El lun., 18 mar. 2019 a las 15:53, Secrist, Eric (<[email protected]>) escribió: > > The problem appears to have been using "set" statement outside of a ruleset > definition, not using an intermediary variable as I thought previously. > > This did NOT work, where the set statement is not part of the ruleset > definition, the $!csv_msg variable was empty: > set $!csv_msg = replace($msg,"|",","); > template(name="isilon_tmpl" type="string" > string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% > %syslogtag%%$!csv_msg%\n") > > ruleset(name="isilon_rset") { > if ($msg contains "/xxxxx" or $msg contains "/xxxx" or $msg contains > "/xxxx") then { > action(type="omfile" FileCreateMode="0644" > File="/var/log/remote/msg/eric-test" template="isilon_tmpl") > } > } > > This DID work, where the set statement IS part of the ruleset definition: > template(name="isilon_tmpl" type="string" > string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% > %syslogtag%%$!csv_msg%\n") > > ruleset(name="isilon_rset") { > if ($msg contains "/ifs/cda/userdata/ctshared" or $msg contains > "/ifs/cda/userdata/cdm" or $msg contains "/ifs/cda/userdata/DevIS") then { > set $!csv_msg = replace($msg,"|",","); > action(type="omfile" FileCreateMode="0644" > File="/var/log/remote/msg/eric-test" template="isilon_tmpl") > } > } > > Is this expected behavior?
Definitely! If a statement is not inside the rule set, it is not executed. That's why rulesets exists: group statements that shall be executed together. Rainer > > Regards, > Eric _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
