Hello List,
I am trying to do a dynamic file and string edit within a ruleset and am
coming up empty on examples. I want to replicate the two template edits
in the new format, but I am not seeing any examples of how to do both,
without using the legacy syntax. Config listed below:
template(name="AuditLogSavePath" type="list") {
constant(value="/data/syslogs/audit/")
property(name="fromhost-ip")
constant(value="/")
property(name="timegenerated" dateFormat="year")
constant(value="-")
property(name="timegenerated" dateFormat="month")
constant(value="-")
property(name="timegenerated" dateFormat="day")
constant(value="-")
property(name="fromhost-ip")
constant(value=".audit.log")
}
template(name"AuditMsg" type=string "string="%msg:2:$%\n")
ruleset(name="Audit-Rules"){
action(type="omfile" DynaFile="AuditLogSavePath")
}
# provides TCP syslog reception
input(type="imtcp" port="2514" ruleset="Audit-Rules")
#$InputTCPServerRun 2514
# $AllowedSender TCP,127.0.0.1,192.168.56.102
$template HostAudit,"/data/syslog/audit/%HOSTNAME%/audit.log"
$template auditFormat,"%msg%\n"
local6.* ?HostAudit;auditFormat
--
Bradley Hieber
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
