[rsyslog] localhost (only) messages to /var/log/messages

[Chris Bartram]

swVersion="7.6.3"

Need to send all localhost messages to /var/log/messages; everything else to a 
dynfile. The dynfile stuff I have working, but to catch the localhost stuff I 
tried using “new” syntax – binding a ruleset to imuxsock and imklog – but I get 
syntax errors:

# begin rulesets here
ruleset(name="localhost-messages")              # write log messages from local 
host to /var/log/messages
{
        action(type="omfile"
               file="/var/log/messages"
              )
}
 
# begin input modules
input(type="imuxsock"                           # capture local logger commands
      ruleset="localhost-messages"
      )
 
input(type="imklog"                             # capture local kernel messages
      ruleset="localhost-messages"
      )

Error messages:
input(type="imuxsock"                          
rsyslogd-2207: error during parsing file /etc/rsyslog.conf, on or before line 
59: parameter 'socket' required but not specified - fix config [try 
http://www.rsyslog.com/e/2207 ]
rsyslogd-2211: imuxsock: required parameter are missing  [try 
http://www.rsyslog.com/e/2211 ]
rsyslogd-2207: error during parsing file /etc/rsyslog.conf, on or before line 
59: parameter 'ruleset' not known -- typo in config file? [try 
http://www.rsyslog.com/e/2207 ]

rsyslogd-2224: input module 'imklog' does not support input() statement [try 
http://www.rsyslog.com/e/2224 ]
rsyslogd-2207: error during parsing file /etc/rsyslog.conf, on or before line 
63: parameter 'ruleset' not known -- typo in config file? [try 
http://www.rsyslog.com/e/2207 ]

I guess I need to revert to old syntax? Can anyone provide an example? This 
server will be receiving tcp/relp messages from hundreds of other remote 
servers - that part I have setup. I just need to make sure all the localhost 
generated messages get ONLY written to /var/log/messages.

Thanks!
 -Chris Bartram

"The purpose of life is not to be happy. It is to be useful, to be honorable, 
to be compassionate, to have it make some difference that you have lived and 
lived well". (Ralph Waldo Emerson)
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.