Sorry if it was confusing, it was just a call example. As said, post the whole configuration.
Flo On Tue, Apr 2, 2019 at 9:29 PM Gorman, Kevin via rsyslog < [email protected]> wrote: > I found a few issues. I defined the *.* wrong for one. The *.* is all logs > defined in rsyslog.conf, which we don’t touch and the version is 8.24 > > I want to use a ruleset to separate the info and make things modular. > Since I also forward a large number of files, I’d prefer to define the > address, port and protocol in one separate file. Here's the ruleset and my > best guess of the action, but it doesn't work, meaning the log messages > aren’t forwarded. Obviously it’s syntax is incorrect. It isn’t clear how to > use an if statement to do what I’m trying to do. > > The file forwarding looks like it works using the ruleset. > > global ( > parser.dropTrailingLFOnReception="on" > parser.escapeControlCharactersOnReceive="on" > workDirectory="/var/lib/rsyslog" > > ruleset( > name="linux_forward" > queue.type="LinkedList" > queue.filename="FwdRule0" > queue.maxDiskSpace="1g" > queue.saveOnShutdown="on" > ) { > action( > type="omfwd" > target="2001:4888:a00:3154:f0:ff2:0:b01" # logserver VIP > protocol="udp" > port="5544" > ) > stop > } > > *.* action( > type="omfwd" > ruleset="linux_forward" > tag="rsyslog" > name="rsyslog" > ) > > From: Flo Rance [mailto:[email protected]] > Sent: Tuesday, April 02, 2019 6:08 AM > To: rsyslog-users > Cc: David Lang; Gorman, Kevin > Subject: Re: [rsyslog] [E] Re: Help with newer syntax a ruleset and > forwarding > > I use a similar config to forward from my servers. > > ruleset(name="linux_forward" queue.type="LinkedList" > queue.filename="nlsFwdRule0" queue.maxDiskSpace="1g" > queue.saveOnShutdown="on") { > action(type="omfwd" target="2001:4888:a00:3154:f0:ff2:0:b01" > protocol="udp" port="5544" resumeRetryCount="-1") > } > > and it's called like that: > > if (....) then { > call linux_forward > stop > } > > Flo > > On Mon, Apr 1, 2019 at 9:27 PM Gorman, Kevin via rsyslog < > [email protected]<mailto:[email protected]>> wrote: > For the moment, I've removed the app part of the configuration. Redhat > suggested changing action to the config that's below. Still, nothing is > forwarded, which is the sole purpose of the configuration. I'm trying to > use the rule to avoid repeating the IP address over and over as well as to > not use lots of files. > > I imagine I could use the earlier format and combine the files, so that's > not really a big issue. If it's better I'm not against just using the > earlier format. > > # cat rsyslog.all.conf > module(load="imfile" mode="inotify") > > global ( > parser.dropTrailingLFOnReception="on" > parser.escapeControlCharactersOnReceive="on" > workDirectory="/var/lib/rsyslog" > ) > > ruleset( > name="linux_forward" > queue.type="LinkedList" > queue.filename="nlsFwdRule0" > queue.maxDiskSpace="1g" > queue.saveOnShutdown="on" > ) { > action( > type="omfwd" > target="2001:4888:a00:3154:f0:ff2:0:b01" # VIP address of > logserver > protocol="udp" > port="5544" > #resumeRetryCount="-1" > ) > stop > } > > # cat rsyslog.linux.conf > > input( > type="imfile" > ruleset="linux_forward" > file="*.*" > escapeLF="on" > tag="syslog" > ) > > input( > type="imfile" > ruleset="linux_forward" > tag="ansible" > file="/var/log/ansible.log" > escapeLF="on" > ) > > input( > type="imfile" > ruleset="linux_forward" > tag="audit" > file="/var/log/audit/audit.log" > escapeLF="on" > ) > > ]# rsyslogd -N2 > rsyslogd: version 8.24.0-34.el7, config validation run (level 2), master > config /etc/rsyslog.conf > > 6396.163499269:main thread : debug level 2 set via config file > 6396.163515320:main thread : This is rsyslog version 8.24.0-34.el7 > 6396.163520128:main thread : config parser: reached end of file > /etc/rsyslog.d/rsyslog.debug.conf > 6396.163524390:main thread : config parser: resume parsing of file > /etc/rsyslog.d/rsyslog.linux.conf at line 1 > 6396.163531565:main thread : cnf:global:obj: obj: 'input' > 6396.163538048:main thread : nvlst 0x562f39069bb0: > 6396.163541541:main thread : name: 'tag', value 'syslog' > 6396.163545544:main thread : name: 'escapeLF', value 'on' > 6396.163549402:main thread : name: 'file', value '*.*' > 6396.163553221:main thread : name: 'ruleset', value > 'linux_forward' > 6396.163557231:main thread : name: 'type', value 'imfile' > 6396.163562884:main thread : nvlstGetParam: name 'type', type 14, > valnode->bUsed 0 > 6396.163566743:main thread : input param blk after inputProcessCnf: > 6396.163570295:main thread : type: 'imfile' > 6396.163579084:main thread : newInpInst (imfile) > 6396.163582949:main thread : nvlstGetParam: name 'file', type 14, > valnode->bUsed 0 > 6396.163586431:main thread : nvlstGetParam: name 'tag', type 14, > valnode->bUsed 0 > 6396.163590393:main thread : nvlstGetParam: name 'ruleset', type 14, > valnode->bUsed 0 > 6396.163594337:main thread : nvlstGetParam: name 'escapelf', type 4, > valnode->bUsed 0 > 6396.163598668:main thread : input param blk in imfile: > 6396.163601763:main thread : file: '*.