On Thu, 24 Apr 2014, Bryn Hughes wrote:
On 14-04-15 02:45 AM, Rainer Gerhards wrote:
On Tue, Apr 15, 2014 at 11:27 AM, Joop Boonen<[email protected]> wrote:
>Dear all,
>
>As php-fpm does only sent log messages with severity notice but want to
>parse them as we want then at warning as this is also configured in the
>php-fpm configuration file. We would like to rewrite the severity of this
>message, basically all php-fpm messages from 5 to 4.
>
>I expected that the property replacer count do the trick but I cant find
>any information about this.
>
>http://www.rsyslog.com/doc/property_replacer.html
>
>In this link,http://rsyslog-users.1305293.n2.nabble.com/facility-
>rewriting-td7569455.html , is also entioned that it's possible but no
>example is shown.
>
>I've also read that the mmnormalize module,http://www.rsyslog.com/doc/
>mmnormalize.html , could do the tick. But sadly I cant find enough
>information.
>
>
>
If it is just a forwarding case, you can do that with a proper template and
a couple of if's. The best way is to write a message modification module.
Currently, the severity and facility can only be modified by C modules, but
I will see if I can add that option to the external plugin interface.
Rainer
Hey Rainer,
Wondering if you could expand on the template method a bit?
The facility and severity are represented in a forwarded message as a single
number (from 0-255), also called PRI
since you can make your own template, you can create a template with these
values hard coded (or with v7+, with them as a user-defined variable that you
manipulate)
Then you can have if statements to decide which template to use to send a
message out, or to set the variables for a computed PRI
as an example
$template fixedpri,"<47>%timestamp% %hostname% %syslogtag%%msg%\n"
if (some condition) then @dest;fixedpri
else @dest;RSYSLOG_TraditionalForwardFormat
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
