On Wed, 14 Jan 2015, Asif Iqbal wrote:
I am using a /etc/rsyslog.d/routers.conf to put files in the right facility
folder.
Then I symlink that directory to a human friendly name.
# cat /etc/rsyslog.d/routers.conf
$template
RouterLogs,"/var/log/%syslogfacility-text%/%$YEAR%/%$MONTH%/%$DAY%/%$YEAR%%$MONTH%%$DAY%.log"
if ( \
($syslogfacility-text == 'local0') or \
($syslogfacility-text == 'local1') or \
($syslogfacility-text == 'local1') or \
($syslogfacility-text == 'local2') or \
($syslogfacility-text == 'local3') or \
($syslogfacility-text == 'local4') \
) \
then -?RouterLogs
# ln -s local0 cisco; ln -s local1 juniper .. and so on
This way to look for cisco logs I can go to /var/log/cisco and not
/var/log/local0.
Is there a way to dynamically create the human friendly name for the folder
with
rsyslog instead?
yes, using a reasonably current version of rsyslog you can do:
if $syslogfacility-text == 'local0' then set $.type = "cisco";
if $syslogfacility-text == 'local1' then set $.type = "juniper";
$template
RouterLogs,"/var/log/%$.type%/%$YEAR%/%$MONTH%/%$DAY%/%$YEAR%%$MONTH%%$DAY%.log"
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
