Using the configuration line...
*.debug /path/to/debug.msgs
...and the configuration block...
*.debug {
action(
type="omfile"
file="/path/to/debug.msgs"
)
}
...are functionally identical. However, neither has a "name" specified
so you get a pstats statistics name of "action28" or something equally
as informative like "action31" or "action12".
Adding the action name to the new style configuration...
*.debug {
action(
name="debugActionName"
type="omfile"
file="/path/to/debug.msgs"
)
}
... gives a pstats statistics name of "debugActionName" as distinguished
from a separately defined "infoActionName", and this is much more useful
and several orders of magnitude easier than somehow having to know that
"action28" is the former and "action29" is the latter when doing stream
monitoring using pstats.
The pstats subsystem is your friend! Think of it as the EEG and EKG
monitors of your running instance, and give all of your actions unique
names to differentiate them in this manner.
Regards,
On 11/9/18 12:54 PM, David Lang wrote:
It it takes multiple lines to set something up (several $something
lines followed by the action), you are probably using the obsolete
format and should re-do it.
If what you are doing can be done in a single line, it's probably just
fine to keep using it.
Rsyslog started off using the same things that were in sysklog (what's
worked in syslog.conf forever), but as it gained new capabilities,
that syntax needed to be extended, and it got more and more
complicated to understand.
With version 6 a new syntax was introduced that makes it much easier
to understand what is happening with more complex configs. Initially
it was stated that everything in the older syntax was legacy and going
to go away 'someday', but over time we have refined this position to
discourage use of the parts that caused the most problems while still
supporting the simple things. This change from two categories of
syntax to three happened within the last year or so (I think around
8.30 or so) so the older documentation will refer to all of the old
syntax as legacy and suggest moving everything to the new format.
It's unlikely that we will ever remove support for what we are
declaring obsolete (we _really_ believe in backwards compatibility),
but we discourage it's use.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
