what shows up when you write the output with RSYSLOG_DebugFormat ?
that will show you the value in each field so that you can see if you have
things correct. in your filter.
David Lang
On Fri, 30 Aug 2013, jinge wrote:
Date: Fri, 30 Aug 2013 12:30:06 +0800
From: jinge <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: [email protected]
Subject: Re: [rsyslog] Rsyslog with omprog and condition filter not success
We want to filter syslog facility local4 and message contains "HTTP: Invalid
Response: No object data received for" to the custom script and use the script doing
some process and output to the file /tmp/queue.log
We use rsyslog for our messages process. For testing we use the directives.
$ModLoad omprog
$ActionOMProgBinary /root/omprog.py
*.* :omprog:;RSYSLOG_TraditionalFileFormat
And we found there are output rightly in the /tmp/queue.log
When we add some filter and msg contains.
$ModLoad omprog
$ActionOMProgBinary /root/omprog.py
if $syslogfacility-text == 'local4' and ($msg contains 'HTTP: Invalid
Response: No object data received for') then
:omprog:;RSYSLOG_TraditionalFileFormat
There are no output in the /tmp/queue.log
we use ubuntu 13.04 and rsyslog 5.8.11
here is my omprog.py
https://gist.github.com/altman87120/6338616#file-omprog-py
I don't know why just add some filter in the process line and it could output
to the file.Is there any limits there or our directive wrong ?
Is there anyone can help? Thanks!
Regards
Jinge
On 2013-8-28, at ??10:11, jinge <[email protected]> wrote:
Hi, all!
We use rsyslog for our messages process.And use the omprog custom some process
but we never sucess when use the condition filter with omprog
we use ubuntu 13.04 and rsyslog 5.8.11 and the omprog success if process all
message *.* and the below is never sucess.
$ModLoad omprog
$ActionOMProgBinary /root/omprog.py
if $syslogfacility-text == 'local4' and ($msg contains 'HTTP: Invalid Response:
No object data received for') then :omprog:;RSYSLOG_TraditionalFileFormat
here is my omprog.py
https://gist.github.com/altman87120/6338616#file-omprog-py
Is there anyone can help? Thanks!
Regards
Jinge
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
