On Thu, 30 Jul 2015, Nate wrote:
I am having trouble coming up with a v8 rsyslog.conf file from a v5 one as I
am trying to create a new syslog server. In looking at all the documentation,
it's all written in the old format so there's not a lot of examples with the
new style.
first off, you can keep using your old config. The new version still understands
the old config.
Questions:Since order matters, is there a specific structure that the file
should be in? Are global variables like $WorkDirectory and $IncludeConfig
supposed to go within a ruleset? Where does the timezone function get called
(like a global or within ruleset(), input())?
you don't need to use rulesets
How do you call $RulesetCreateMainQueue within a RainerScript ruleset? Where
goes the timezone function get called?
ruleset(name='blah' queue.type="fixedarray"){
}B
Do action functions need to be withing a ruleset?
no. rulesets are completely optional
In doing a google search, it seems like people have 2 main rulesets: local and
remote. local is where the old default unix rules are and it's set as the
default ruleset while remote is bound to the input function.
Distros do that because they think that people don't want the logs from remote
machines in the same place as the logs from the local machine, and having a
ruleset for local and a ruleset for remote make this easy to keep separated.
So does that mean that this won't work?
ruleset (
name="q_default"
queue.maxdiskspace="192m"
queue.type="LinkedList" # use asynchronous processing
queue.saveonshutdown="on" # save in-memory data if rsyslog shuts down
action.resumeretrycount="-1" #retry indefinitely on failure
)
*.info action(type="omfwd" target="tigger" queue.filename="qf_tigger"
ruleset="q_default")
& action(type="omfwd" target="pooh" queue.filename="qf_pooh"
ruleset="q_default")
& action(type="omfwd" target="piglet" queue.filename="qf_piglet"
ruleset="q_default")
& action(type="omfwd" target="eyore" queue.filename="qf_eyore"
ruleset="q_default")
well, that won't work because it's not a valid syntax, but the following would
work.
ruleset (
name="q_default"
queue.maxdiskspace="192m"
queue.type="LinkedList" # use asynchronous processing
queue.saveonshutdown="on" # save in-memory data if rsyslog shuts down
action.resumeretrycount="-1" #retry indefinitely on failure
){
*.info {
action(type="omfwd" target="tigger" queue.filename="qf_tigger"
ruleset="q_default")
action(type="omfwd" target="pooh" queue.filename="qf_pooh"
ruleset="q_default")
action(type="omfwd" target="piglet" queue.filename="qf_piglet"
ruleset="q_default")
action(type="omfwd" target="eyore" queue.filename="qf_eyore"
ruleset="q_default")
}
}
It would probably be best if you could post your existing ruleset and we could
help you convert it over.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
