On Wed, Oct 30, 2013 at 2:58 PM, David Lang <[email protected]> wrote:
> On Wed, 30 Oct 2013, Grégoire Seux wrote:
>
> Hello,
>>
>> I receive logs whose programname contains slashes (they represent a
>> folder hierarchy like "net/verbose/exception") I'd like to recreate this
>> folder hierarchy with rsyslog.
>> I have used dynafile in the past but it seems that rsyslog truncate the
>> programname at the fist slash.
>>
>> For instance, using the following template:
>> template(name="All" type="list") {
>> constant(value="/var/opt/logs/**tests/")
>> property(name="programname")
>> constant(value="-test.log")
>> }
>>
>> rsyslog creates logs in : /var/opt/logs/tests/net-log instead of
>> /var/opt/logs/test/net/**verbose/exception-test.log
>>
>> Is there something I am doing wrong?
>>
>
> programname has some limits to what's allowed in it, I know that it cuts
> things off at 32 characters for example, and I also believe that there are
> characters that are not supposed to be in the name.
RFC3164 says it mus be alphanumeric (in section 4.1.3). I think we made
some very limited exceptions, but slash is definitely not among them. The
first non-alphanumeric char terminates the tag.
Rainer
> I would suggest loging with the format RSYSLOG_DebugFormat for a short
> time to see exactly how the message is getting parsed and what values are
> in programname.
>
> Since you are using a new style template, this indicates that you are
> using rsyslog v7.x, with newer versions like this, my suggestion is to
> format your message as JSON so that you can add whatever additional
> metadata that you want without the limits of the traditional syslog formats
> and reference those variables in your output templates.
>
> for example, if your sending systems were to have the config
> :mmjsonparse:
> set $!myreservedname!path = statement to extract path from logs;
> $template jsonlogs,"<%pri%>%timestamp% %hostname% %syslogtag% @cee{%$!}"
>
> then at the server you could use $!myreservedname!path in your dynafile
> template, and then replace %msg% with %$!msg% in your output line template
> and the line you output will not contain the path.
>
> This approach can also let the sending machine include other useful
> metadata (is this box QA, Prod, DR, Development, etc)
>
> David Lang
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
