On Sat, Sep 28, 2013 at 5:05 AM, David Lang <[email protected]> wrote: > On Fri, 27 Sep 2013, Micah Anderson wrote: > > Hi, >> >> I'm trying to understand how to use the mmanon action, but so far >> everything I've tried has not worked. >> >> I have: >> >> $ModLoad imuxsock >> $ModLoad mmanon >> >> $ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat >> >> auth,authpriv.* /var/log/auth.log >> *.*;auth,authpriv.none -/var/log/syslog >> #cron.* /var/log/cron.log >> daemon.* -/var/log/daemon.log >> kern.* -/var/log/kern.log >> lpr.* -/var/log/lpr.log >> mail.* action(type="mmanon") >> action(type="omfile" file="/var/log/mail.log") >> user.* -/var/log/user.log >> >> but messages for the mail facility are not getting anonymized. >> >> I must be missing something obvious, but this is my first experience >> with actions in rsyslog and I am unsure if this is the correct way to go >> about this. >> > > to combine two actions, you need to put them between {} > > are you getting an error on startup? what version are you running? >
I think the main problem is related to this bug that come in yesterday: http://bugzilla.adiscon.com/show_bug.cgi?id=477 The config itself *is* valid - the write to mail.log is an action without filter, so it is executed for each message. I've written up some small doc on how to do it correctly: http://www.rsyslog.com/howto-anonymize-messages-that-go-to-specific-files/ Note that this probably does not work as expected due to the mentioned bug (which I will definitely look into soon). HTH Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
