template definitions happen at startup time, you don't define them during the
log processing, so your config is exactly the same as:
$template DynFile,"/var/log/remotelogs/CS Lab Head - %timestamp:::date-day%.log"
$template Dynfile,"/var/log/remotelogs/CS Lab Head Backup -
%timestamp:::date-day%.log"
if ($FROMHOST-IP=="10.200.0.1") then {
} else {
}
which doesn't make any sense.
what you can do is define a $. variable and use that variable in your template,
then populate that variable with different things during log processing.
David Lang
On Tue, 19 Sep 2023, Steve G via rsyslog wrote:
Date: Tue, 19 Sep 2023 18:37:06 +0000
From: Steve G via rsyslog <[email protected]>
To: "[email protected]" <[email protected]>
Cc: Steve G <[email protected]>
Subject: [rsyslog] rsyslog error trying to resolve
I am trying to pick a filename based on the IP of the machine sending the log.
I have this:
if ($FROMHOST-IP=="10.200.0.1") then {
$template DynFile,"/var/log/remotelogs/CS Lab Head - %timestamp:::date-day%.log"
} else {
$template Dynfile,"/var/log/remotelogs/CS Lab Head Backup -
%timestamp:::date-day%.log"
}
But when checking the rsyslog status, I'm seeing:
Sep 19 10:46:59 syslog systemd[1]: Starting System Logging Service...
Sep 19 10:46:59 syslog systemd[1]: Started System Logging Service.
Sep 19 10:46:59 syslog rsyslogd[66896]: error during parsing file
/etc/rsyslog.conf, on or before line 26: syntax error on token '}' [v8.2001.0
try https://www.rsyslog.com/e/2207 ]
Sep 19 10:46:59 syslog rsyslogd[66896]: could not interpret master config file
'/etc/rsyslog.conf'. [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
Sep 19 10:46:59 syslog rsyslogd[66896]: imuxsock: Acquired UNIX socket
'/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0]
Sep 19 10:46:59 syslog rsyslogd[66896]: [origin software="rsyslogd" swVersion="8.2001.0"
x-pid="66896" x-info="https://www.rsyslog.com";] start
What am I missing??
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
