there should be nothing special in the name (unless you managed to conflict with
a built-in name), can you try the old name with this working format?
David Lang
On Wed, 10 Mar 2021, linksonice via rsyslog wrote:
Date: Wed, 10 Mar 2021 11:14:25 -0700 (MST)
From: linksonice via rsyslog <[email protected]>
To: [email protected]
Cc: linksonice <[email protected]>
Subject: Re: [rsyslog] another n00b question about logging clients logs to
their own directories based on hostnames
Even better, the total solution:
###############
if ($hostname != "aws-delta-mon") then {
$template
DynaFile,"/var/log/external/%HOSTNAME%/windows_events-%$YEAR%%$MONTH%%$DAY%.log"
*.* -?DynaFile
}
###############
This prevents the rsyslog server from logging everything in duplicate under
/var/log/external.
I realised somewhat late in the game that $template [pre-V6 notation] is
acceptable in v8 or post v6, but the issue I found, if you read the entire
thread here is that whilst it's acceptable syntactically, it just doesn't
work. Maybe there was something else missing in my rsyslog.conf, but it's
just not straightforward enough really. Hope this helps somebody going
forward. Call me lazy [and many do :D], but maybe the documentation could
use a bunch of tried and tested example use cases.
--
Sent from: http://rsyslog-users.1305293.n2.nabble.com/
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
