On Wed, 30 Oct 2013, Grégoire Seux wrote:
Hello,
I receive logs whose programname contains slashes (they represent a folder hierarchy like
"net/verbose/exception") I'd like to recreate this folder hierarchy with
rsyslog.
I have used dynafile in the past but it seems that rsyslog truncate the
programname at the fist slash.
For instance, using the following template:
template(name="All" type="list") {
constant(value="/var/opt/logs/tests/")
property(name="programname")
constant(value="-test.log")
}
rsyslog creates logs in : /var/opt/logs/tests/net-log instead of
/var/opt/logs/test/net/verbose/exception-test.log
Is there something I am doing wrong?
programname has some limits to what's allowed in it, I know that it cuts things
off at 32 characters for example, and I also believe that there are characters
that are not supposed to be in the name. I would suggest loging with the format
RSYSLOG_DebugFormat for a short time to see exactly how the message is
getting parsed and what values are in programname.
Since you are using a new style template, this indicates that you are using
rsyslog v7.x, with newer versions like this, my suggestion is to format your
message as JSON so that you can add whatever additional metadata that you want
without the limits of the traditional syslog formats and reference those
variables in your output templates.
for example, if your sending systems were to have the config
:mmjsonparse:
set $!myreservedname!path = statement to extract path from logs;
$template jsonlogs,"<%pri%>%timestamp% %hostname% %syslogtag% @cee{%$!}"
then at the server you could use $!myreservedname!path in your dynafile
template, and then replace %msg% with %$!msg% in your output line template and
the line you output will not contain the path.
This approach can also let the sending machine include other useful metadata (is
this box QA, Prod, DR, Development, etc)
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
