Hi,
Within the new configuration format of a RuleSet, what is the syntax of binding
a specific RuleSetParser to it? I have a set of hosts that send awfully
formatted messages and the rfc3164 parser seems to parse them fine while the
rfc5424 parser does not.
I see examples of how to specify the parser in the legacy configuration format,
but how would I do it in a RainerScript like this?
ruleset(name="centralized_logging"){
*.*
action(type="omfile" dynaFile="DailyPerHostLogs")
auth,authpriv.*
action(type="omfile" dynaFile="DailyPerHostLogsAuth")
cron.*
action(type="omfile" dynaFile="DailyPerHostLogsCron")
mail.*
action(type="omfile" dynaFile="DailyPerHostLogsMail")
kern.*
action(type="omfile" dynaFile="DailyPerHostLogsKern")
local4.*
action(type="omfile" dynaFile="DailyPerHostLogs")
local6.*
action(type="omfile" dynaFile="DailyPerHostLogs")
& stop
}
listeners.conf:
input(type="imudp" port="10514" ruleset="centralized_logging")
Templates from rsyslog.conf:
template(name="DailyPerHostLogs" type="string"
string="/syslog/%FROMHOST%/syslog")
template(name="DailyPerHostLogsAuth" type="string"
string="/syslog/%FROMHOST%/auth.log")
template(name="DailyPerHostLogsCron" type="string"
string="/syslog/%FROMHOST%/cron.log")
template(name="DailyPerHostLogsKern" type="string"
string="/syslog/%FROMHOST%/kern.log")
template(name="DailyPerHostLogsMail" type="string"
string="/syslog/%FROMHOST%/mail.log")
Thanks!
______________________________________________
See http://www.peak6.com/email_disclaimer/ for terms and conditions related to
this email
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
