Hi David, Thanks a lot for the hint. I have it working now :) I think it would be good if the documentation could be improved with respect to this issue.
BR Elisabeth -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Friday, March 25, 2016 7:04 PM To: rsyslog-users Subject: Re: [rsyslog] omprog queue On Fri, 25 Mar 2016, Elisabeth Kemper wrote: > Hi all, > > I have following question: > In my configuration I have defined: > > module(load="omprog") > ruleset(name="iscsi_repair"){ > action(name="iscsi_repair" > type="omprog" > binary="/usr/bin/iscsi-supervision-handler" > template="RSYSLOG_TraditionalFileFormat") > } > # Rules for matching events > # -------------------------# > if ($syslogtag contains "iscsid") and ($msg contains "operational after > recovery") then { > call iscsi_repair > } > > It works fine, but when a triggering event occurs while the program > (iscsi_repair) is still running, it is not triggered again. > i.e. the triggering event in that case is just discarded. > I already tried to add > queue.type="linkedList" for the action but this did not change anything. > > What can I do that each trigger event is handled? You have the wrong mental model of omprog You are thinking, "I get a matching log and fire off the program" The correct model is "rsyslog starts the program as needed, and pipes all matching logs to stdin of the program" It's just a performance optimization to not start it when rsyslog starts, only starting it when the first matching log event happens. So: you need to modify the iscsi_repair script from being a one-shot thing to being a daemon that listens for multiple log events to be passed to it on stdin and processes each of them. David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
