On Mon, Nov 19, 2018 at 2:52 PM David Lang <[email protected]> wrote: > On Mon, 19 Nov 2018, Mike Schleif wrote: > > > How can I do that? > > in your config for writing to mysql you specify a template to use, use > that same > template to write to a file > > old syntax > > /var/log/foo_file;bar_template > > new syntax > > action(type="omfile" filename="foo_file" template="bar_template") > > in general, if things aren't working the way you think they should, look > at the > actual data. > > you can also use the template RSYSLOG_Debug_Format to get a dump of > everything > that rsyslog knows about the log message to understand what your templates > are > doing. > > David Lang >
My problem is the intermittency of this issue. The errant Action runs hundreds of times each day, almost always successfully. In fact, that error stamped: Nov 15 11:39:43 is the last time it failed. authpriv.* all go to /var/log/secure, and when I look there for PID related events associated with that failure/error, there are three short lines, without any indication of line breaks and special characters. This particular event is my ssh'ing into subject host, which I do dozens of times each week, and normally successfully. What am I missing with your suggestion? ~ Mike _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
