Re: [rsyslog] omprog now on v7

2013-06-26 Thread David Lang
per the page mentioned below http://www.rsyslog.com/doc/omprog.html the new style format should work action(type="omprog" binary="/pathto/omprog.py --parm1=\"value 1\" --parm2=value2" template="RSYSLOG_TraditionalFileFormat") David Lang On Wed, 26 Jun 2013, Orangepeel

Re: [rsyslog] omprog now on v7

2013-06-26 Thread Orangepeel Beef
That seems to have done the trick. Is the version that allows parameters in the devel ubuntu package yet? On Wed, Jun 26, 2013 at 10:23 PM, Rainer Gerhards wrote: > On Thu, Jun 27, 2013 at 5:23 AM, Orangepeel Beef > wrote: > > > So I got rsyslogv7 installed finally and working, the re_match fil

Re: [rsyslog] omprog now on v7

2013-06-26 Thread Rainer Gerhards
On Thu, Jun 27, 2013 at 5:23 AM, Orangepeel Beef wrote: > So I got rsyslogv7 installed finally and working, the re_match filters are > working, but it does not seem that the omprog script ever actually executes > even though it receives a child pid, it immediately dies. No output ever > makes it t

[rsyslog] omprog now on v7

2013-06-26 Thread Orangepeel Beef
So I got rsyslogv7 installed finally and working, the re_match filters are working, but it does not seem that the omprog script ever actually executes even though it receives a child pid, it immediately dies. No output ever makes it to logs. I even tried a script that just echo'd text to a file in

Re: [rsyslog] replace value in template to enhance dynamic file name

2013-06-26 Thread jc_ruiz
Hi David, thank you for this reply. -- View this message in context: http://rsyslog-rsyslog-users.1305293.n2.nabble.com/replace-value-in-template-to-enhance-dynamic-file-name-tp7581019p7581022.html Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com. __

Re: [rsyslog] replace value in template to enhance dynamic file name

2013-06-26 Thread David Lang
%hostname% is the name that the sender puts in the log message. If the sender sends a malformed message that has this missing (and rsyslog is able to detect that it's missing), rsyslog puts in the reverse DNS name of the machine it received the log from, if there is no reverse DNS entry, it puts

[rsyslog] rsyslog 7.5.1 (v7-devel) released

2013-06-26 Thread Florian Riedl
Hi all, This release opens the new 7.5 development branch. Most importantly, this version provides certificate-based authentication for RELP. It also includes mmfields, a module that can be used to parse CEF and other similar delimited formats. BSD-support has been improved and imjournal has been

[rsyslog] replace value in template to enhance dynamic file name

2013-06-26 Thread jc_ruiz
I have a working template that I use to create my dynamic files and it is working great and very happy with the automation of it.$template FilePerHost,"/var/log/syslog/system-%HOSTNAME%/%timegenerated:1:10:date-rfc3339%.log"My issue is that I have about 5000 plus network devices and some have point

Re: [rsyslog] rsyslog daemon dies on RHEL6 at start

2013-06-26 Thread Rainer Gerhards
On Wed, Jun 26, 2013 at 4:03 PM, wm-lists wrote: > Interestingly I found the issue, or at least a solution to it yesterday. I > assumed there was some issue in cached syslog entries since the debug info > showed connections to one or both of the udp destinations for syslog. > > Eventually I foun

Re: [rsyslog] rsyslog daemon dies on RHEL6 at start

2013-06-26 Thread wm-lists
Interestingly I found the issue, or at least a solution to it yesterday. I assumed there was some issue in cached syslog entries since the debug info showed connections to one or both of the udp destinations for syslog. Eventually I found my way to /var/lib/rsyslog and discvored about 10 files in

Re: [rsyslog] rsyslog daemon dies on RHEL6 at start

2013-06-26 Thread Rainer Gerhards
could you run it under valgrind control? Also note that this version is no longer project-supported, but I could at lest have a quick look. In any case, I suggest upgrading to the currently supported 7.4 version. RPM repositories are available here: http://www.rsyslog.com/rhelcentos-rpms/ Rainer

Re: [rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Radu Gheorghe
2013/6/26 Rainer Gerhards > On Wed, Jun 26, 2013 at 11:54 AM, Rainer Gerhards > wrote: > > > > > On Wed, Jun 26, 2013 at 11:52 AM, Radu Gheorghe >wrote: > > > >> Thanks for your reply, Rainer! This clears up my options. Now I only > have > >> to decide :) > >> > >> I was also thinking about usin

Re: [rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Rainer Gerhards
On Wed, Jun 26, 2013 at 11:54 AM, Rainer Gerhards wrote: > > On Wed, Jun 26, 2013 at 11:52 AM, Radu Gheorghe > wrote: > >> Thanks for your reply, Rainer! This clears up my options. Now I only have >> to decide :) >> >> I was also thinking about using templates for filenames in imfile. This >> req

Re: [rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Rainer Gerhards
On Wed, Jun 26, 2013 at 11:52 AM, Radu Gheorghe wrote: > Thanks for your reply, Rainer! This clears up my options. Now I only have > to decide :) > > I was also thinking about using templates for filenames in imfile. This > requires additional work, though, so it falls in the same category as epol

Re: [rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Radu Gheorghe
Thanks for your reply, Rainer! This clears up my options. Now I only have to decide :) I was also thinking about using templates for filenames in imfile. This requires additional work, though, so it falls in the same category as epoll support. Best regards, Radu 2013/6/26 Rainer Gerhards > O

Re: [rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Rainer Gerhards
On Wed, Jun 26, 2013 at 11:01 AM, Radu Gheorghe wrote: > Hello, > > I know the problem of imfile and rotating logs was discussed a million > times now, but I still can't find a comprehensive answer. So please excuse > me for bringing it up again. > > I understand that previous versions of imfile u

[rsyslog] imfile and log rotating via copytruncate (again)

2013-06-26 Thread Radu Gheorghe
Hello, I know the problem of imfile and rotating logs was discussed a million times now, but I still can't find a comprehensive answer. So please excuse me for bringing it up again. I understand that previous versions of imfile used to monitor the size of the log and if that went down, assume it

Re: [rsyslog] ruleset new syntax & queue.type parameter

2013-06-26 Thread Philippe Muller
Great. :-) Philippe Muller On Wed, Jun 26, 2013 at 9:26 AM, Rainer Gerhards wrote: > OK, I now know what's going on. Will post to the bug tracker. > > > On Tue, Jun 25, 2013 at 6:59 PM, Philippe Muller > wrote: > > > Here is the full debug log, using the configuration example I gave in my > > f

Re: [rsyslog] ruleset new syntax & queue.type parameter

2013-06-26 Thread Rainer Gerhards
OK, I now know what's going on. Will post to the bug tracker. On Tue, Jun 25, 2013 at 6:59 PM, Philippe Muller wrote: > Here is the full debug log, using the configuration example I gave in my > first e-mail : http://dl.free.fr/oU1IyTMcN > > Philippe Muller > > > On Mon, Jun 24, 2013 at 10:59 AM