protected from disclosure. If the reader
of this message is not the intended recipient, or an employee
or agent responsible for delivering this message to the
intended recipient, you are hereby notified that any reproduction,
dissemination or distribution of this communication is strictly
prohibited. If you have received this communication in error,
please notify us immediately by replying to the message and
deleting it from your computer. Thank you. Tellabs
============================================================
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
