Kind souls,
Greetings.
I am working to separate network-received cisco logs from other syslogs,
and to save them by device type. My attempted approach is to:
- regex the cisco type out of the msg,
- assign it to the variable $!ciscoapp
- choose the cisco or non-cisco template based on that variable's contents
- write to a file
I am on RHEL6, rsyslog 8.19, and I run selinux.
I have a conf in /etc/rsyslog.d to do this, included:
==begin conf file==
#### MODULES ####
#===TCP SYSLOG===#
module(load="imtcp" MaxSessions="500")
input(type="imtcp" port="514" ruleset="remote-syslogs")
input(type="imtcp" port="6514" ruleset="remote-syslogs")
#===UDP SYSLOG===#
module(load="imudp")
input(type="imudp" port="514" ruleset="remote-syslogs")
# Now lets template our two filepath options
#template(name="dynamicIpSrcDir" type="string"
string="/opt/log/syslog/generic/%myhostname%/%source%/%$YEAR%-%$MONTH%-%$DAY%_%$HOUR%.log")
#template(name="dynamicCiscoSrcDir" type="string"
string="/opt/log/syslog/$!ciscoapp/$myhostname/%source%/%$YEAR%-%$MONTH%-%$DAY%_%$HOUR%.log")
template(name="dynamicIpSrcDir" type="list") {
constant(value="/opt/log/syslog/generic/")
property(name="$myhostname")
constant(value="/")
property(name="source")
constant(value="/")
property(name="$year")
constant(value="-")
property(name="$month")
constant(value="-")
property(name="$day")
constant(value="_")
property(name="$hour")
constant(value=".log")
}
template(name="dynamicCiscoSrcDir" type="list") {
constant(value="/opt/log/syslog/")
property(name="$!ciscoapp")
constant(value="/")
property(name="$myhostname")
constant(value="/")
property(name="source")
constant(value="/")
property(name="$year")
constant(value="-")
property(name="$month")
constant(value="-")
property(name="$day")
constant(value="_")
property(name="$hour")
constant(value=".log")
}
#===Regex for identifying cisco fw-type devices===#
#template (name="ciscotype" type="string"
string="%msg:R,ERE,1,ZERO:[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+.%([A-Z]+)-[0-9]+-[0-9]+:--end%")
#set $!ciscoapp = exec_template("ciscotype")
#set $!ciscoapp =
re_extract($msg,'[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+.%([A-Z]+)-[0-9]+-[0-9]+',0,0,0);
ruleset(name="remote-syslogs") {
set $!ciscoapp =
re_extract($msg,'[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+.%([A-Z]+)-[0-9]+-[0-9]+',0,0,0);
if $!ciscoapp == "0" then {
action(type="omfile" dynaFile="dynamicIpSrcDir"
ioBufferSize="64k" flushOnTXEnd="off"
dynaFileCacheSize="100" flushInterval="5"
asyncWriting="on" fileOwner="splunk" dirOwner="splunk"
fileGroup="splunk" dirGroup="splunk" fileCreateMode="0660"
dirCreateMode="0770")
} else {
action(type="omfile" dynaFile="dynamicCiscoSrcDir"
ioBufferSize="64k" flushOnTXEnd="off"
dynaFileCacheSize="100" flushInterval="5"
asyncWriting="on" fileOwner="splunk" dirOwner="splunk"
fileGroup="splunk" dirGroup="splunk" fileCreateMode="0660"
dirCreateMode="0770")
}
}
==end conf file==
DATA
====
CASE 1: If I place the variable assignment outside of the ruleset, I get
this error:
rsyslogd-3000: Could not open dynamic file
'/opt/log/syslog//scrbspldk004031/10.139.225.1/2016-07-19_10.log' [state
-3000] - discarding message [v8.19.0]
>From this I infer that
- The regex is returning something nonzero, and the variable $!ciscoapp
is evaluated properly in the IF, since the cisco app template is chosen
- The variable is not properly evaluated in the template, since the
filename ain't right
CASE 2: If I place the variable assignment inside the ruleset, I get this
error:
rsyslogd-3000: Could not open dynamic file
'/opt/log/syslog/generic/scrbspldk004031/10.139.225.1/2016-07-19_10.log'
[state -3000] - discarding message [v8.19.0]
I am short on inference here.
Also, the directory /opt/log/syslog is owned and writable by the
user/group in template, but I still get the "-3000":
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log
Help I would be grateful for
============================
- Insight into either proper use of variables, or a better way to do the
thing I am trying
- Advice on the permission issue
Kind thanks,
Sam
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
