On 20/01/2021 15:04, Alex Regan via rsyslog wrote:
Okay, now I understand. It's produced output like:
FROMHOST: 'xavier', fromhost-ip: '127.0.0.1', HOSTNAME: 'xavier', PRI:
22,syslogtag 'postfix-117/qmgr[496743]:', programname: 'postfix-117',
APP-NAME: 'postfix-117', PROCID: '496743', MSGID: '-',TIMESTAMP: 'Jan
20 08:39:54', STRUCTURED-DATA: '-',msg: '6B1B930668306: removed'
escaped msg: '6B1B930668306: removed' inputname: imjournal rawmsg:
'6B1B930668306: removed' $!:{ "PRIORITY": "6", "_BOOT_ID":
"6ff20e0e797d45789b7c38229e26f928", "_MACHINE_ID":
"c4b32aa0d25c4a5d85432835f7c2e2ac", "_HOSTNAME": "xavier.example.com",
"_TRANSPORT": "syslog", "SYSLOG_FACILITY": "2", "_UID": "89", "_GID":
"89", "_CAP_EFFECTIVE": "0", "_SYSTEMD_CGROUP":
"\/system.slice\/postfix.service", "_SYSTEMD_UNIT": "postfix.service",
"_SYSTEMD_SLICE": "system.slice", "_SYSTEMD_INVOCATION_ID":
"dde7fdbb530148f89ad2ee01b46615ac", "_COMM": "qmgr", "_EXE":
"\/usr\/libexec\/postfix\/qmgr", "_CMDLINE": "qmgr -l -t unix -u",
"SYSLOG_IDENTIFIER": "postfix-117\/qmgr", "SYSLOG_PID": "496743",
"_PID": "496743", "SYSLOG_TIMESTAMP": "Jan 20 08:39:54 ", "MESSAGE":
"6B1B930668306: removed", "_SOURCE_REALTIME_TIMESTAMP":
"1611149994883159" }
I've modified my config to the following:
if $fromhost-ip == "127.0.0.1" then {
if $syslogfacility == 2 then { action(type="omfile"
file="/var/log/maillog") }
} else {
action(type="omfile" file="/var/log/maillog-other")
}
}
It now logs only messages from the local host to /var/log/maillog, but
the maillog-other file is not logging messages from the other hosts
sending their maillogs to this server. What am I missing?
Does this config properly validate? It seems that you have some
unbalanced brackets.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