*' > 6396.163609748:main thread : tag: 'syslog' > 6396.163617468:main thread : severity: (unset) > 6396.163625204:main thread : facility: (unset) > 6396.163632741:main thread : ruleset: 'linux_forward' > 6396.163640567:main thread : readmode: (unset) > 6396.163647878:main thread : startmsg.regex: (unset) > 6396.163655402:main thread : escapelf: 1 > 6396.163663156:main thread : reopenontruncate: (unset) > 6396.163670723:main thread : maxlinesatonce: (unset) > 6396.163678123:main thread : trimlineoverbytes: (unset) > 6396.163685535:main thread : maxsubmitatonce: (unset) > 6396.163693026:main thread : removestateondelete: (unset) > 6396.163700527:main thread : persiststateinterval: (unset) > 6396.163707941:main thread : deletestateonfiledelete: (unset) > 6396.163715616:main thread : addmetadata: (unset) > 6396.163723134:main thread : addceetag: (unset) > 6396.163730628:main thread : statefile: (unset) > 6396.163738023:main thread : readtimeout: (unset) > 6396.163745561:main thread : freshstarttail: (unset) > 6396.163753288:main thread : filenotfounderror: (unset) > 6396.163766549:main thread : imfile: adding file monitor for > '/etc/rsyslog.d/*.*' > 6396.163773257:main thread : cnf:global:obj: obj: 'input' > 6396.163779160:main thread : nvlst 0x562f39069bb0: > 6396.163782591:main thread : name: 'escapeLF', value 'on' > 6396.163786546:main thread : name: 'file', value > '/var/log/ansible.log' > 6396.163790411:main thread : name: 'tag', value 'ansible' > 6396.163794224:main thread : name: 'ruleset', value > 'linux_forward' > 6396.163797976:main thread : name: 'type', value 'imfile' > 6396.163801795:main thread : nvlstGetParam: name 'type', type 14, > valnode->bUsed 0 > 6396.163805261:main thread : input param blk after inputProcessCnf: > 6396.163808489:main thread : type: 'imfile' > 6396.163816432:main thread : newInpInst (imfile) > 6396.163819936:main thread : nvlstGetParam: name 'file', type 14, > valnode->bUsed 0 > 6396.163823434:main thread : nvlstGetParam: name 'tag', type 14, > valnode->bUsed 0 > 6396.163826995:main thread : nvlstGetParam: name 'ruleset', type 14, > valnode->bUsed 0 > 6396.163831104:main thread : nvlstGetParam: name 'escapelf', type 4, > valnode->bUsed 0 > 6396.163834918:main thread : input param blk in imfile: > 6396.163838094:main thread : file: '/var/log/ansible.log' > 6396.163846164:main thread : tag: 'ansible' > 6396.163853819:main thread : severity: (unset) > 6396.163861180:main thread : facility: (unset) > 6396.163868499:main thread : ruleset: 'linux_forward' > 6396.163876167:main thread : readmode: (unset) > 6396.163887346:main thread : startmsg.regex: (unset) > 6396.163894769:main thread : escapelf: 1 > 6396.163902192:main thread : reopenontruncate: (unset) > 6396.163909580:main thread : maxlinesatonce: (unset) > 6396.163917049:main thread : trimlineoverbytes: (unset) > 6396.163924368:main thread : maxsubmitatonce: (unset) > 6396.163931741:main thread : removestateondelete: (unset) > 6396.163939088:main thread : persiststateinterval: (unset) > 6396.163946539:main thread : deletestateonfiledelete: (unset) > 6396.163953922:main thread : addmetadata: (unset) > 6396.163961245:main thread : addceetag: (unset) > 6396.163968548:main thread : statefile: (unset) > 6396.163976034:main thread : readtimeout: (unset) > 6396.163983654:main thread : freshstarttail: (unset) > 6396.163990987:main thread : filenotfounderror: (unset) > 6396.163999425:main thread : imfile: adding file monitor for > '/var/log/ansible.log' > 6396.164005230:main thread : cnf:global:obj: obj: 'input' > 6396.164010915:main thread : nvlst 0x562f39069b50: > 6396.164014145:main thread : name: 'escapeLF', value 'on' > 6396.164017884:main thread : name: 'file', value > '/var/log/audit/audit.log' > 6396.164021570:main thread : name: 'tag', value 'audit' > 6396.164025149:main thread : name: 'ruleset', value > 'linux_forward' > 6396.164028710:main thread : name: 'type', value 'imfile' > 6396.164032501:main thread : nvlstGetParam: name 'type', type 14, > valnode->bUsed 0 > 6396.164035773:main thread : input param blk after inputProcessCnf: > 6396.164038848:main thread : type: 'imfile' > 6396.164046776:main thread : newInpInst (imfile) > 6396.164050055:main thread : nvlstGetParam: name 'file', type 14, > valnode->bUsed 0 > 6396.164053369:main thread : nvlstGetParam: name 'tag', type 14, > valnode->bUsed 0 > 6396.164057322:main thread : nvlstGetParam: name 'ruleset', type 14, > valnode->bUsed 0 > 6396.164060945:main thread : nvlstGetParam: name 'escapelf', type 4, > valnode->bUsed 0 > 6396.164065406:main thread : input param blk in imfile: > 6396.164068477:main thread : file: '/var/log/audit/audit.log' > 6396.164076510:main thread : tag: 'audit' > 6396.164084408:main thread : severity: (unset) > 6396.164091877:main thread : facility: (unset) > 6396.164099363:main thread : ruleset: 'linux_forward' > 6396.164107182:main thread : readmode: (unset) > 6396.164114585:main thread : startmsg.regex: (unset) > 6396.164122030:main thread : escapelf: 1 > 6396.164129589:main thread : reopenontruncate: (unset) > 6396.164137143:main thread : maxlinesatonce: (unset) > 6396.164144594:main thread : trimlineoverbytes: (unset) > 6396.164186518:main thread : maxsubmitatonce: (unset) > 6396.164194316:main thread : removestateondelete: (unset) > 6396.164203193:main thread : persiststateinterval: (unset) > 6396.164211781:main thread : deletestateonfiledelete: (unset) > 6396.164219445:main thread : addmetadata: (unset) > 6396.164226847:main thread : addceetag: (unset) > 6396.164234219:main thread : statefile: (unset) > 6396.164241554:main thread : readtimeout: (unset) > 6396.164248996:main thread : freshstarttail: (unset) > 6396.164256436:main thread : filenotfounderror: (unset) > 6396.164265510:main thread : imfile: adding file monitor for > '/var/log/audit/audit.log' > 6396.164270419:main thread : config