Hello Rainer, thanks for your online video tutorials. I found them very useful.
If my template violates the format, I'm willing to change it. My only requirement is that I'm not prepending rsyslog property values to the log lines. If preferable, I'd like to send the data exactly the same as it's generated by the application (Apache) I turned on the receiver's debug, and these are the results: 1) When my client configuration reads: local3.* <IP>:514 all configured input file logging is sent to the log server. The debugger logs no new data 2) When my client configuration reads: $template msgOnlyTemplate,"%syslogtag%%msg%\n" if $syslogfacility-text == 'local3' then @156.36.38.61:514;msgOnlyTemplate & ~ no configured input file logging is sent to the log server. The debugger records the following: inputname: rsyslogd rawmsg: ' [origin software="rsyslogd" swVersion="5.10.1" x-pid="17085" x-info="http://www.rsyslog.com";] start' Debug line with all properties: FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', PRI: 15, syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME: 'auditmanager', PROCID: '-', MSGID: '-', TIMESTAMP: 'Apr 23 14:56:22', STRUCTURED-DATA: '-', msg: ' Received wakeup signal before sleep finished' escaped msg: ' Received wakeup signal before sleep finished' inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: Received wakeup signal before sleep finished' Debug line with all properties: FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', PRI: 15, syslogtag 'auditmanager:', programname: 'auditmanager', APP-NAME: 'auditmanager', PROCID: '-', MSGID: '-', TIMESTAMP: 'Apr 23 14:56:24', STRUCTURED-DATA: '-', msg: ' last message repeated 2 times' escaped msg: ' last message repeated 2 times' inputname: imuxsock rawmsg: '<15>Apr 23 14:56:22 auditmanager: last message repeated 2 times' [truncated] Debug line with all properties: FROMHOST: '<HOST_HIDE>', fromhost-ip: '127.0.0.1', HOSTNAME: '<HOST_HIDE>', PRI: 31, syslogtag '.vasac_helper[17173]:', programname: '.vasac_helper', APP-NAME: '.vasac_helper', PROCID: '17173', MSGID: '-', TIMESTAMP: 'Apr 23 14:56:35', STRUCTURED-DATA: '-', msg: ' Unable to set daemon API context to default to memory ccache in _local_vas_init, Error was Invalid VAS context, no available error message' escaped msg: ' Unable to set daemon API context to default to memory ccache in _local_vas_init, Error was Invalid VAS context, no available error message' inputname: imuxsock rawmsg: '<31>Apr 23 14:56:35 .vasac_helper[17173]: Unable to set daemon API context to default to memory ccache in _local_vas_init, Error was Invalid VAS context, no available error message' followed by msg: ' Received wakeup signal before sleep finished' msg: ' last message repeated 2 times' several times in a row -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/imfile-templates-tp7585270p7585274.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
