On Tue, Aug 13, 2013 at 12:47 PM, Rainer Gerhards <[email protected]> wrote: > On Tue, Aug 13, 2013 at 2:37 PM, David Lang <[email protected]> wrote: > >> On Tue, 13 Aug 2013, C. L. Martinez wrote: >> >> HI all, >>> >>> Question: Is syslogtag property >>> (http://www.rsyslog.com/doc/**property_replacer.html<http://www.rsyslog.com/doc/property_replacer.html>) >>> the same as tag >>> when imfile module is used?? >>> >>> For example in the following configuration: >>> >>> input(type="imfile" file="/tmp/test.log" tag="testlog:" >>> statefile="/tmp/testlog-state" facility="local6" severity="info") >>> >>> if $syslogtag == 'testlog:' then { >>> action(type="omfwd" protocol="tcp" target="1.1.1.1"..... >>> >>> Is this correct?? >>> >> >> other than the fact that I'm not sure if the : is part of syslogtag, yes. >> The tag value you use for imfile is what goes in the log in the syslogtag >> location. >> >> > The colon should not be part of it, but imfile (I think) does not check for > invalid characters ... and it is probably too late to change that without > breaking too much... > > Rainer >
Uhmm .. I have reased colon from tag and syslogtag options, but it seems exists some problem with imfile module. Launching rsyslog in debug mode: Stack now 0 1 18 42 61 Entering state 93 Reading a token: Now at end of input. Reducing stack by rule 24 (line 151): $1 = token IF () $2 = nterm expr () $3 = token THEN () $4 = nterm block () -> $$ = nterm stmt () Stack now 0 1 Entering state 20 Reducing stack by rule 3 (line 124): $1 = nterm conf () $2 = nterm stmt () -> $$ = nterm conf () Stack now 0 Entering state 1 Now at end of input. Shifting token $end () Entering state 2 Stack now 0 1 2 Cleanup: popping token $end () Cleanup: popping nterm conf () ^Crsyslogd: imfile: could not persist state file /data/logs/rsyslog/test_conn-state - data may be repeated on next startup. Is WorkDirectory set? [try http://www.rsyslog.com/e/2040 ] rsyslogd: imfile: could not persist state file /data/logs/rsyslog/test2-state - data may be repeated on next startup. Is WorkDirectory set? [try http://www.rsyslog.com/e/2040 ] /data/logs/rsyslog directory exists ... And I don't understand this problem.... On the other side, where do I need to see if my action is working?? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