parser: reached end of file > /etc/rsyslog.d/rsyslog.linux.conf > 6396.164274127:main thread : config parser: resume parsing of file > /etc/rsyslog.conf at line 36 > 6396.164279275:main thread : cnf:global:cfsysline: $OmitLocalLogging on > 6396.164286427:main thread : cnf:global:cfsysline: $IMJournalStateFile > imjournal.state > 6396.164294137:main thread : doGetWord: get newval 'imjournal.state' > (len 15), hdlr (nil) > 6396.164303495:main thread : tried selector action for builtin:omfile: 0 > 6396.164311978:main thread : Module builtin:omfile processes this > action. > 6396.164317464:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.164323448:main thread : action 1 queue: parameter dump: > 6396.164326952:main thread : action 1 queue: queue.filename '[NONE]' > 6396.164334718:main thread : action 1 queue: queue.size: 1000 > 6396.164338167:main thread : action 1 queue: queue.dequeuebatchsize: 16 > 6396.164341621:main thread : action 1 queue: queue.maxdiskspace: 0 > 6396.164345011:main thread : action 1 queue: queue.highwatermark: 800 > 6396.164348271:main thread : action 1 queue: queue.lowwatermark: 200 > 6396.164351572:main thread : action 1 queue: queue.fulldelaymark: -1 > 6396.164354802:main thread : action 1 queue: queue.lightdelaymark: -1 > 6396.164358063:main thread : action 1 queue: queue.discardmark: 980 > 6396.164361329:main thread : action 1 queue: queue.discardseverity: 8 > 6396.164364535:main thread : action 1 queue: queue.checkpointinterval: 0 > 6396.164367779:main thread : action 1 queue: queue.syncqueuefiles: 0 > 6396.164371177:main thread : action 1 queue: queue.type: 3 [Direct] > 6396.164374406:main thread : action 1 queue: queue.workerthreads: 1 > 6396.164377529:main thread : action 1 queue: queue.timeoutshutdown: 0 > 6396.164381977:main thread : action 1 queue: > queue.timeoutactioncompletion: 1000 > 6396.164385354:main thread : action 1 queue: queue.timeoutenqueue: 50 > 6396.164388562:main thread : action 1 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.164392010:main thread : action 1 queue: > queue.workerthreadminimummessages: -1 > 6396.164395288:main thread : action 1 queue: queue.maxfilesize: 1048576 > 6396.164398450:main thread : action 1 queue: queue.saveonshutdown: 1 > 6396.164401606:main thread : action 1 queue: queue.dequeueslowdown: 0 > 6396.164404782:main thread : action 1 queue: queue.dequeuetimebegin: 0 > 6396.164408000:main thread : action 1 queue: queue.dequeuetimeend: 25 > 6396.164411451:main thread : Action 0x562f39069e20: queue > 0x562f3906a110 created > 6396.164420866:main thread : Decoding traditional PRI filter > '*.info;mail.none;authpriv.none;cron.none' > 6396.164425079:main thread : symbolic name: info ==> 6 > 6396.164434695:main thread : symbolic name: none ==> 16 > 6396.164440522:main thread : symbolic name: mail ==> 16 > 6396.164446156:main thread : symbolic name: none ==> 16 > 6396.164451686:main thread : symbolic name: authpriv ==> 80 > 6396.164457296:main thread : symbolic name: none ==> 16 > 6396.164462807:main thread : symbolic name: cron ==> 72 > 6396.164468480:main thread : cnf:global:script > 6396.164473547:main thread : tried selector action for builtin:omfile: 0 > 6396.164476879:main thread : Module builtin:omfile processes this > action. > 6396.164490465:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.164497558:main thread : action 2 queue: parameter dump: > 6396.164500967:main thread : action 2 queue: queue.filename '[NONE]' > 6396.164504243:main thread : action 2 queue: queue.size: 1000 > 6396.164507445:main thread : action 2 queue: queue.dequeuebatchsize: 16 > 6396.164510706:main thread : action 2 queue: queue.maxdiskspace: 0 > 6396.164513894:main thread : action 2 queue: queue.highwatermark: 800 > 6396.164517149:main thread : action 2 queue: queue.lowwatermark: 200 > 6396.164520347:main thread : action 2 queue: queue.fulldelaymark: -1 > 6396.164523503:main thread : action 2 queue: queue.lightdelaymark: -1 > 6396.164526702:main thread : action 2 queue: queue.discardmark: 980 > 6396.164529882:main thread : action 2 queue: queue.discardseverity: 8 > 6396.164533057:main thread : action 2 queue: queue.checkpointinterval: 0 > 6396.164536250:main thread : action 2 queue: queue.syncqueuefiles: 0 > 6396.164539589:main thread : action 2 queue: queue.type: 3 [Direct] > 6396.164542752:main thread : action 2 queue: queue.workerthreads: 1 > 6396.164545910:main thread : action 2 queue: queue.timeoutshutdown: 0 > 6396.164549154:main thread : action 2 queue: > queue.timeoutactioncompletion: 1000 > 6396.164552402:main thread : action 2 queue: queue.timeoutenqueue: 50 > 6396.164555564:main thread : action 2 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.164558868:main thread : action 2 queue: > queue.workerthreadminimummessages: -1 > 6396.164565093:main thread : action 2 queue: queue.maxfilesize: 1048576 > 6396.164568380:main thread : action 2 queue: queue.saveonshutdown: 1 > 6396.164571547:main thread : action 2 queue: queue.dequeueslowdown: 0 > 6396.164574747:main thread : action 2 queue: queue.dequeuetimebegin: 0 > 6396.164577911:main thread : action 2 queue: queue.dequeuetimeend: 25 > 6396.164581255:main thread : Action 0x562f3906a810: queue > 0x562f3906b1e0 created > 6396.164585997:main thread : Decoding traditional PRI filter > 'authpriv.