On Wed, 20 Jul 2016, [email protected] wrote:
DATA ==== CASE 1: If I place the variable assignment outside of the ruleset, I get this error: rsyslogd-3000: Could not open dynamic file '/opt/log/syslog//scrbspldk004031/10.139.225.1/2016-07-19_10.log' [state -3000] - discarding message [v8.19.0]
If it is outside of the ruleset, it will never be evaluated for logs that have the input tied to the ruleset, so the variable is always going to be '' (blank)
From this I infer that - The regex is returning something nonzero, and the variable $!ciscoapp is evaluated properly in the IF, since the cisco app template is chosen - The variable is not properly evaluated in the template, since the filename ain't right CASE 2: If I place the variable assignment inside the ruleset, I get this error: rsyslogd-3000: Could not open dynamic file '/opt/log/syslog/generic/scrbspldk004031/10.139.225.1/2016-07-19_10.log' [state -3000] - discarding message [v8.19.0] I am short on inference here. Also, the directory /opt/log/syslog is owned and writable by the user/group in template, but I still get the "-3000": drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log
what are the SELinux permissions on this directory.
Help I would be grateful for ============================ - Insight into either proper use of variables, or a better way to do the thing I am trying
mmnormalize is probably a better thing to use, or look at programname that starts with %ASA rather than doing a regex of the message body.
David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
