-----Original Message-----
> From: [email protected] [mailto:rsyslog-
> [email protected]] On Behalf Of Roger Salisbury
> Sent: Wednesday, October 24, 2012 5:52 PM
> To: rsyslog-users
> Subject: [rsyslog] Moving from v5 to v7
>
> Upgrading from V5 to v7
>
> #if $syslogfacility-text == 'local3' and not ($msg contains
> 'com\.company\.[A-Z]') then ?WEBAPP
> if $syslogfacility-text == 'local3' and not ($msg contains
> 'com\.company\.[A-Z]') then {
> ?WEBAPP
> }
>
>
> Shutting down system logger: [ OK ]
> Starting system logger: rsyslogd: run failed with error -2207 (see
> rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that
> number means)
Could you run it interactively and tell the complete set of error messages?
That would be very helpful.
The "if" above looks OK, but it will probably not do what you want. It does NOT
test for a regex, so the text exactly as you wrote it must be contained inside
the message.
The problem you have is potentially a problem with the config grammar, which
mis-interprets the legacy dynafile action. Instead of
?WEBAPP
You can try to use
action(type="omfile" dynafile="WEBAPP")
[along these lines, check omfile doc for exact syntax]
Please let me know the results and if you wanted to use a regex.
Rainer
> [FAILED]
>
> Do I need to group the "if" statement somehow?
>
> $template
> HOSTS,"/opt/data/syslog/hosts/syslog/%$YEAR%/%HOSTNAME%/syslog-%$YEAR%-
> %$MONTH%-%$DAY%.log"
> $template APACHE,"/opt/data/syslog/hosts/apache/%$YEAR%/%HOSTNAME%-
> %$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> TOMCAT,"/opt/data/syslog/hosts/tomcat/%$YEAR%/%HOSTNAME%/syslog-
> %$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> WEBAPP,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/%HOSTNAME%/%$
> YEAR%/%$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> TIMING,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/TIMING/%$YEAR
> %/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> API,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/API/%$YEAR%/%HOS
> TNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> CLIPDATA,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/CLIPDATA/%$
> YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
> $template
> WORKFLOW,"/opt/data/syslog/webapp/%msg:F,59:2%/%msg:F,59:3%/WORKFLOW/%$
> YEAR%/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log"
>
>
> #*.*;local1.none;local2.none;local3.none ?HOSTS
> *.*;local1.none;local2.none;local3.none {
> ?HOSTS
> }
>
> #if $syslogfacility-text == 'local1' then ?APACHE
> if $syslogfacility-text == 'local1' then {
> ?APACHE
> }
>
> #if $syslogfacility-text == 'local2' then ?TOMCAT
> if $syslogfacility-text == 'local2' then {
> ?TOMCAT
> }
>
> #if $syslogfacility-text == 'local3' and not ($msg contains
> 'com\.company\.[A-Z]') then ?WEBAPP
> if $syslogfacility-text == 'local3' and not ($msg contains
> 'com\.company\.[A-Z]') then {
> ?WEBAPP
> }
>
> #if $syslogfacility-text == 'local3' and ($msg contains
> 'com\.company\.TIMING') then ?TIMING
>
> #if $syslogfacility-text == 'local3' and ($msg contains
> 'com\.company\.API') then ?API
>
> #if $syslogfacility-text == 'local3' and ($msg contains
> 'com\.company\.CLIPDATA') then ?CLIPDATA
>
> #if $syslogfacility-text == 'local3' and ($msg contains
> 'com\.company\.WORKFLOW') then ?WORKFLOW
>
> :fromhost-ip, !isequal, "127.0.0.1" ~
>
>
> Roger Salisbury | Web Services |
> | T3Media(formerly Thought Equity Motion)
> Suite 135, 3001 E. Pershing Blvd., Cheyenne, WY 82001
> E [email protected]<mailto:[email protected]> P 307.316.7221
> M 307.316.7221 F 720.382.2719
>
> www.t3media.com<http://www.t3media.com/>
>
> DISCLAIMER: This electronic message together with any attachments is
> proprietary and may contain confidential or other private information
> that is property of T3Media, Inc. If you are not the intended
> recipient, do not copy, disclose or use the contents in any way. Please
> also advise us by return e-mail that you have received the message and
> then please destroy. T3Media, Inc. is not responsible for any changes
> made to this message and / or any attachments after sending by T3Media,
> Inc. We use virus scanning software but exclude all liability for
> viruses or anything similar in this email or any attachment.
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
