[rsyslog] Moving from v5 to v7

[Roger Salisbury]

Upgrading from V5 to v7

#if $syslogfacility-text == 'local3' and not ($msg contains 
'com\.company\.[A-Z]') then  ?WEBAPP
if $syslogfacility-text == 'local3' and not ($msg contains 
'com\.company\.[A-Z]') then {
       ?WEBAPP
}


Shutting down system logger:                               [  OK  ]
Starting system logger: rsyslogd: run failed with error -2207 (see rsyslog.h or 
try http://www.rsyslog.com/e/2207 to learn what that number means)
                                                           [FAILED]

Do I need to group the "if" statement somehow?

$template 
HOSTS,"/opt/data/syslog/hosts/syslog/%$YEAR%/%HOSTNAME%/syslog-%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
APACHE,"/opt/data/syslog/hosts/apache/%$YEAR%/%HOSTNAME%-%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
TOMCAT,"/opt/data/syslog/hosts/tomcat/%$YEAR%/%HOSTNAME%/syslog-%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
WEBAPP,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/%HOSTNAME%/%$YEAR%/%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
TIMING,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/TIMING/%$YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
API,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/API/%$YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
CLIPDATA,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/CLIPDATA/%$YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
$template 
WORKFLOW,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/WORKFLOW/%$YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"


#*.*;local1.none;local2.none;local3.none         ?HOSTS
*.*;local1.none;local2.none;local3.none {
        ?HOSTS
}

#if $syslogfacility-text == 'local1' then  ?APACHE
if $syslogfacility-text == 'local1' then {
        ?APACHE
}

#if $syslogfacility-text == 'local2' then  ?TOMCAT
if $syslogfacility-text == 'local2' then  {
        ?TOMCAT
}

#if $syslogfacility-text == 'local3' and not ($msg contains 
'com\.company\.[A-Z]') then  ?WEBAPP
if $syslogfacility-text == 'local3' and not ($msg contains 
'com\.company\.[A-Z]') then {
       ?WEBAPP
}

#if $syslogfacility-text == 'local3' and ($msg contains 'com\.company\.TIMING') 
then ?TIMING

#if $syslogfacility-text == 'local3' and ($msg contains 'com\.company\.API') 
then ?API

#if $syslogfacility-text == 'local3' and ($msg contains 
'com\.company\.CLIPDATA') then ?CLIPDATA

#if $syslogfacility-text == 'local3' and ($msg contains 
'com\.company\.WORKFLOW') then ?WORKFLOW

:fromhost-ip, !isequal, "127.0.0.1" ~


Roger Salisbury  | Web Services |
| T3Media(formerly Thought Equity Motion)
Suite 135, 3001 E. Pershing Blvd., Cheyenne, WY 82001
E rsalisb...@t3media.com<mailto:rsalisb...@t3media.com> P  307.316.7221    M  
307.316.7221   F  720.382.2719

www.t3media.com<http://www.t3media.com/>

DISCLAIMER: This electronic message together with any attachments is 
proprietary and may contain confidential or other private information that is 
property of T3Media, Inc. If you are not the intended recipient, do not copy, 
disclose or use the contents in any way. Please also advise us by return e-mail 
that you have received the message and then please destroy. T3Media, Inc. is 
not responsible for any changes made to this message and / or any attachments 
after sending by T3Media, Inc. We use virus scanning software but exclude all 
liability for viruses or anything similar in this email or any attachment.

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.