We want to filter syslog facility local4 and message contains "HTTP: Invalid
Response: No object data received for" to the custom script and use the script
doing some process and output to the file /tmp/queue.log
We use rsyslog for our messages process. For testing we use the directives.
$ModLoad omprog
$ActionOMProgBinary /root/omprog.py
*.* :omprog:;RSYSLOG_TraditionalFileFormat
And we found there are output rightly in the /tmp/queue.log
When we add some filter and msg contains.
$ModLoad omprog
$ActionOMProgBinary /root/omprog.py
if $syslogfacility-text == 'local4' and ($msg contains 'HTTP: Invalid
Response: No object data received for') then
:omprog:;RSYSLOG_TraditionalFileFormat
There are no output in the /tmp/queue.log
we use ubuntu 13.04 and rsyslog 5.8.11
here is my omprog.py
https://gist.github.com/altman87120/6338616#file-omprog-py
I don't know why just add some filter in the process line and it could output
to the file.Is there any limits there or our directive wrong ?
Is there anyone can help? Thanks!
Regards
Jinge
On 2013-8-28, at 上午10:11, jinge <[email protected]> wrote:
> Hi, all!
>
> We use rsyslog for our messages process.And use the omprog custom some
> process but we never sucess when use the condition filter with omprog
>
> we use ubuntu 13.04 and rsyslog 5.8.11 and the omprog success if process all
> message *.* and the below is never sucess.
>
>
> $ModLoad omprog
> $ActionOMProgBinary /root/omprog.py
>
> if $syslogfacility-text == 'local4' and ($msg contains 'HTTP: Invalid
> Response: No object data received for') then
> :omprog:;RSYSLOG_TraditionalFileFormat
>
> here is my omprog.py
> https://gist.github.com/altman87120/6338616#file-omprog-py
>
>
> Is there anyone can help? Thanks!
>
>
>
> Regards
> Jinge
>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
