Re: [rsyslog] ActionQueueSaveOnShutdown does not work

2014-03-26 Thread David Lang
On Wed, 26 Mar 2014, swapna prasad wrote: Thanks David, I have the files on the same filesystem. I thought setting $ActionQueueSaveOnShutdown or $MainMsgQueueSaveOnShutdown "on" will make it write to the file when rsyslog is restarted too. Would deleting the current log to which rsyslog is wri

Re: [rsyslog] ActionQueueSaveOnShutdown does not work

2014-03-26 Thread swapna prasad
Thanks David, I have the files on the same filesystem. I thought setting $ActionQueueSaveOnShutdown or $MainMsgQueueSaveOnShutdown "on" will make it write to the file when rsyslog is restarted too. Would deleting the current log to which rsyslog is writing, trigger it to write to a local disk or

Re: [rsyslog] ActionQueueSaveOnShutdown does not work

2014-03-26 Thread David Lang
On Wed, 26 Mar 2014, swapna prasad wrote: Hi Does actionqueuesaveonshutdown work if the rule is to write to a file in the local file. I have logs written to file by rsyslog but when rsyslog or goes down I want the logs written into the queue by saved to be written in the log when it co

Re: [rsyslog] remove from logs some messages

2014-03-26 Thread David Lang
On Wed, 26 Mar 2014, li...@vfemail.net wrote: Quoting David Lang : On Wed, 26 Mar 2014, li...@vfemail.net wrote: Dear rsyslog experts, I am new here and also with syslog. I am running rsyslog-5.6.5-2.x86_64 on a rhel 5.10. I saw that is possible to not log some messages into /var/log/mess

[rsyslog] ActionQueueSaveOnShutdown does not work

2014-03-26 Thread swapna prasad
Hi Does actionqueuesaveonshutdown work if the rule is to write to a file in the local file. I have logs written to file by rsyslog but when rsyslog or goes down I want the logs written into the queue by saved to be written in the log when it comes up. I don't see any example for local

Re: [rsyslog] %app-name% %programname%

2014-03-26 Thread Boylan, James
In my experience it uses the : separator assumption that is part of the older RFC to try and guess what should be there. -- James -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-boun...@lists.adiscon.com] On Behalf Of Rainer Gerhards Sent: Wednesday, March 26

Re: [rsyslog] remove from logs some messages

2014-03-26 Thread linux
Quoting David Lang : On Wed, 26 Mar 2014, li...@vfemail.net wrote: Dear rsyslog experts, I am new here and also with syslog. I am running rsyslog-5.6.5-2.x86_64 on a rhel 5.10. I saw that is possible to not log some messages into /var/log/messages or mysql (in my case). I've already su

Re: [rsyslog] %app-name% %programname%

2014-03-26 Thread Rainer Gerhards
On Wed, Mar 26, 2014 at 6:03 PM, David Lang wrote: > On Wed, 26 Mar 2014, James Patterson wrote: > > With syslog-ng I could detect an empty application field and replace it >> with something else. >> While trying to do the same with rsyslog I noticed that the first word >> of the message appears

Re: [rsyslog] %app-name% %programname%

2014-03-26 Thread David Lang
On Wed, 26 Mar 2014, James Patterson wrote: With syslog-ng I could detect an empty application field and replace it with something else. While trying to do the same with rsyslog I noticed that the first word of the message appears in these fields. Is there a way to not have this happen? Thanks.

Re: [rsyslog] remove from logs some messages

2014-03-26 Thread David Lang
On Wed, 26 Mar 2014, li...@vfemail.net wrote: Dear rsyslog experts, I am new here and also with syslog. I am running rsyslog-5.6.5-2.x86_64 on a rhel 5.10. I saw that is possible to not log some messages into /var/log/messages or mysql (in my case). I've already suppressed some messages com

[rsyslog] remove from logs some messages

2014-03-26 Thread linux
Dear rsyslog experts, I am new here and also with syslog. I am running rsyslog-5.6.5-2.x86_64 on a rhel 5.10. I saw that is possible to not log some messages into /var/log/messages or mysql (in my case). I've already suppressed some messages coming from dovecot adding the following line

[rsyslog] %app-name% %programname%

2014-03-26 Thread James Patterson
With syslog-ng I could detect an empty application field and replace it with something else. While trying to do the same with rsyslog I noticed that the first word of the message appears in these fields. Is there a way to not have this happen? Thanks. -- James Patterson jamespatter...@operama

Re: [rsyslog] Question on Queue Info (.qi) files.

2014-03-26 Thread Rainer Gerhards
On Wed, Mar 26, 2014 at 6:17 AM, David Lang wrote: > On Tue, 25 Mar 2014, Nick Syslog wrote: > > My team and I are working on new methods for monitoring our disk assisted >> queues and additionally look for failures within these queues. >> >> Typically with a 'healthy' DA queue I will see an ass