Hi,
I have been trying to implement separate logging for haproxy.
But I end up with duplicate logging and can't separate logs based on the
input socket or facility alone.
My sample configuration in haproxy:
Global configuration:
log /dev/log len 1024 format local local0 debug
Frontend -1 configuration (for Web requests):
log /dev/request-log len 1024 format local local1
debug
Frontend-2 configuration (for DB requests):
log /dev/db-log len 1024 format local local2 debug
So here I was basically trying to redirect logs to different sockets and
additionally I also used different facilities for each, because I don't
know how to redirect messages based on input socket.
And in rsyslog configuration, I added the following:
$AddUnixListenSocket /var/lib/haproxy/dev/log
local0.* /var/log/haproxy/haproxy.log
$AddUnixListenSocket /var/lib/haproxy/dev/request-log
local2.* /var/log/haproxy/requests.log
$AddUnixListenSocket /var/lib/haproxy/dev/db-log
local3.* /var/log/haproxy/db.log
But all the above log files have the same logging i.e., web request
logging, db logging and other haproxy logging all are duplicated in these
three files.and including default /var/log/messages.
Complete rsyslog.conf:
$ModLoad imuxsock
$ModLoad imjournal
$WorkDirectory /var/lib/rsyslog
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$SystemLogSocketName /run/systemd/journal/syslog
$OmitLocalLogging on
$IMJournalStateFile imjournal.state
*.info;mail.none;authpriv.none;cron.none /var/log/messages
authpriv.* /var/log/secure
mail.* -/var/log/maillog
cron.* /var/log/cron
*.emerg :omusrmsg:*
uucp,news.crit /var/log/spooler
local7.* /var/log/boot.log
local1.* /var/log/keepalived.log
$AddUnixListenSocket /var/lib/haproxy/dev/log
local0.* /var/log/haproxy/haproxy.log
$AddUnixListenSocket /var/lib/haproxy/dev/request-log
local2.* /var/log/haproxy/requests.log
$AddUnixListenSocket /var/lib/haproxy/dev/db-log
local3.* /var/log/haproxy/db.log
I see it works correctly if I use something like this instead of using
facility: (i..e, no duplication happens)
:programname, startswith, "haproxy" {
/var/log/haproxy/haproxy.log
stop
}
But it is unwanted extra processing when it could be easy to filter out
messages based on input socket or facility name.
Can anyone help me understand why the duplication is happening, but not in
the case for other default sections like cron, mail, authpriv etc. where
there is no duplication.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