*' > 6396.164589403:main thread : symbolic name: * ==> 255 > 6396.164595474:main thread : symbolic name: authpriv ==> 80 > 6396.164601271:main thread : cnf:global:script > 6396.164606267:main thread : tried selector action for builtin:omfile: 0 > 6396.164609571:main thread : Module builtin:omfile processes this > action. > 6396.164613176:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.164617766:main thread : action 3 queue: parameter dump: > 6396.164621051:main thread : action 3 queue: queue.filename '[NONE]' > 6396.164633859:main thread : action 3 queue: queue.size: 1000 > 6396.164638023:main thread : action 3 queue: queue.dequeuebatchsize: 16 > 6396.164641286:main thread : action 3 queue: queue.maxdiskspace: 0 > 6396.164644507:main thread : action 3 queue: queue.highwatermark: 800 > 6396.164647725:main thread : action 3 queue: queue.lowwatermark: 200 > 6396.164650910:main thread : action 3 queue: queue.fulldelaymark: -1 > 6396.164654041:main thread : action 3 queue: queue.lightdelaymark: -1 > 6396.164657251:main thread : action 3 queue: queue.discardmark: 980 > 6396.164660480:main thread : action 3 queue: queue.discardseverity: 8 > 6396.164663607:main thread : action 3 queue: queue.checkpointinterval: 0 > 6396.164666793:main thread : action 3 queue: queue.syncqueuefiles: 0 > 6396.164670012:main thread : action 3 queue: queue.type: 3 [Direct] > 6396.164673166:main thread : action 3 queue: queue.workerthreads: 1 > 6396.164676316:main thread : action 3 queue: queue.timeoutshutdown: 0 > 6396.164686565:main thread : action 3 queue: > queue.timeoutactioncompletion: 1000 > 6396.164690042:main thread : action 3 queue: queue.timeoutenqueue: 50 > 6396.164693216:main thread : action 3 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.164696441:main thread : action 3 queue: > queue.workerthreadminimummessages: -1 > 6396.164709045:main thread : action 3 queue: queue.maxfilesize: 1048576 > 6396.164712495:main thread : action 3 queue: queue.saveonshutdown: 1 > 6396.164715769:main thread : action 3 queue: queue.dequeueslowdown: 0 > 6396.164718975:main thread : action 3 queue: queue.dequeuetimebegin: 0 > 6396.164722151:main thread : action 3 queue: queue.dequeuetimeend: 25 > 6396.164729007:main thread : Action 0x562f3906b8e0: queue > 0x562f3906bd30 created > 6396.164733869:main thread : Decoding traditional PRI filter 'mail.*' > 6396.164737273:main thread : symbolic name: * ==> 255 > 6396.164743260:main thread : symbolic name: mail ==> 16 > 6396.164748943:main thread : cnf:global:script > 6396.164753785:main thread : tried selector action for builtin:omfile: 0 > 6396.164757093:main thread : Module builtin:omfile processes this > action. > 6396.164760757:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.164765553:main thread : action 4 queue: parameter dump: > 6396.164768797:main thread : action 4 queue: queue.filename '[NONE]' > 6396.164771979:main thread : action 4 queue: queue.size: 1000 > 6396.164775166:main thread : action 4 queue: queue.dequeuebatchsize: 16 > 6396.164778361:main thread : action 4 queue: queue.maxdiskspace: 0 > 6396.164781537:main thread : action 4 queue: queue.highwatermark: 800 > 6396.164784719:main thread : action 4 queue: queue.lowwatermark: 200 > 6396.164787938:main thread : action 4 queue: queue.fulldelaymark: -1 > 6396.164791085:main thread : action 4 queue: queue.lightdelaymark: -1 > 6396.164794280:main thread : action 4 queue: queue.discardmark: 980 > 6396.164797582:main thread : action 4 queue: queue.discardseverity: 8 > 6396.164804004:main thread : action 4 queue: queue.checkpointinterval: 0 > 6396.164807312:main thread : action 4 queue: queue.syncqueuefiles: 0 > 6396.164810574:main thread : action 4 queue: queue.type: 3 [Direct] > 6396.164813731:main thread : action 4 queue: queue.workerthreads: 1 > 6396.164816875:main thread : action 4 queue: queue.timeoutshutdown: 0 > 6396.164820049:main thread : action 4 queue: > queue.timeoutactioncompletion: 1000 > 6396.164823264:main thread : action 4 queue: queue.timeoutenqueue: 50 > 6396.164826455:main thread : action 4 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.164829673:main thread : action 4 queue: > queue.workerthreadminimummessages: -1 > 6396.164832921:main thread : action 4 queue: queue.maxfilesize: 1048576 > 6396.164836104:main thread : action 4 queue: queue.saveonshutdown: 1 > 6396.164839272:main thread : action 4 queue: queue.dequeueslowdown: 0 > 6396.164842440:main thread : action 4 queue: queue.dequeuetimebegin: 0 > 6396.164845631:main thread : action 4 queue: queue.dequeuetimeend: 25 > 6396.164848906:main thread : Action 0x562f3906c430: queue > 0x562f3906c880 created > 6396.164853110:main thread : Decoding traditional PRI filter 'cron.*' > 6396.164856359:main thread : symbolic name: * ==> 255 > 6396.164862042:main thread : symbolic name: cron ==> 72 > 6396.164867635:main thread : cnf:global:script > 6396.164871861:main thread : tried selector action for builtin:omfile: > -2001 > 6396.164875325:main thread : tried selector action for builtin:ompipe: > -2001 > 6396.164878883:main thread : tried selector action for builtin-shell: > -2001 > 6396.164882337:main thread : tried selector action for > builtin:omdiscard: -2001 > 6396.164885969:main thread : tried selector action for builtin:omfwd: > -2001 > 6396.164889484:main thread : write-alltried selector action for > builtin:omusrmsg: 0 > 6396.164895511:main thread : Module builtin:omusrmsg processes this > action. > 6396.164899013:main thread : template: ' WallFmt' assigned > 6396.164903376:main thread : action 5 queue: parameter dump: > 6396.164906676:main thread : action 5 queue: