Hey David,
I had a question for you and anyone else that know's the answer to. Currently
I'm running the omfile you suggested on my development server and I'm noticing
that the code is working, but also that my messages log file is also filling up
with the same log information. Is there a way to filter logs to only go to
their destination and not log into the messages log file that is in linux?
Here is the part of my config that I have done.
-------------------------------------------
$template
RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogseverity-text%.log.gz"
action(name="PerHostFile" type="omfile" dynafile="RemoteHost"
DynaFileCacheSize="1000" ziplevel="5"
-------------------------------------------
-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of David Lang
Sent: Friday, May 09, 2014 3:36 PM
To: rsyslog-users
Subject: Re: [rsyslog] Rsyslog w/ logstash-elasticsearch-kibana server
On Fri, 9 May 2014, Josh Bitto wrote:
> In the link I posted there is a description of syslogpriority-text -an
> alias for syslogseverity-text
>
> And that's my question as to what it is referencing.
ahh, in that case you use whichever one makes sense to you, some people think
of it as priority, some as severity, rsyslog supports both names with identical
content.
David Lang
>
>
> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]] On Behalf Of David Lang
> Sent: Friday, May 09, 2014 3:33 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Rsyslog w/ logstash-elasticsearch-kibana server
>
> On Fri, 9 May 2014, Josh Bitto wrote:
>
>> Happy Friday!
>>
>> One last question. I modified the template a tad bit and added the following.
>>
>> $template
>> RemoteHost,"/var/log/hosts/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%syslogseverity-text%.log.gz"
>>
>> When looking at the http://www.rsyslog.com/doc/property_replacer.html
>> documentation I see both "syslogseverity-text" and "syslogpriority-text"
>>
>> My question is in this case I'm basically separating the files based
>> on the severity. In what instance would I use the alias for? I guess
>> I'm not fully understanding what its purpose is.
>
> what are you referring to as the 'alias'?
>
> I'm not understanding your question.
>
> David Lang
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This
> is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
> control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is
a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our
control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
