> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Beat Meier > Sent: Wednesday, October 10, 2012 5:57 AM > To: rsyslog-users > Subject: [rsyslog] How can I log to different path if localmachine with > templates? > > Hello > > I have 26 templates of the form > $template > DynFileAuth,"/data/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/auth.log" > $template > DynFileSyslog,"/data/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/syslog" > which will log to my data partition.Now I had a problem with the data > partition and the local log > went to to this data partition. > What I want to do is seperate local logs from remote logs i.e. > something > like > > if $fromhost == 'xxx' then { > $template > DynFileAuth,"/gugus/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/auth.log" > $template > DynFileSyslog,"/gugus/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/syslog" > ... > } > else { > $template > DynFileAuth,"/data/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/auth.log" > $template > DynFileSyslog,"/data/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/syslog" > ... > } > > or even better define a head of path for each case as a property like > if $fromhost == 'xxx' then > HEAD="/gugus" > else > HEAD="/data" > > $template > DynFileAuth,"/%HEAD%/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/auth.log" > $template > DynFileSyslog,"/%HEAD%/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/syslog" > > How can I do that?
This should work (minus maybe a syntax error or small mistake by me - see rsyslog error messages if that happens): if $fromhost == 'xxx' then set !usr!HEAD="/gugus"; else set !usr!HEAD="/data"; $template DynFileAuth,"/%$!usr!HEAD%/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/auth.log" $template DynFileSyslog,"/%$!usr!HEAD%/syslog/%HOSTNAME%/%$YEAR%%$MONTH%%$DAY%/syslog" Doc on that new feature is sparse, will come with the next beta updates. In the mean time, I suggest reading: http://blog.gerhards.net/2012/09/setting-variables-in-rsyslog-v7.html HTH Rainer > > Greetings and thanks for the nice syslog relplacement!! _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