queue.filename '[NONE]' > 6396.164909836:main thread : action 5 queue: queue.size: 1000 > 6396.164913033:main thread : action 5 queue: queue.dequeuebatchsize: 16 > 6396.164916214:main thread : action 5 queue: queue.maxdiskspace: 0 > 6396.164919384:main thread : action 5 queue: queue.highwatermark: 800 > 6396.164999202:main thread : action 5 queue: queue.lowwatermark: 200 > 6396.165002813:main thread : action 5 queue: queue.fulldelaymark: -1 > 6396.165005988:main thread : action 5 queue: queue.lightdelaymark: -1 > 6396.165012911:main thread : action 5 queue: queue.discardmark: 980 > 6396.165017653:main thread : action 5 queue: queue.discardseverity: 8 > 6396.165021127:main thread : action 5 queue: queue.checkpointinterval: 0 > 6396.165025322:main thread : action 5 queue: queue.syncqueuefiles: 0 > 6396.165028683:main thread : action 5 queue: queue.type: 3 [Direct] > 6396.165031997:main thread : action 5 queue: queue.workerthreads: 1 > 6396.165035322:main thread : action 5 queue: queue.timeoutshutdown: 0 > 6396.165038628:main thread : action 5 queue: > queue.timeoutactioncompletion: 1000 > 6396.165041963:main thread : action 5 queue: queue.timeoutenqueue: 50 > 6396.165045189:main thread : action 5 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.165048469:main thread : action 5 queue: > queue.workerthreadminimummessages: -1 > 6396.165051769:main thread : action 5 queue: queue.maxfilesize: 1048576 > 6396.165055096:main thread : action 5 queue: queue.saveonshutdown: 1 > 6396.165058313:main thread : action 5 queue: queue.dequeueslowdown: 0 > 6396.165061494:main thread : action 5 queue: queue.dequeuetimebegin: 0 > 6396.165064778:main thread : action 5 queue: queue.dequeuetimeend: 25 > 6396.165068218:main thread : Action 0x562f3906ce10: queue > 0x562f3906d260 created > 6396.165073756:main thread : Decoding traditional PRI filter '*.emerg' > 6396.165077355:main thread : symbolic name: emerg ==> 0 > 6396.165087448:main thread : cnf:global:script > 6396.165092447:main thread : tried selector action for builtin:omfile: 0 > 6396.165095801:main thread : Module builtin:omfile processes this > action. > 6396.165099618:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.165104462:main thread : action 6 queue: parameter dump: > 6396.165107866:main thread : action 6 queue: queue.filename '[NONE]' > 6396.165111099:main thread : action 6 queue: queue.size: 1000 > 6396.165114305:main thread : action 6 queue: queue.dequeuebatchsize: 16 > 6396.165117635:main thread : action 6 queue: queue.maxdiskspace: 0 > 6396.165120826:main thread : action 6 queue: queue.highwatermark: 800 > 6396.165124052:main thread : action 6 queue: queue.lowwatermark: 200 > 6396.165127310:main thread : action 6 queue: queue.fulldelaymark: -1 > 6396.165130490:main thread : action 6 queue: queue.lightdelaymark: -1 > 6396.165133698:main thread : action 6 queue: queue.discardmark: 980 > 6396.165136955:main thread : action 6 queue: queue.discardseverity: 8 > 6396.165140149:main thread : action 6 queue: queue.checkpointinterval: 0 > 6396.165143350:main thread : action 6 queue: queue.syncqueuefiles: 0 > 6396.165146649:main thread : action 6 queue: queue.type: 3 [Direct] > 6396.165149834:main thread : action 6 queue: queue.workerthreads: 1 > 6396.165153030:main thread : action 6 queue: queue.timeoutshutdown: 0 > 6396.165156345:main thread : action 6 queue: > queue.timeoutactioncompletion: 1000 > 6396.165159589:main thread : action 6 queue: queue.timeoutenqueue: 50 > 6396.165162713:main thread : action 6 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.165165965:main thread : action 6 queue: > queue.workerthreadminimummessages: -1 > 6396.165169170:main thread : action 6 queue: queue.maxfilesize: 1048576 > 6396.165172310:main thread : action 6 queue: queue.saveonshutdown: 1 > 6396.165175541:main thread : action 6 queue: queue.dequeueslowdown: 0 > 6396.165178722:main thread : action 6 queue: queue.dequeuetimebegin: 0 > 6396.165181909:main thread : action 6 queue: queue.dequeuetimeend: 25 > 6396.165185279:main thread : Action 0x562f3906d940: queue > 0x562f3906dd90 created > 6396.165189528:main thread : Decoding traditional PRI filter > 'uucp,news.crit' > 6396.165192871:main thread : symbolic name: crit ==> 2 > 6396.165198642:main thread : symbolic name: uucp ==> 64 > 6396.165204535:main thread : symbolic name: news ==> 56 > 6396.165210123:main thread : cnf:global:script > 6396.165214553:main thread : tried selector action for builtin:omfile: 0 > 6396.165217855:main thread : Module builtin:omfile processes this > action. > 6396.165221356:main thread : template: 'RSYSLOG_TraditionalFileFormat' > assigned > 6396.165225575:main thread : action 7 queue: parameter dump: > 6396.165228845:main thread : action 7 queue: queue.filename '[NONE]' > 6396.165232086:main thread : action 7 queue: queue.size: 1000 > 6396.165235280:main thread : action 7 queue: queue.dequeuebatchsize: 16 > 6396.165238591:main thread : action 7 queue: queue.maxdiskspace: 0 > 6396.165241801:main thread : action 7 queue: queue.highwatermark: 800 > 6396.165245069:main thread : action 7 queue: queue.lowwatermark: 200 > 6396.165248270:main thread : action 7 queue: queue.fulldelaymark: -1 > 6396.165251431:main thread : action 7 queue: queue.lightdelaymark: -1 > 6396.165254600:main thread : action 7 queue: queue.discardmark: 980 > 6396.165257824:main thread : action 7 queue: queue.discardseverity: 8 > 6396.165261012:main thread : action 7 queue: queue.checkpointinterval: 