Hi all,
I'm having problems creating a rule for rsyslog 5.8.6 (I know, but I
can't easily upgrade it). This is my rule:
$Template tpl_trap_fatal, "..."
$ModLoad omprog
$ActionOMProgBinary /usr/lib/nagios/plugins/rsyslog_trap_wrapper
if re_match($programname,'snmptrapd') then :omprog:;tpl_trap_fatal
and rsyslog debug shows:
1815.563605659:7f0a16e49700: cfline: 'if
re_match($programname,'snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563618130:7f0a16e49700: - general expression-based filter
1815.563632462:7f0a16e49700: skipped whitespace, stream now
're_match($programname,'snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563644049:7f0a16e49700: skipped whitespace, stream now
're_match($programname,'snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563658878:7f0a16e49700: ctok_token 0x235dc40: token: 17
1815.563673840:7f0a16e49700: expr 0x234a540: function
1815.563687892:7f0a16e49700: skipped whitespace, stream now
'($programname,'snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563699533:7f0a16e49700: ctok_token 0x235ddc0: token: 10
1815.563716377:7f0a16e49700: skipped whitespace, stream now
'$programname,'snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563729567:7f0a16e49700: ctok_token 0x235ddc0: token: 13
1815.563743498:7f0a16e49700: expr 0x234a540: MSGVAR
1815.563758510:7f0a16e49700: skipped whitespace, stream now
','snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563769924:7f0a16e49700: ctok_token 0x235ddc0: token: 11
1815.563784681:7f0a16e49700: skipped whitespace, stream now
''snmptrapd') then :omprog:;tpl_trap_fatal'
1815.563796643:7f0a16e49700: ctok_token 0x235ddc0: token: 14
1815.563810825:7f0a16e49700: expr 0x234a540: simpstr
1815.563825416:7f0a16e49700: skipped whitespace, stream now ') then
:omprog:;tpl_trap_fatal'
1815.563836988:7f0a16e49700: ctok_token 0x235ddc0: token: 9
1815.563857029:7f0a16e49700: config line NOT successfully processed
1815.563871193:7f0a16e49700: Called LogError, msg: the last error
occured in /etc/rsyslog.d/51_errores_fatal.conf, line 5:"if
re_match($programname,'snmptrapd') then :omprog:;tpl_trap_fatal"
any help?
--
Angel L. Mateo Martínez
Sección de Telemática
Área de Tecnologías de la Información
y las Comunicaciones Aplicadas (ATICA)
http://www.um.es/atica
Tfo: 868887590
Fax: 868888337
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
