Hi
module( load="imuxsock" )
module( load="imklog" )
if ($syslogfacility-text == 'kern' and $msg contains "Out of memory") then {
action(type="omfile" queue.size="1000" queue.type="LinkedList"
queue.dequeueSlowDown="3600000000" file="/var/log/oom")
}
If we have a flurry of, for example, "Out of memory" messages from the
facility 'kern', we'd like to keep only, say, one per hour in a
separate file.
https://rsyslog.readthedocs.io/en/latest/rainerscript/queue_parameters.html
says do not set low value for queue.size.
Above page also says queue.dequeueslowdown can be used as
rate-limiting. Maybe that doesn't apply for "omfile" as I don't see
above rsyslog.conf working. high and low watermarks are not applicable
here as it's not a disk based queue. Appreciate any pointers.
Thank you.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
