Hi all, I'm sure I'm doing something stupid that's causing this not to
work.
I am trying to format the logs coming in on local1.info so that they are
saved in a separate file, and have a custom date-stamp vs the other logs
that are being written to other files.
I am using rsyslog v8.24 on CentOS 7.5 if this is correct:
# rpm -qa |grep rsyslog
rsyslog-8.24.0-16.el7_5.4.x86_64
Here is my template:
template (name="local1template" type="list") {
property(name="timereported" dateformat="date-year")
constant(value="-")
property(name="timereported" dateformat="date-month")
constant(value="-")
property(name="timereported" dateformat="date-day")
constant(value=" ")
property(name="timereported" dateformat="date-hour")
constant(value=":")
property(name="timereported" dateformat="date-minute")
constant(value=":")
property(name="timereported" dateformat="date-second")
constant(value=" ")
property(name="timereported" dateformat="date-wdayname")
constant(value=" ")
property(name="hostname")
constant(value=" ")
property(name="syslogtag")
constant(value=" ")
property(name="msg")
constant(value="\n")
}
and my binding:
local1.* action(type="omfile" file="/var/log/jmtest.log"
template="local1template")
When I restart rsyslogd, I eithe get nothing logged from local1.info, or
it falls through to the 'messages' file.
When I run rsyslogd in debug mode, it complains that it doesn't like
'dateformat="date-year"'. I commented out that part, and it then
complained about 'dateformat="date-month"'.
It's very unclear to me what I should be putting in this template. It's
also unclear whether I'm going about this correctly at all. Should I be
using the property-replacer instead somehow? How would that even work
here?
Thanks everyone, sorry if this is in the doc somewhere, but if it is I
haven't been able to find (or perhaps recognize) it.
---
Jason Marshall
Katalyst Data Management
www.katalystdm.com | www.seismiczone.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
