Under 5.3.6, I am trying to use property-based filtering to separate
local messages (coming in via imuxsock, presumably) from remote
messages (coming in via UDP). Initially, I tried using the 'inputname'
property to distinguish between the two:
:inputname, isequal, "imudp" /remote_udp.log
:inputname, isequal, "imuxsock" /local_socket.log
With this config, nothing ever ends up in the 2nd file
(/local_socket.log)--instead, because the 'inputname' property is
always set to 'imudp', regardless of where the input originates.
The property replacer docs mention that the value of 'inputname' isn't
guaranteed, so I guess this isn't necessarily a bug. Also, I found a
comment in the source code for 'imuxsock.c' that makes this behavior
seem to be intentional.
Why does only imuxsock behave like this? The other input modules I've
used (imrelp, imklog) provide the expected 'inputname' values
('imrelp' and 'imklog', respectively), which is intuitive and
consistent. Is there a reason why imuxsock needs to be different, or
is this a bug?
(In case anyone is wondering, I could work around this by comparing
the 'hostname' and '$myhostname' properties, in addition to checking
'inputname'. But that would force me to use expression-based filters
(property-based filtering doesn't support AND/OR logic), which seems
to increase the CPU activity per message. I really can't afford the
lost efficiency, here, if it can be helped.)
Ryan B. Lynch
[email protected]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
