In the old style of rsyslog configuration, you can say that you want to buffer
a file, rather than flush it after every write, with syntax like this
(prefixing the filename with '-'):
local4.info -/var/log/mylog
Reading the documentation of the omfile Output Module, I don't see an exact
om phone, thus brief.
>
> John Chivian via rsyslog schrieb am Do., 29.
> Sep. 2022, 23:25:
>
>> If I am not mistaken, buffering is the default in the new syntax such that
>> it is not necessary to state it explicitly. The maintainers will know for
>> sure.
>
I'm porting some configurations from syslog to rsyslog, and seeing some
unexpected selector behavior in rsyslog 8.2104
After reading the selector examples from the configuration portion of the
rsyslog manual, I'm either misunderstanding how this is supposed to work, or
there's a long standing i
x27;t cause any side effects.
You could add a "stop" directive to make sure that events matching your
selector won't be processed further. Like:
*.debug;local6.err {
action( type="omfile" file="/what/ever/file")
stop
}
On 2.11.2022 01:26, Gordon Mar
you please confirm that this still happens on the current
> version of rsyslog?
>
> David Lang
>
> On Wed, 2 Nov 2022, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog wrote:
>
> > Date: Wed, 2 Nov 2022 19:01:22 -0000
> > From: "Gordon Marler (BLOOMBERG/ 120 P
*.debug;local6.!=info
> On Nov 2, 2022, at 14:27, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog
> wrote:
>
> So, what would be the correct way to start with *.debug, then reduce to
> priority .err and higher for particular facilities, like local6?
>
> From: rsyslog@li
> need rewording if it works differently.
>>>>
>>>> MK
>>>>
>>>> On 2.11.2022 20:18, Rainer Gerhards via rsyslog wrote:
>>>>> Info is higher severity than debug, so it validly matches.
>>>>>
>>>>> Sent fro
l/994
Rainer
El jue, 3 nov 2022 a las 16:43, Gordon Marler (BLOOMBERG/ 120 PARK)
via rsyslog () escribió:
>
> Perfectly fine with a doc fix; we're converting from syslog selectors that
predate the 2000s (probably from around 1984 or so).
>
> So I'm still left with the questi
Noticing that all messages logged from Solaris rsyslog clients have a field in
all messages that rsyslog on AIX and Linux don't have:
Jan 30 12:12:16 nydevsol10 root: [ID 702911 user.info] This is a test
^
I tried to see where that fie
Follow up:
This field is prepended to all messages sent through the log(4D) device on
Solaris, as documented in the syslogd(8) and log(4D) man pages, before they hit
rsyslogd.
However, I'll work on using rsyslogd's property replacer mechanism to modify
the %msg property to remove this field vi
this.
Or you could run rsyslog on solaris instead of it's syslog daemon and avoid the
problem that way :-)
David Lang
On Tue, 31 Jan 2023, Gordon Marler (BLOOMBERG/ 120 PARK) via rsyslog wrote:
> Follow up:
>
> This field is prepended to all messages sent through the log(4D) device
11 matches
Mail list logo
