On Mon, Jul 21, 2014 at 11:43 AM, masoom alam <[email protected]> wrote:
> David: > > How the performance will affected in the case where we want to pass the > control to do some normalization - name,value pair conversion by Rsyslog. > We want to get rid of Logstash. > > depending on what you do it's "not too bad", but of course it depends on the circumstances. However, you do not want to use output modules but you want to use the message modification internface, implemented via mmexternal. See these links: https://github.com/rsyslog/rsyslog/blob/master/plugins/external/INTERFACE.md http://www.rsyslog.com/doc/master/configuration/modules/mmexternal.html HTH Rainer > Thanks > > > On Mon, Jul 21, 2014 at 2:20 PM, David Lang <[email protected]> wrote: > > > On Mon, 21 Jul 2014, Zeshan wrote: > > > > Thanks David, > >> > >> It worked now with the following lines in my rsyslog.conf > >> > >> $ModLoad omprog > >> $actionomprogbinary /var/log/test.sh > >> *.* :omprog:;RSYSLOG_TraditionalFileFormat > >> > > > > that's the legacy format, the new format I gave below does the same > thing, > > but is clearer in many ways. It allos allows you to give parameters to > your > > program (the $actionomprogbinary value can't have any spaces in it) > > > > now that you have this working, you can change the format of data passed > > to your script by using a different template, and change ot program > itself > > to any other language. > > > > David Lang > > > > > > I was doing exactly the same except that the script was in /opt/test.sh > >> and > >> now it is in /var/log/test.sh > >> > >> Thanks for all the kindness > >> > >> > >> On Mon, Jul 21, 2014 at 1:42 PM, David Lang <[email protected]> wrote: > >> > >> Ok, looking at the documentation > http://www.rsyslog.com/doc/omprog.html > >>> > >>> try > >>> > >>> Module (load="omprog") > >>> action(type="omprog" binary="/pathto/test.sh" template="RSYSLOG_ > >>> TraditionalFileFormat") > >>> > >>> this will send the script every log entry that arrives on the rsyslog > >>> server > >>> > >>> if you run this with the -dn flags, we should see test.sh and the prog > >>> output module show up with the first log entry that it processes. > >>> > >>> David Lang > >>> > >>> > >>> > >>> On Mon, 21 Jul 2014, Zeshan wrote: > >>> > >>> Thanks David for your reply > >>> > >>>> > >>>> ok , i have script named test.sh having following code > >>>> > >>>> #!/bin/bash > >>>> echo "$@" >/var/log/myoutput > >>>> > >>>> and it is is executable. > >>>> > >>>> Now what should me rsyslog.conf file. and how to test this whole > >>>> procedure > >>>> > >>>> > >>>> On Mon, Jul 21, 2014 at 1:09 PM, Muhammad Asif Ihsan < > >>>> [email protected]> wrote: > >>>> > >>>> > >>>> > >>>>> David, now I have its binary and what should I code in rsyslog.conf > >>>>> for > >>>>> > >>>>>> > >>>>>> loading and redirecting to my executable myfile. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> rsyslog mailing list > >>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>>>> http://www.rsyslog.com/professional-services/ > >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > >>>>> myriad > >>>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you > >>>>> DON'T LIKE THAT. > >>>>> > >>>>> _______________________________________________ > >>>>> > >>>> rsyslog mailing list > >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>>> http://www.rsyslog.com/professional-services/ > >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >>>> DON'T LIKE THAT. > >>>> > >>>> _______________________________________________ > >>>> > >>> rsyslog mailing list > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > >>> http://www.rsyslog.com/professional-services/ > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >>> DON'T LIKE THAT. > >>> > >>> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > >> DON'T LIKE THAT. > >> > >> _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
