Re: [rsyslog] Syslogging FQDN logfile/logdir howto/links/examples

[david]

the surest way to tell that the DNS cache is working is to look at traffic 
to your DNS server (or more precisely the lack of traffic to that host)

any way of checking in rsyslog itself is something that is brand new 
thing. There may be something in the rsyslog documentation, but I don't 
know anything about it.

David Lang

 On Fri, 27 Jan 2012, Michael Maymann wrote:

Date: Fri, 27 Jan 2012 15:53:30 +0100
From: Michael Maymann <mich...@maymann.org>
Reply-To: rsyslog-users <rsyslog@lists.adiscon.com>
To: rsyslog-users <rsyslog@lists.adiscon.com>
Subject: Re: [rsyslog] Syslogging FQDN logfile/logdir howto/links/examples

Hi List,

Please - anyone who can help with this ?


Thanks in advance :-) !
~maymann

2012/1/25 Michael Maymann <mich...@maymann.org>

Hi,

1. how do I test if dns-cache is enabled in v6.3.6-devel (strace rsyslog
-c6... what to look for...?) ?
2. This is my current rsyslog.conf - comments are very welcome (any thing
that looks odd to you...?):
---
#LOAD MODULES
$ModLoad imtcp
$InputTCPServerRun 514

#SET DESTINATION FOR LOGS
$template
DYNmessages,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_messages"
$template
DYNsecure,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_secure"
$template
DYNmaillog,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_maillog"
$template DYNcron,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_cron"
$template
DYNspooler,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_spooler"
$template
DYNboot,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_boot.log"
$template
DYNtraps,"/local/logs/%FROMHOST%/%FROMHOST%_%$YEAR%.%$MONTH%_traps"

#SET LOGGING CONDITIONS
if $syslogseverity <= '6' then ?DYNmessages
if $syslogfacility-text == 'authpriv' then ?DYNsecure
if $syslogfacility-text == 'mail' then ?DYNmaillog
if $syslogfacility-text == 'cron' then ?DYNcron
if $syslogseverity-text == 'crit' then ?DYNspooler
if $syslogfacility-text == 'local7' then ?DYNboot
if $syslogfacility-text == 'local6' and $syslogseverity-text == 'WARNING'
then ?DYNtraps
---

3. A little off-topic - I have setup monthly logrotate:
/DIR_TO_LOGS/*/*
{
        rotate 36
        monthly
        missingok
        notifempty
#        delaycompress
#        compress
        create 2750 _rsyslog rme_it
        sharedscripts
        postrotate
                service rsyslog restart >/dev/null 2>&1 || true
        endscript
}
3.a: is this looking at each logfiles fileage (and rotate when the fileage
is more than 1 month old) or does it rotate the files every 1st of the
month ?
3.b: we use SIS and think of dedublication (from NetAPP) instead of
compressing data during logrotate - any experience, recommendations ?


Br.
~maymann



2012/1/19 Michael Maymann <mich...@maymann.org>

Hi David,

Thanks for your reply...:-) !

2012/1/19 <da...@lang.hm>

On Thu, 19 Jan 2012, Michael Maymann wrote:

 Hi,

Got it installed...:
yum install zlib-devel.x86_64
yum install byacc.x86_64
did the trick for me...
Thanks for your help Rainer...:-) !

Trying to look through the man-page and googling a bit...
1. do I have to enable DNS cache somewhere, or is this feature on by
default ?


I don't know


Ok, anyone who knows this ?



 2. Is there some v6.3.6 version config examples somewhere. I would need
to:
a. generally have logfiles in a
/NFS_logdir/FQDN/equial_to_**local_logfile_name (e.g. messages)
b. have maillog from mailcluster=host001 (host001a+host001b) being
merged
in a single /NFS_logdir/host001/maillog file


unless you are needing some 6.x specific feature, the configs from
earlier versions will still work.


I'm don't think I do...:-) - besides the DNS cache thing.
But I'm new to syslog/rsyslog and wondering if someone has a link/example
to something similar to what I describe above.


David Lang

______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>




_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/