0 > 6396.165264150:main thread : action 7 queue: queue.syncqueuefiles: 0 > 6396.165267457:main thread : action 7 queue: queue.type: 3 [Direct] > 6396.165270595:main thread : action 7 queue: queue.workerthreads: 1 > 6396.165273795:main thread : action 7 queue: queue.timeoutshutdown: 0 > 6396.165277098:main thread : action 7 queue: > queue.timeoutactioncompletion: 1000 > 6396.165280335:main thread : action 7 queue: queue.timeoutenqueue: 50 > 6396.165283481:main thread : action 7 queue: > queue.timeoutworkerthreadshutdown: 60000 > 6396.165289125:main thread : action 7 queue: > queue.workerthreadminimummessages: -1 > 6396.165292488:main thread : action 7 queue: queue.maxfilesize: 1048576 > 6396.165295652:main thread : action 7 queue: queue.saveonshutdown: 1 > 6396.165298878:main thread : action 7 queue: queue.dequeueslowdown: 0 > 6396.165302031:main thread : action 7 queue: queue.dequeuetimebegin: 0 > 6396.165305174:main thread : action 7 queue: queue.dequeuetimeend: 25 > 6396.165308524:main thread : Action 0x562f3906e490: queue > 0x562f3906e8e0 created > 6396.165318316:main thread : config parser: reached end of file > /etc/rsyslog.conf > 6396.165321770:main thread : config parser: parsing completed > 6396.165325412:main thread : Decoding traditional PRI filter 'local7.*' > 6396.165328690:main thread : symbolic name: * ==> 255 > 6396.165334562:main thread : symbolic name: local7 ==> 184 > 6396.165340471:main thread : cnf:global:script > 6396.165348534:main thread : Number of actions in this configuration: 8 > 6396.165352230:main thread : begin ruleset optimization phase > 6396.165355632:main thread : ruleset 'RSYSLOG_DefaultRuleset' before > optimization: > 6396.165361066:main thread : ruleset 0x562f39053ee0: rsyslog ruleset > RSYSLOG_DefaultRuleset: > 6396.165365264:main thread : PRIFILT > '*.info;mail.none;authpriv.none;cron.none' > 6396.165377207:main thread : pmask: 7F 7F X 7F 7F 7F 7F 7F 7F X X 7F > 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F > 6396.165443422:main thread : ACTION 1 > [builtin:omfile:/var/log/messages] > 6396.165449603:main thread : END PRIFILT > 6396.165452825:main thread : PRIFILT 'authpriv.*' > 6396.165455875:main thread : pmask: X X X X X X X X X X FF > X X X X X X X X X X X X X X X > 6396.165527168:main thread : ACTION 2 [builtin:omfile:/var/log/secure] > 6396.165533089:main thread : END PRIFILT > 6396.165536267:main thread : PRIFILT 'mail.*' > 6396.165539290:main thread : pmask: X X FF X X X X X X X X > X X X X X X X X X X X X X X X > 6396.165601826:main thread : ACTION 3 > [builtin:omfile:-/var/log/maillog] > 6396.165607420:main thread : END PRIFILT > 6396.165610474:main thread : PRIFILT 'cron.*' > 6396.165613459:main thread : pmask: X X X X X X X X X FF X > X X X X X X X X X X X X X X X > 6396.165703605:main thread : ACTION 4 [builtin:omfile:/var/log/cron] > 6396.165709467:main thread : END PRIFILT > 6396.165712567:main thread : PRIFILT '*.emerg' > 6396.165715713:main thread : pmask: 1 1 1 1 1 1 1 1 1 1 1 > 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 > 6396.165780695:main thread : ACTION 5 [builtin:omusrmsg::omusrmsg:*] > 6396.165786330:main thread : END PRIFILT > 6396.165789551:main thread : PRIFILT 'uucp,news.crit' > 6396.165792593:main thread : pmask: X X X X X X X 7 7 X X > X X X X X X X X X X X X X X X > 6396.165855340:main thread : ACTION 6 > [builtin:omfile:/var/log/spooler] > 6396.165861053:main thread : END PRIFILT > 6396.165864116:main thread : PRIFILT 'local7.*' > 6396.165867102:main thread : pmask: X X X X X X X X X X X > X X X X X X X X X X X X FF X X > 6396.165929648:main thread : ACTION 7 > [builtin:omfile:/var/log/boot.log] > 6396.165935241:main thread : END PRIFILT > 6396.165938521:main thread : ruleset 0x562f39053ee0: ruleset > RSYSLOG_DefaultRuleset assigned parser list: > 6396.165943030:main thread : ruleset 'RSYSLOG_DefaultRuleset' after > optimization: > 6396.165946291:main thread : ruleset 0x562f39053ee0: rsyslog ruleset > RSYSLOG_DefaultRuleset: > 6396.165949661:main thread : PRIFILT > '*.info;mail.none;authpriv.none;cron.none' > 6396.165952724:main thread : pmask: 7F 7F X 7F 7F 7F 7F 7F 7F X X 7F > 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F > 6396.166016807:main thread : ACTION 1 > [builtin:omfile:/var/log/messages] > 6396.166022499:main thread : END PRIFILT > 6396.166025605:main thread : PRIFILT 'authpriv.*' > 6396.166028609:main thread : pmask: X X X X X X X X X X FF > X X X X X X X X X X X X X X X > 6396.166096291:main thread : ACTION 2 [builtin:omfile:/var/log/secure] > 6396.166102020:main thread : END PRIFILT > 6396.166105139:main thread : PRIFILT 'mail.*' > 6396.166108150:main thread : pmask: X X FF X X X X X X X X > X X X X X X X X X X X X X X X > 6396.166171729:main thread : ACTION 3 > [builtin:omfile:-/var/log/maillog] > 6396.166177353:main thread : END PRIFILT > 6396.166180415:main thread : PRIFILT 'cron.*' > 6396.166183373:main thread : pmask: X X X X X X X X X FF X > X X X X X X X X X X X X X X X > 6396.166246357:main thread : ACTION 4 [builtin:omfile:/var/log/cron] > 6396.166251964:main thread : END PRIFILT > 6396.166254981:main thread : PRIFILT '*.emerg' > 6396.166258080:main thread : pmask: 1 1 1 1 1 1 1 1 1 1 1 > 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 > 6396.166323090:main thread : ACTION 5 [builtin:omusrmsg::omusrmsg:*] > 6396.166328650:main thread : END PRIFILT > 6396.166331797:main thread : PRIFILT 'uucp,news.crit' > 6396.166334827:main thread : pmask: X X X X X X X 7 7 X X > X X X X X X X X X X X X X X X > 6396.166397632:main thread : ACTION 6 > [builtin:omfile:/var/log/spooler] > 6396.166403215:main thread : END PRIFILT > 6396.166406302:main thread : PRIFILT 'local7.