On Thu, 21 Jul 2016, [email protected] wrote:
David, thanks for your advices. Comments inline.
On 20 Jul 2016, at 19:49, David Lang <[email protected]> wrote:
On Wed, 20 Jul 2016, [email protected] wrote:
DATA
====
CASE 1: If I place the variable assignment outside of the ruleset, I get
this error:
rsyslogd-3000: Could not open dynamic file
'/opt/log/syslog//scrbspldk004031/10.139.225.1/2016-07-19_10.log' [state
-3000] - discarding message [v8.19.0]
If it is outside of the ruleset, it will never be evaluated for logs that have
the input tied to the ruleset, so the variable is always going to be '' (blank)
That was the impression I got from a post of yours to this list from November
(20th maybe) of last year, and why I tried it inside and out. The behaviour I
am seeing must be due to blank != 0. So, I need to keep the assignment within
the ruleset and determine why it is not working (since all of the logs from my
test source are ASA or FWSM)
Yes "" != "0", remember that everything inside rsyslog is string based.
From this I infer that
- The regex is returning something nonzero, and the variable $!ciscoapp
is evaluated properly in the IF, since the cisco app template is chosen
- The variable is not properly evaluated in the template, since the
filename ain't right
CASE 2: If I place the variable assignment inside the ruleset, I get this
error:
rsyslogd-3000: Could not open dynamic file
'/opt/log/syslog/generic/scrbspldk004031/10.139.225.1/2016-07-19_10.log'
[state -3000] - discarding message [v8.19.0]
I am short on inference here.
Also, the directory /opt/log/syslog is owned and writable by the
user/group in template, but I still get the "-3000":
drwxr-xr-x. root root system_u:object_r:var_log_t:s0 /var/log
what are the SELinux permissions on this directory.
The context shown immediately above, var_log_t, is copied from /var/log, which
rsyslog writes to adequately. I will dig out and check the grants for that
context.
Help I would be grateful for
============================
- Insight into either proper use of variables, or a better way to do the
thing I am trying
mmnormalize is probably a better thing to use, or look at programname that
starts with %ASA rather than doing a regex of the message body.
The doc for mmnormalize looks like a good direction -- what performance hit am
I likely to take for that (noting that I was about to regex into the msg
anyway)? I am looking at 20 GB of syslog a day through the box, and double
that if the partner box fails.
mmnormalize is WAY faster than regexes. Rainer just did his masters thesis on
the topic and mmnormalize was ~100x faster than grok regexes on even a simple
30ish line ruleset and >4x faster on even a single line ruleset.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
