Re: [rsyslog] queue.HighWaterMark message

Mike via rsyslog Sun, 08 Jun 2025 20:44:00 -0700

> In this case, the queues that rsyslog is complaining to the userabout are internally defined, hence the frustration of users like usthat have ZERO control over them, and to whom the messages were acomplete surprise courtesy of the latest version.


Internally defined?


Wow, that makes this issue even worse.

Is rsyslog intentionally foisting this issue upon its users?

Yeah, as a user subject to so many logged messages per millisecond (permillsecond!), I have difficulty in trying to dismiss this egregiousbehaviour of rsyslog.


To the point that I am now working towards no longer using rsyslog.

Why?

Two reasons:

1) the apparent capricious change in default behavior, via newly-enacteddefault parms, resulting in [for me] near-useless logs.

2) the apparent tone-deaf response on this support message list aboutthe severity of the issue.





On 6/8/2025 10:40 PM, John Chivian wrote:

rsyslog is complaining about queues numbered 0-12.  Not coincidentally the 
configuration has 13 lines defining output to a file.  For each of those 13 
internally defined queues there should be a highWaterMark and a lowWaterMark 
message once.  The block of error messages pasted below shows each of those 
messages twice, probably because two of the rules pickup the same event.  Then 
you see the message that rsyslog has started.

This is the behavior of the current version.  When it starts, for each queue 
that does not have an explicitly defined highWaterMark and lowWaterMark, there 
is a configuration warning.  These messages all come at once, at start time, 
hence the timestamps.  After these warnings is the normal “start” message.

In this case, the queues that rsyslog is complaining to the user about are 
internally defined, hence the frustration of users like us that have ZERO 
control over them, and to whom the messages were a complete surprise courtesy 
of the latest version.

In the posted configuration, the only thing that can be done to reduce the 
volume of those warnings (by half) is to identify which of the configuration 
lines is causing the duplication.  Beyond that the choices are reverting to a 
previous version, and/or waiting for the maintainers to “resolve” the issue.

On Jun 8, 2025, at 18:39, Mike via rsyslog <[email protected]> wrote:

My experience is that these messages only occur once, as a configuration 
warning when rsyslog starts.

I have had a different experience.

Please look at the timestamps....

2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-0-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-0-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-0-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-1-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-1-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-2-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-2-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-3-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-3-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-4-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-4-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-0-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-1-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-1-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-2-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-2-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-3-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-3-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-4-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-4-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-5-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-5-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-6-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-6-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-7-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-7-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-5-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-5-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-6-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-6-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-7-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-7-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-8-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-8-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-9-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-9-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-10-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-8-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-8-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-9-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-9-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-10-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-10-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-11-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-11-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.593 bigbox rsyslogd[42449]: queue "action-12-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.593 bigbox rsyslogd[42449]: queue "action-12-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-10-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-11-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.592 bigbox rsyslogd[42449]: queue "action-11-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.593 bigbox rsyslogd[42449]: queue "action-12-builtin:omfile
queue": queue.highWaterMark is set below queue size. It has been automatically been
adjusted to 900. In any case, we strongly recommend to review the queue definition and
resolve inconsistencies to guarantee the config really matches your intent. [v8.2504.0
try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.593 bigbox rsyslogd[42449]: queue "action-12-builtin:omfile
queue": queue.lowWaterMark is set below queue size or highWaterMark. It has been
automatically been adjusted to 900. In any case, we strongly recommend to review the
queue definition and resolve inconsistencies to guarantee the config really matches your
intent. [v8.2504.0 try https://www.rsyslog.com/e/2357 ]
2025-06-04T11:32:34.593 bigbox rsyslogd[42449]: [origin software="rsyslogd" swVersion="8.2504.0"
x-pid="42449" x-info="https://www.rsyslog.com";] start

That's just two milliseconds worth of entries, according to the rsyslog
timestamps.

On 6/8/2025 5:18 PM, John Chivian wrote:

That configuration doesn’t have any user defined queues, there’s nothing you can 
currently do other than revert to a previous version until the “issue" is 
addressed.  My experience is that these messages only occur once, as a configuration 
warning when rsyslog starts.  Yes, it’s a set of unexpected (and in some cases 
unwanted) log entries, but unless rsyslog is being restarted repeatedly I’d hesitate 
to call it “filling up the logs”.

