On Mon, 18 Jan 2016, Otis Gospodnetić wrote:
Hi,Is there a way to tell rsyslog to "log a little extra", but on demand (i.e. not by increasing log levels via a config or restart)? We run Logene <http://sematext.com/logsene>, a log management service that makes use or rsyslog. Sometimes people ship poorly formatted logs to our rsyslog end point and logs never make it into Logsene, but it's really hard to figure out why exactly. Is there a mechanism to "give" a log to rsyslog and tell it to: * include debug log messages for this one log * return some sort of error somewhere/anywhere .... basically, is there any mechanism to make it a little less of a black box?
If you know anything about the log that is failing, you can setup an action to log it using the RSYSLOG_DebugFormat and see all the deatils of how the log is parsed apart.
Rsyslog also has the ability to turn the debug log on and off via a signal, take a look under debugging in the documentation.
today is a work holiday for many companies in the US, so I don't have access to my production systems to cut-n-paste examples, but if you can't figure it out from the documentation, ask again and I'll give a example tomorrow.
David Lang
_______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
