Re: [rsyslog] change in filer

2023-05-04 Thread Rainer Gerhards via rsyslog
No problem, thanks! Sent from phone, thus brief. Brad Van Orden schrieb am Do., 4. Mai 2023, 14:45: > I figured it out. I had a second line in that same file that started with: > > if $progamname == "systemd-logind" > > I was missing the second 'r' in programname. :( > > Sorry for the

Re: [rsyslog] change in filer

2023-05-04 Thread Brad Van Orden via rsyslog
I figured it out. I had a second line in that same file that started with: if $progamname == "systemd-logind" I was missing the second 'r' in programname. :( Sorry for the bother. On Thu, May 4, 2023 at 6:10 AM Brad Van Orden wrote: > version is 8.2102.0-10.el8 > rsyslogd -N1 spits out: >

Re: [rsyslog] change in filer

2023-05-04 Thread Brad Van Orden via rsyslog
version is 8.2102.0-10.el8 rsyslogd -N1 spits out: rsyslogd: error during parsing file /etc/rsyslog.d/ignore-systemd-session-slice.conf, on or before line 2: invalid property 'programname' [v8.2102.0-10.el8 try https://www.rsyslog.com/e/2207 ] rsyslog.conf: $PreserverFQDN on $ModLoad imuxsock

Re: [rsyslog] change in filer

2023-05-04 Thread Rainer Gerhards via rsyslog
This is strange. No,everything is supported, we never remove any config capability without very, very strong reason. Plus, the "if" is not BSD-Style but script, the most modern filter. Which version is running on RHEL 8? How does the full config look like? What does rsyslogd -N1 split out?

[rsyslog] change in filer

2023-05-04 Thread Brad Van Orden via rsyslog
On RHEL 7, I have a filter: if $programname == "systemd" and ( $msg contains "Starting Session" or $msg contains "Started Session" ) then stop which works fine. However under RHEL 8, I get invalid property 'programname' I think this is because BSD type filters are no longer supported, but I'm