David, thanks for your advices. Comments inline. >> On 20 Jul 2016, at 19:49, David Lang <[email protected]> wrote: >> >> On Wed, 20 Jul 2016, [email protected] wrote: >> >> DATA >> ==== >> >> CASE 1: If I place the variable assignment outside of the ruleset, I get >> this error: >> >> rsyslogd-3000: Could not open dynamic file >> '/opt/log/syslog//scrbspldk004031/10.139.225.1/2016-07-19_10.log' [state >> -3000] - discarding message [v8.19.0] > > If it is outside of the ruleset, it will never be evaluated for logs that > have the input tied to the ruleset, so the variable is always going to be '' > (blank)
That was the impression I got from a post of yours to this list from November (20th maybe) of last year, and why I tried it inside and out. The behaviour I am seeing must be due to blank != 0. So, I need to keep the assignment within the ruleset and determine why it is not working (since all of the logs from my test source are ASA or FWSM) >> From this I infer that >> - The regex is returning something nonzero, and the variable $!ciscoapp >> is evaluated properly in the IF, since the cisco app template is chosen >> - The variable is not properly evaluated in the template, since the >> filename ain't right >> >> CASE 2: If I place the variable assignment inside the ruleset, I get this >> error: >> >> rsyslogd-3000: Could not open dynamic file >> '/opt/log/syslog/generic/scrbspldk004031/10.139.225.1/2016-07-19_10.log' >> [state -3000] - discarding message [v8.19.0] >> >> I am short on inference here. >> >> Also, the directory /opt/log/syslog is owned and writable by the >> user/group in template, but I still get the "-3000": >> >> drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log > > what are the SELinux permissions on this directory. The context shown immediately above, var_log_t, is copied from /var/log, which rsyslog writes to adequately. I will dig out and check the grants for that context. > >> >> Help I would be grateful for >> ============================ >> - Insight into either proper use of variables, or a better way to do the >> thing I am trying > > mmnormalize is probably a better thing to use, or look at programname that > starts with %ASA rather than doing a regex of the message body. The doc for mmnormalize looks like a good direction -- what performance hit am I likely to take for that (noting that I was about to regex into the msg anyway)? I am looking at 20 GB of syslog a day through the box, and double that if the partner box fails. > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