On Jun 8, 2025, at 14:41, Mike via rsyslog <[email protected]> wrote:

The only thing you can currently do is explicitly add watermark
values to the user defined queue configurations


Where in my config is a queue defined?

I guess, more specifically, how might I be able to modify my config file to 
eliminate the extraneous log messages?

I've spent a couple hours reading the online documentation.  It has a lot of 
details (A LOT!), but I was not able to find any specifics or examples of how 
to resolve this issue.

thx.


On 6/8/2025 2:21 PM, John Chivian wrote:

This is a known issue that affects both user defined and internal queues.  The 
only thing you can currently do is explicitly add watermark values to the user 
defined queue configurations.  This will eliminate the messages for those 
queues, but not for the internal queues.
See https://github.com/rsyslog/rsyslog/ issues/5615#issuecomment-2841088817 
<https://github.com/rsyslog/rsyslog/ issues/5615#issuecomment-2841088817>

On Jun 8, 2025, at 11:32, Mike via rsyslog <[email protected]> wrote:

Hi,

I have recently started to see the following messages (repeated many, many 
times) in my system logs...

rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.highWaterMark is 
set below queue size. It has been automatically been adjusted to 900. In any case, we 
strongly recommend to review the queue definition and resolve inconsistencies to 
guarantee the config really matches your intent. [v8.2504.0 try https://www.rsyslog.com/ 
e/2357 ]

rsyslogd[15180]: queue "action-0-builtin:omfile queue": queue.lowWaterMark is 
set below queue size or highWaterMark. It has been automatically been adjusted to 900. In 
any case, we strongly recommend to review the queue definition and resolve 
inconsistencies to guarantee the config really matches your intent. [v8.2504.0 try 
https://www.rsyslog.com/e/2357 ]

The URL given in the message is a generic one.  I tried looking through the 
Documentation, but I saw nothing to help me resolve the cause of error message.

Running FreeBSD (AMD64) 14.2.  rsyslog version is in the log message.

What do I need to add to my rsyslog config file to prevent this message from 
filling up my logs?


My current rsyslog config file is pretty much simple, just trying to reproduce 
a syslog config file with a specific date format.  Config file is below.

Thanks for the assist.





rsyslog.conf:

-----------------------------------
# rsyslog

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # kernel logging


template(name="MyLogFormat" type="list") {
property(name="timestamp" dateFormat="year")
constant(value="-")
property(name="timestamp" dateFormat="month")
constant(value="-")
property(name="timestamp" dateFormat="day")
constant(value="T")
property(name="timestamp" dateFormat="hour")
constant(value=":")
property(name="timestamp" dateFormat="minute")
constant(value=":")
property(name="timestamp" dateFormat="second")
constant(value=".")
property(name="timestamp" dateFormat="subseconds" position.from="1" 
position.to="3")
constant(value=" ")
property(name="hostname" position.from="1" position.to="6")
constant(value=" ")
property(name="syslogtag")
constant(value=":")
property(name="msg" spifno1stsp="on" )
property(name="msg" droplastlf="on" )
constant(value="\n")
}


#if $programname == 'devd' then {
#   /var/log/devd.log
#}


*.err;kern.debug;auth.notice;authpriv.none;mail.crit /var/log/ 
console.log;MyLogFormat
*.notice;auth,authpriv,cron,ftp,kern,lpr,mail,user.none /var/log/ 
messages;MyLogFormat
kern.debug;user.info;syslog.info/var/log/messages;MyLogFormat
auth.info/var/log/auth.log;MyLogFormat
authpriv.debug/var/log/secure;MyLogFormat
console.*/var/log/console.log;MyLogFormat
cron.info/var/log/cron;MyLogFormat
daemon.info/var/log/daemon;MyLogFormat
mail.info/var/log/maillog;MyLogFormat
news.info/var/log/build.log;MyLogFormat

*.emerg/var/log/messages;MyLogFormat

local0.*/var/log/ods.log;MyLogFormat
local1.*/var/log/zss.log;MyLogFormat
#local3.*empty;MyLogFormat
#local4.*empty;MyLogFormat
#local5.*empty;MyLogFormat
#local6.*empty;MyLogFormat
#local7.*empty;MyLogFormat
#local8.*empty;MyLogFormat
#local9.*empty;MyLogFormat


-----------------------------------------------
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.


_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.


_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.


_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Re: [rsyslog] queue.HighWaterMark message

Reply via email to