Thanks David.
And also I found the "[rsyslogd] <defunct>" maybe because of wrong set
and calculate syntax which is solved now.
I haven't make the package and not familiar with this...
Best regards,
Eason
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of David Lang
Sent: Friday, August 02, 2013 6:18 PM
To: rsyslog-users
Subject: Re: [rsyslog] need a help about configure file(template & modify)
On Fri, 2 Aug 2013, Xu, Shouxin wrote:
> Thanks David,
>
> My rsyslog version is 7.4.0.
>
> You mean that I could use template, if condition, set variables to
> implement that case, such as:
>
> if $syslogfacility == 16 then set $!cfac = 20 else set $!cfac = 1;
>
> set $!cpri = ($!cfac)*8 + ($syslogseverity);
>
> template(name="listFormat" type="list") {
> constant(value="<")
> property(name="$!cpri")
> constant(value=">1")
> constant(value=" ")
> property(name="timestamp" dateFormat="rfc3339")
> constant(value=" ")
> property(name="hostname")
> constant(value=" - - ")
> property(name="msg")
> constant(value="\n")
> }
>
> Is that correct? Thank you!
exactly the type of thing I was thinking of (note, I think you need a ';'
before the else as part of the set)
David Lang
> Best regards,
> Eason
>
>
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of David Lang
> Sent: Wednesday, July 31, 2013 4:20 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] need a help about configure file(template &
> modify)
>
> On Wed, 31 Jul 2013, Xu, Shouxin wrote:
>
>> Hi, all
>>
>> I want to modify the PRI or FACILITY for the specific message.
>> For example, I call syslog API with params that FACILITY equals
>> SECURITY, could rsyslog change it to LOCAL0(according to custom
>> rules) then send to the destination? (I compared syslog-ng which
>> could modify MESSAGE, HOST, etc, but could not modify FACILITY, LEVEL
>> which is syslog API's params.)
>>
>> If it could, how to write the rsyslog configuration file?
>
> Yes you can (indire ctly), there are several possible ways to do this.
>
> In any case, you will need to create a different template to output the
> message.
>
> With earlier versions, you will need to create a set of templates, one for
> each severity level, and then output with the correct template.
>
> With version 7 you can use the variables that you can define to
> calculate the new pri value and have that in the template for the
> outbound message
>
>> Could also recommend some reference about using rsyslog except its doc.
>> Thank you!
>
> I'm not aware of a lot of other references other than the documentation
> included with the packages and on the website, what sort of thing are you
> looking for?
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This
> is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
>
> ============================================================
> The information contained in this message may be privileged and
> confidential and protected from disclosure. If the reader of this
> message is not the intended recipient, or an employee or agent
> responsible for delivering this message to the intended recipient, you
> are hereby notified that any reproduction, dissemination or
> distribution of this communication is strictly prohibited. If you have
> received this communication in error, please notify us immediately by
> replying to the message and deleting it from your computer. Thank you.
> Tellabs ============================================================
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
============================================================
The information contained in this message may be privileged
and confidential and protected from disclosure. If the reader
of this message is not the intended recipient, or an employee
or agent responsible for delivering this message to the
intended recipient, you are hereby notified that any reproduction,
dissemination or distribution of this communication is strictly
prohibited. If you have received this communication in error,
please notify us immediately by replying to the message and
deleting it from your computer. Thank you. Tellabs
============================================================
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
