Re: [rsyslog] Urgent, need help with correct usage of local variables in an action

Hi, In our design we have a GUI where operator can configure the IP and Port of the remote syslog server. Operator can enable or disable streaming to the configured IP and Port using a flag. In the backend we will consume the configuration made by the operator and prepare the required config

Re: [rsyslog] Urgent, need help with correct usage of local variables in an action

target and port cannot be variables, variables can only be used where they are explicitly allowed (almost entirely in templates) let's back up a bit and ask what you are trying to do rather than why this specific approach doesn't work. ___ rsyslog ma

[rsyslog] Urgent, need help with correct usage of local variables in an action

Hi, I am prepare templates to allow user to configure the IP and Port of Remote Syslog Server. In the templates hard coding IP works but when i assign the value to a local variable and use the variable in action it does not work as expected. Works fine: action(type="omfwd" Target="10.40.18.

Re: [rsyslog] excluding ip addresses

On Mon, 23 Apr 2018, Cheltenham, Chris via rsyslog wrote: How do I exclude ip addresses from being logged? I tried this .. #Ignore the 170.235.1.248 and 170.235.1.249 A 10 Load balancer health checks if $fromhost-ip=='170.235.1.248' then /dev/null/%FROMHOST-IP%/%syslogfacility-text%.log-I

Re: [rsyslog] server received messages but rsyslog did not write them into a file

On Mon, 23 Apr 2018, sophie.loewenthal--- via rsyslog wrote: After 31st March our rsyslog v8.4.2 Solaris 11 servers stopped processing lots of messages. I think we had a network change but do not yet know what. Tcpdump showed the test message arrived, # tcpdump -s 0 -A -vvv port 514 |grep sd

[rsyslog] excluding ip addresses

Hello, I am using 8.24 in CentOS 7. How do I exclude ip addresses from being logged? I tried this .. #Ignore the 170.235.1.248 and 170.235.1.249 A 10 Load balancer health checks if $fromhost-ip=='170.235.1.248' then /dev/null/%FROMHOST-IP%/%syslogfacility-text%.log-I-I/%FROMHOST

Re: [rsyslog] Packages obsoleted by rsyslog

Thanks, David and Rainer. I checked and found out that there is another internal package that somehow, most likely unnecessarily, depends on libfastjson. So, to speed the process up I decided to create RPMs without Obsoletes directive, albeit unsuccessfully so far (issue posted on rsyslog-pkg-rhel-

[rsyslog] server received messages but rsyslog did not write them into a file

Hi guys, After 31st March our rsyslog v8.4.2 Solaris 11 servers stopped processing lots of messages. I think we had a network change but do not yet know what. Tcpdump showed the test message arrived, # tcpdump -s 0 -A -vvv port 514 |grep sdfasdfsa dropped privs to nobody tcpdump: listening on

[rsyslog] Question about previous article "Adding the BOM to a message"

Hi, I noticed that in the article available at https://www.rsyslog.com/adding-the-bom-to-a-message/ Template does not have %$BOM% but the explanation has it. I believe %$BOM% is correct. Correct me if i am wrong. $template mytemplate,"<%PRI%>%TIMESTAMP:::date-rfc3339%%HOSTNAME% %SYSLOGTAG:1