It it takes multiple lines to set something up (several $something lines
followed by the action), you are probably using the obsolete format and should
re-do it.
If what you are doing can be done in a single line, it's probably just fine to
keep using it.
Rsyslog started off using the same things that were in sysklog (what's worked in
syslog.conf forever), but as it gained new capabilities, that syntax needed to
be extended, and it got more and more complicated to understand.
With version 6 a new syntax was introduced that makes it much easier to
understand what is happening with more complex configs. Initially it was stated
that everything in the older syntax was legacy and going to go away 'someday',
but over time we have refined this position to discourage use of the parts that
caused the most problems while still supporting the simple things. This change
from two categories of syntax to three happened within the last year or so (I
think around 8.30 or so) so the older documentation will refer to all of the old
syntax as legacy and suggest moving everything to the new format.
It's unlikely that we will ever remove support for what we are declaring
obsolete (we _really_ believe in backwards compatibility), but we discourage
it's use.
David Lang
On Fri, 9 Nov 2018, Rainer Gerhards wrote:
Date: Fri, 9 Nov 2018 09:45:02 +0100
From: Rainer Gerhards <[email protected]>
To: rsyslog-users <[email protected]>
Cc: David Lang <[email protected]>, [email protected]
Subject: Re: [rsyslog] Code verification : legacy to new format
https://www.rsyslog.com/doc/v8-stable/configuration/conf_formats.html
HTH
Rainer
El vie., 9 nov. 2018 a las 9:30, sophie.loewenthal--- via rsyslog
(<[email protected]>) escribió:
-----Original Message-----
From: David Lang [mailto:[email protected]]
Sent: Thursday, November 08, 2018 10:30 PM
To: sophie.loewenthal--- via rsyslog
Cc: LOEWENTHAL Sophie
Subject: Re: [rsyslog] Code verification : legacy to new format
On Thu, 8 Nov 2018, sophie.loewenthal--- via rsyslog wrote:
Hi,
This seems to work for me, but I'd be grateful if somebody would confirm this
is actually correct.
Dump all nrpe messages into a file, and once done discard.
* Legacy format
:programname, isequal, "nrpe" /app/rsyslog/messages.nrpe.all
:programname, isequal, "nrpe" &
* New format
if ( $programname == "nrpe" ) then {
action(type="omfile" file="/app/rsyslog/messages.nrpe.all"
flushOnTXEnd="off")
stop
}
This works, but I'll point out that the following also works
if ( $programname == "nrpe" ) then {
/app/rsyslog/messages.nrpe.all
stop
}
you don't have to switch everything to use action(), the general
recommendation
is taht if it's a single line in the legacy format, and it's at least as clear
as the new format, go ahead and use the legacy format.
It's when you have things that are multiple lines of config in the old format
(setting lots of $foo lines and then having the line that they affect) that the
old format becomes confusing and you should switch to the new format. There
are
also new features available in the action() syntax, but if the old format does
what you want, you aren't using the new feature :-)
David Lang
Hi David,
I presumed incorrectly that the legacy format was deprecated and would be
obsolete later. If this is not the case, I'm happy to mix these syntaces
together.
This message and any attachments (the "message") is
intended solely for the intended addressees and is confidential.
If you receive this message in error,or are not the intended recipient(s),
please delete it and any copies from your systems and immediately notify
the sender. Any unauthorized view, use that does not comply with its purpose,
dissemination or disclosure, either whole or partial, is prohibited. Since the
internet
cannot guarantee the integrity of this message which may not be reliable, BNP
PARIBAS
(and its subsidiaries) shall not be liable for the message if modified, changed
or falsified.
Do not print this message unless it is necessary, consider the environment.
----------------------------------------------------------------------------------------------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le "message")
sont etablis a l'intention exclusive de ses destinataires et sont confidentiels.
Si vous recevez ce message par erreur ou s'il ne vous est pas destine,
merci de le detruire ainsi que toute copie de votre systeme et d'en avertir
immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de
ce message qui n'est pas conforme a sa destination, toute diffusion ou toute
publication, totale ou partielle, est interdite. L'Internet ne permettant pas
d'assurer
l'integrite de ce message electronique susceptible d'alteration, BNP Paribas
(et ses filiales) decline(nt) toute responsabilite au titre de ce message dans
l'hypothese
ou il aurait ete modifie, deforme ou falsifie.
N'imprimez ce message que si necessaire, pensez a l'environnement.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
