just out of curiosity: could you create a debug log of a startup with the original config? Maybe I am just not spotting the problem, maybe it's a bug in that old version.
debug log: https://www.rsyslog.com/doc/master/troubleshooting/howtodebug.html Rainer El jue, 17 feb 2022 a las 22:18, Antonio Leding (<[email protected]>) escribió: > > It works fine - this original stanza is shown below. The only difference, > aside from the hostname being part of the conditions, is that the last > statement is an ‘else if’ instead of an ‘else’: > > if ($hostname contains ‘srv1’ and $syslogfacility-text == 'local7') then { > /var/log/srv1_local7.log > & stop > } else if ($hostname contains 'srv1' and $msg contains 'PROXY') then { > /var/log/srv1_proxy.log > & stop > } else if ($hostname contains 'srv1') then { > /var/log/srv1_main.log > & stop > } > > ________________________________ > > On 17 Feb 2022, at 13:12, Rainer Gerhards wrote: > > Quite old, but should work. > > Remove the outer if as a test. What happes than? > > Sent from phone, thus brief. > > Antonio Leding <[email protected]> schrieb am Do., 17. Feb. 2022, 22:10: >> >> Hello David & Rainer - apologies as I meant to include the version: >> >> rsyslogd 8.24.0, compiled with: >> PLATFORM: x86_64-redhat-linux-gnu >> PLATFORM (lsb_release -d): >> FEATURE_REGEXP: Yes >> GSSAPI Kerberos 5 support: Yes >> FEATURE_DEBUG (debug build, slow code): No >> 32bit Atomic operations supported: Yes >> 64bit Atomic operations supported: Yes >> memory allocator: system default >> Runtime Instrumentation (slow code): No >> uuid support: Yes >> Number of Bits in RainerScript integers: 64 >> >> ________________________________ >> >> On 17 Feb 2022, at 13:04, Rainer Gerhards wrote: >> >> No, not perfectly. The ampersand of course is invalid, it's just an old >> shortcut forn for joining actions, what in script is done by curly braces. >> >> Version? >> >> Rainer >> >> Sent from phone, thus brief. >> >> Rainer Gerhards <[email protected]> schrieb am Do., 17. Feb. 2022, >> 22:00: >>> >>> No, the code is perfectly valid. I guess the outer if evaluates to false. >>> >>> Rainer >>> >>> Sent from phone, thus brief. >>> >>> David Lang via rsyslog <[email protected]> schrieb am Do., 17. Feb. >>> 2022, 21:39: >>>> >>>> try: >>>> >>>> if ($hostname contains ‘srv1’) then { >>>> if ($syslogfacility-text == 'local7') then { >>>> /var/log/srv1_local7.log >>>> } else { >>>> if ($msg contains ‘PROXY’) then { >>>> /var/log/srv1_proxy.log >>>> } else { >>>> /var/log/srv1_main.log >>>> } >>>> stop >>>> } >>>> } >>>> >>>> David Lang >>>> >>>> On Thu, 17 Feb 2022, Antonio Leding via rsyslog wrote: >>>> >>>> > Date: Thu, 17 Feb 2022 20:35:48 +0000 >>>> > From: Antonio Leding via rsyslog <[email protected]> >>>> > To: [email protected] >>>> > Cc: Antonio Leding <[email protected]> >>>> > Subject: [rsyslog] Nested if/else-if/else statements >>>> > >>>> > Hello rsyslog community, >>>> > >>>> > Are nested if/else-if/else statements supported? For example, I tried >>>> > the following but this fails to grab any log messages: >>>> > >>>> > if ($hostname contains ‘srv1’) then { >>>> > if ($syslogfacility-text == 'local7') then { >>>> > /var/log/srv1_local7.log >>>> > } else if ($msg contains ‘PROXY’) then { >>>> > /var/log/srv1_proxy.log >>>> > } else { >>>> > /var/log/srv1_main.log >>>> > } >>>> > & stop >>>> > } >>>> > >>>> > Also, if I remove the “& stop” at the end, only the last statement >>>> > for ‘srv1_main.log’ grabs log messages. >>>> > >>>> > Thanks in advance. >>>> > _______________________________________________ >>>> > rsyslog mailing list >>>> > https://lists.adiscon.net/mailman/listinfo/rsyslog >>>> > http://www.rsyslog.com/professional-services/ >>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> > of >>>> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>>> > LIKE THAT. >>>> _______________________________________________ >>>> rsyslog mailing list >>>> https://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. _______________________________________________ rsyslog mailing list https://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
