I don't understand your problem. you have 4 templates defined, two with legacy
format (which I still use a lot) and two with the new format.
you can use any of the four formats with either the old format actions or the
new format actions.
what is it you are trying to do that isn't working?
David Lang
On Wed, 11 Dec 2019, Bradley Hieber via rsyslog wrote:
Date: Wed, 11 Dec 2019 12:30:36 -0500
From: Bradley Hieber via rsyslog <[email protected]>
To: [email protected]
Cc: Bradley Hieber <[email protected]>
Subject: [rsyslog] Two templates in the same ruleset
Hello List,
I am trying to do a dynamic file and string edit within a ruleset and am
coming up empty on examples. I want to replicate the two template edits
in the new format, but I am not seeing any examples of how to do both,
without using the legacy syntax. Config listed below:
template(name="AuditLogSavePath" type="list") {
constant(value="/data/syslogs/audit/")
property(name="fromhost-ip")
constant(value="/")
property(name="timegenerated" dateFormat="year")
constant(value="-")
property(name="timegenerated" dateFormat="month")
constant(value="-")
property(name="timegenerated" dateFormat="day")
constant(value="-")
property(name="fromhost-ip")
constant(value=".audit.log")
}
template(name"AuditMsg" type=string "string="%msg:2:$%\n")
ruleset(name="Audit-Rules"){
action(type="omfile" DynaFile="AuditLogSavePath")
}
# provides TCP syslog reception
input(type="imtcp" port="2514" ruleset="Audit-Rules")
#$InputTCPServerRun 2514
# $AllowedSender TCP,127.0.0.1,192.168.56.102
$template HostAudit,"/data/syslog/audit/%HOSTNAME%/audit.log"
$template auditFormat,"%msg%\n"
local6.* ?HostAudit;auditFormat
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