*' > 6396.166409280:main thread : pmask: X X X X X X X X X X X > X X X X X X X X X X X X FF X X > 6396.166471810:main thread : ACTION 7 > [builtin:omfile:/var/log/boot.log] > 6396.166477361:main thread : END PRIFILT > 6396.166489361:main thread : ruleset 0x562f39053ee0: ruleset > RSYSLOG_DefaultRuleset assigned parser list: > 6396.166494547:main thread : ruleset 'linux_forward' before > optimization: > 6396.166498468:main thread : ruleset 0x562f39072780: rsyslog ruleset > linux_forward: > 6396.166502166:main thread : ACTION 0 > [builtin:omfwd:action(type="builtin:omfwd" ...)] > 6396.166505378:main thread : STOP > 6396.166508473:main thread : ruleset 0x562f39072780: ruleset > linux_forward assigned parser list: > 6396.166511948:main thread : ruleset 'linux_forward' after optimization: > 6396.166515118:main thread : ruleset 0x562f39072780: rsyslog ruleset > linux_forward: > 6396.166518560:main thread : ACTION 0 > [builtin:omfwd:action(type="builtin:omfwd" ...)] > 6396.166521606:main thread : STOP > 6396.166524673:main thread : ruleset 0x562f39072780: ruleset > linux_forward assigned parser list: > 6396.166528081:main thread : ruleset optimization phase finished. > 6396.166531354:main thread : telling rsyslog core that config load for > 0x562f390508b0 is done > 6396.166536199:main thread : Timezone information table (0 entries): > 6396.166544177:main thread : telling modules that config load for > 0x562f390508b0 is done > 6396.166547866:main thread : beginCnfLoad(0x562f37af0130) for module > 'builtin:omfile' > 6396.166551072:main thread : calling endCnfLoad() for module > 'builtin:omfile' > 6396.166554537:main thread : beginCnfLoad(0x562f37af3150) for module > 'builtin:ompipe' > 6396.166557670:main thread : calling endCnfLoad() for module > 'builtin:ompipe' > 6396.166561052:main thread : beginCnfLoad((nil)) for module > 'builtin-shell' > 6396.166564313:main thread : beginCnfLoad((nil)) for module > 'builtin:omdiscard' > 6396.166567546:main thread : beginCnfLoad(0x562f37aed2e0) for module > 'builtin:omfwd' > 6396.166570711:main thread : calling endCnfLoad() for module > 'builtin:omfwd' > 6396.166573975:main thread : beginCnfLoad((nil)) for module > 'builtin:omusrmsg' > 6396.166577157:main thread : beginCnfLoad((nil)) for module > 'builtin:pmrfc5424' > 6396.166580336:main thread : beginCnfLoad((nil)) for module > 'builtin:pmrfc3164' > 6396.166583454:main thread : beginCnfLoad((nil)) for module > 'builtin:smfile' > 6396.166586598:main thread : beginCnfLoad((nil)) for module > 'builtin:smtradfile' > 6396.166589731:main thread : beginCnfLoad((nil)) for module > 'builtin:smfwd' > 6396.166592891:main thread : beginCnfLoad((nil)) for module > 'builtin:smtradfwd' > 6396.166596125:main thread : beginCnfLoad(0x7efca273d050) for module > 'imuxsock' > 6396.166602210:main thread : calling endCnfLoad() for module 'imuxsock' > 6396.166605773:main thread : beginCnfLoad(0x7efca2536160) for module > 'imjournal' > 6396.166608896:main thread : calling endCnfLoad() for module 'imjournal' > 6396.166612164:main thread : beginCnfLoad(0x7efca0415b20) for module > 'imfile' > 6396.166615281:main thread : calling endCnfLoad() for module 'imfile' > 6396.166618594:main thread : imfile: opmode is 1, polling interval is 10 > 6396.166621772:main thread : telling modules to check config > 0x562f390508b0 > 6396.166625251:main thread : module builtin:omfile tells us config can > be activated > 6396.166628629:main thread : module builtin:ompipe tells us config can > be activated > 6396.166631908:main thread : module builtin:omfwd tells us config can > be activated > 6396.166635379:main thread : module imuxsock tells us config can be > activated > 6396.166638588:main thread : module imjournal tells us config can be > activated > 6396.166646653:main thread : module imfile tells us config can be > activated > 6396.166650564:main thread : GenerateLocalHostName uses > 'sandcaykhsc-v-sienags-01' > rsyslogd: End of config validation run. Bye. > > > -----Original Message----- > From: David Lang [mailto:[email protected]<mailto:[email protected]>] > Sent: Friday, March 29, 2019 6:29 PM > To: Gorman, Kevin > Cc: David Lang; Gorman, Kevin via rsyslog > Subject: RE: [E] Re: [rsyslog] Help with newer syntax a ruleset and > forwarding > > can we see the rest of your config? > > do a rsyslogd -N 2 and show us the results. > > David Lang > > On Fri, 29 Mar 2019, Gorman, Kevin wrote: > > > Date: Fri, 29 Mar 2019 23:25:13 +0000 > > From: "Gorman, Kevin" <[email protected]<mailto: > [email protected]>> > > To: David Lang <[email protected]<mailto:[email protected]>>, > > "Gorman, Kevin via rsyslog" <[email protected]<mailto: > [email protected]>> > > Subject: RE: [E] Re: [rsyslog] Help with newer syntax a ruleset and > > forwarding > > > > Sorry, > > The log messages aren't being forwarded. > > > > -----Original Message----- > > From: David Lang [mailto:[email protected]<mailto:[email protected]>] > > Sent: Friday, March 29, 2019 6:12 PM > > To: Gorman, Kevin via rsyslog > > Cc: Gorman, Kevin > > Subject: [E] Re: [rsyslog] Help with newer syntax a ruleset and > > forwarding > > > > can you clarify a bit more about what's not working? > > > > I will point out that in the old syntax, only the first action