It's trivial to have multiple instances of rsyslogd but you have to be
very specific about who gets what inputs, and be careful that the
instances do not collide. We have many rsyslogd instances per system.
Each has a specific input (high port listener), transformation pipeline,
output set, and telemetry stream to accomplish a single purpose. They
do not have to run as root, and can be defined as individual system
services. This makes control of each totally independent of the others.
Regards,
On 10/30/19 10:28 AM, sch via rsyslog wrote:
Thanks a lot Rainer for quick response.
1. This filter works! Thanks!
2. Ok, I understand it's not possible to load new config without restart
service.
What about having 2 instances of rsyslogd?
Is it possible?
First one to catch logs on machine and store them in files, with simple cfg
like:
module(load="imuxsock") # provides support for local system logging
module(load="imklog")
$template TraditionalFormat,"%timegenerated% %HOSTNAME%
%syslogtag%%syslogpriority-text%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
*.* /var/log/all.log;TraditionalFormat
And second one to remote logging with cfg like I mentioned in first post.
Is this gonna work fine?
3. I saw sometines at end of logs appears '#012' it's caused probably by
'\n' sign. Can I do something with it?
Regards
Sebastian
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
