Re: [rsyslog] replace syslogfacility-text to a human friendly name

[David Lang]

Ok, that version is too old, there are no user-defined variables. You really 
should upgrade to a current version (v8.7.0 is current stable), at least on your 
central server.

David Lang
On Wed, 14 Jan 2015, Asif Iqbal wrote:

Forgot to mention, I am using

rsyslogd 5.8.10, compiled with:
FEATURE_REGEXP: Yes
FEATURE_LARGEFILE: No
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
Runtime Instrumentation (slow code): No

It cames with CentOS release 6.5 (Final)


On Wed, Jan 14, 2015 at 2:08 PM, David Lang <da...@lang.hm> wrote:

On Wed, 14 Jan 2015, Asif Iqbal wrote:

 I am using a /etc/rsyslog.d/routers.conf to put files in the right
facility
folder.

Then I symlink that directory to a human friendly name.

# cat /etc/rsyslog.d/routers.conf
$template
RouterLogs,"/var/log/%syslogfacility-text%/%$YEAR%/%
$MONTH%/%$DAY%/%$YEAR%%$MONTH%%$DAY%.log"
if ( \
  ($syslogfacility-text == 'local0') or \
  ($syslogfacility-text == 'local1') or \
  ($syslogfacility-text == 'local1') or \
  ($syslogfacility-text == 'local2') or \
  ($syslogfacility-text == 'local3') or \
  ($syslogfacility-text == 'local4') \
) \
then -?RouterLogs

# ln -s local0 cisco; ln -s local1 juniper .. and so on

This way to look for cisco logs I can go to /var/log/cisco and not
/var/log/local0.

Is there a way to dynamically create the human friendly name for the
folder
with
rsyslog instead?


yes, using a reasonably current version of rsyslog you can do:

if $syslogfacility-text == 'local0' then set $.type = "cisco";
if $syslogfacility-text == 'local1' then set $.type = "juniper";

$template RouterLogs,"/var/log/%$.type%/%$YEAR%/%$MONTH%/%$DAY%/%$
YEAR%%$MONTH%%$DAY%.log"

David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.





_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.