has a > queue, and unless that queue is full, that action will always succeed, so > the fallback isn't going to work as expected. > > > > David Lang > > > > On Fri, 29 Mar 2019, Gorman, Kevin via rsyslog wrote: > > > >> Date: Fri, 29 Mar 2019 23:05:54 +0000 > >> From: "Gorman, Kevin via rsyslog" <[email protected]<mailto: > [email protected]>> > >> To: "[email protected]<mailto:[email protected]>" < > [email protected]<mailto:[email protected]>> > >> Cc: "Gorman, Kevin" <[email protected]<mailto: > [email protected]>> > >> Subject: [rsyslog] Help with newer syntax a ruleset and forwarding > >> > >> I currently have log forwarding using the older syntax shown at the > bottom of this message. App logs are forwarded with individual .conf files > that repeat the addresses in each file. I'd like to move to the newer > syntax and a ruleset as shown. This actually works on another system. The > all file is read first due to the naming. Things get ugly if it isn't. > >> > >> My question is why is this not working? The debug output isn't showing > anything I can see is incorrect. > >> > >> Also, any pointers to more info on the newer syntax would be helpful. > I've spent hours poring over the docs w/ minimal success. > >> > >> Thanks! > >> > >> The ruleset and initial config > >> > >> # cat /etc/rsyslog.d/rsyslog.all.conf > >> > >> module(load="imfile" mode="inotify") > >> > >> global ( > >> parser.dropTrailingLFOnReception="on" > >> parser.escapeControlCharactersOnReceive="on" > >> workDirectory="/var/lib/rsyslog" > >> ) > >> > >> ruleset(name="linux_forward") { > >> action( > >> type="omfwd" > >> target="2001:4888:a00:3154:f0:ff2:0:b01" > >> protocol="tcp" > >> port="5544" > >> ) > >> stop > >> } > >> > >> # cat /etc/rsyslog.d/rsyslog.linux.conf > >> > >> input( > >> type="imfile" > >> ruleset="linux_forward" > >> file="*.*" > >> escapeLF="on" > >> tag="syslog" > >> ) > >> > >> input( > >> type="imfile" > >> ruleset="linux_forward" > >> tag="ansible" > >> file="/var/log/ansible.log" > >> escapeLF="on" > >> ) > >> > >> input( > >> type="imfile" > >> ruleset="linux_forward" > >> tag="audit" > >> file="/var/log/audit/audit.log" > >> escapeLF="on" > >> ) > >> > >> An example of forwarding an application file. > >> > >> # head rsyslog.app.conf > >> > >> input( > >> type="imfile" > >> ruleset="linux_forward" > >> tag="caapiconfigservice_events" > >> file="/var/log/mcs/caapi01/caapiconfigservice_events.log" > >> escapeLF="on" > >> ) > >> > >> The original and working log forwarding: > >> > >> # cat /root/nagioslogserver.conf > >> > >> $WorkDirectory /var/lib/rsyslog # Where > spool files will live > >> $ActionQueueFileName nlsFwdRule0 # Unique > name prefix for spool files > >> $ActionQueueMaxDiskSpace 1g # 1GB > space limit (use as much as possible) > >> $ActionQueueSaveOnShutdown on # Save > messages to disk on shutdown > >> $ActionQueueType LinkedList # Use > asynchronous processing > >> $ActionResumeRetryCount -1 # Infinite > retries if host is down > >> > >> *.* @@[2001:4888:a00:3154:f0:ff2:0:b01]:5544 # *.*: > send everything in rsyslog.conf, @@: use TCP > >> $ActionExecOnlyWhenPreviousIsSuspended on # If the > 1st log server is down send to the next, etc. > >> & @@[2001:4888:a00:3154:f0:ff2:0:b02]:5544 > >> & @@[2001:4888:a00:3154:f0:ff2:0:b03]:5544 > >> $ActionExecOnlyWhenPreviousIsSuspended off > >> > >> _______________________________________________ > >> rsyslog mailing list > >> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net > >> _ > >> mailman_listinfo_rsyslog&d=DwIBAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb > >> 6 > >> __0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=yMUnGb-a6kR > >> O > >> yg52hTO_S-Tx90Iq5t0Hihub_kqcoHY&s=Ri5XX2f9BwX7iDSyb4HsT19_Svp2k6EBlW6 > >> q > >> MWS_vIs&e= > >> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_p > >> r > >> ofessional-2Dservices_&d=DwIBAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6_ > >> _ > >> 0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=yMUnGb-a6kROy > >> g > >> 52hTO_S-Tx90Iq5t0Hihub_kqcoHY&s=hqHbQrrSzB0w8X0_v-25Yqh0UFuR1dLvzumXJ > >> a WC0uE&e= What's up with rsyslog? Follow > >> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rger > >> h > >> ards&d=DwIBAg&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=stJ62L_ > >> y > >> qJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=yMUnGb-a6kROyg52hTO_S-Tx90Iq5t0 > >> H ihub_kqcoHY&s=vkpTLA5cHNT4buQwLTkh_SgBXSQkRuogmQ227YlvTGU&e= > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if > you DON'T LIKE THAT. > >> > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog< > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_listinfo_rsyslog&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=n6FKr3jsjYjGP-DaJ8BxQmLDduhGOvgMYS1uOHUm1sc&s=7om2-dlmwdBT6D3mm71sNw_SN41kgQkNv6PvBQF4-ww&e= > > > http://www.rsyslog.com/professional-services/< > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional-2Dservices_&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=n6FKr3jsjYjGP-DaJ8BxQmLDduhGOvgMYS1uOHUm1sc&s=E1RdSOuDj90rdFzzYgobzLHlP7tHHxoxngn_Js4Xmig&e= > > > What's up with rsyslog? Follow https://twitter.com/rgerhards< > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=udBTRvFvXC5Dhqg7UHpJlPps3mZ3LRxpb6__0PomBTQ&r=stJ62L_yqJWGrxRl6wWPMpHwvVUmOyXDBgn3Xxfk-6U&m=n6FKr3jsjYjGP-DaJ8BxQmLDduhGOvgMYS1uOHUm1sc&s=UJXJWYhq_ZgzxUWrXVSsQopwGXqokYWvdFrfbMYKAXo&e= > > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
