Forgot to mention, I am using rsyslogd 5.8.10, compiled with: FEATURE_REGEXP: Yes FEATURE_LARGEFILE: No GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes Runtime Instrumentation (slow code): No
It cames with CentOS release 6.5 (Final) On Wed, Jan 14, 2015 at 2:08 PM, David Lang <[email protected]> wrote: > On Wed, 14 Jan 2015, Asif Iqbal wrote: > > I am using a /etc/rsyslog.d/routers.conf to put files in the right >> facility >> folder. >> >> Then I symlink that directory to a human friendly name. >> >> # cat /etc/rsyslog.d/routers.conf >> $template >> RouterLogs,"/var/log/%syslogfacility-text%/%$YEAR%/% >> $MONTH%/%$DAY%/%$YEAR%%$MONTH%%$DAY%.log" >> if ( \ >> ($syslogfacility-text == 'local0') or \ >> ($syslogfacility-text == 'local1') or \ >> ($syslogfacility-text == 'local1') or \ >> ($syslogfacility-text == 'local2') or \ >> ($syslogfacility-text == 'local3') or \ >> ($syslogfacility-text == 'local4') \ >> ) \ >> then -?RouterLogs >> >> # ln -s local0 cisco; ln -s local1 juniper .. and so on >> >> This way to look for cisco logs I can go to /var/log/cisco and not >> /var/log/local0. >> >> Is there a way to dynamically create the human friendly name for the >> folder >> with >> rsyslog instead? >> > > yes, using a reasonably current version of rsyslog you can do: > > if $syslogfacility-text == 'local0' then set $.type = "cisco"; > if $syslogfacility-text == 'local1' then set $.type = "juniper"; > > $template RouterLogs,"/var/log/%$.type%/%$YEAR%/%$MONTH%/%$DAY%/%$ > YEAR%%$MONTH%%$DAY%.log" > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing? _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
