Hi , everyone! i have a little problem with rsyslog sending events to sec.
part of my config in the *rsyslog.conf* is ;
$ModLoad omprog
$ActionOMProgBinary /usr/local/bin/sec.sh
*.* :omprog:
my *sec.sh* is
exec /usr/local/bin/sec --conf=/etc/sec/sec.conf --notail --input=-
my */etc/sec/sec.conf*:
type=PairWithWindow
ptype=RegExp
pattern=(?:[^\ ]*\ ){4}([^ ]*): \1\Wnew\W\w+\W+\w+
desc=No cancellation event for $1 after 10 minutes
action= pipe '$s' mail -s 'alarmed event mailsyslog' mym...@gmail.com
ptype2=RegExp
pattern2=(?:[^\ ]*\ ){4}$1\W\$1\W+cancelled\W\w+\W+\w+\W
desc2=pipe '%s details:$2' mail -s 'canceled event mailsyslog'
mym...@gmail.com
action2= pipe '%s' mail -s 'evento cancelado mailsyslog'
metcheve...@hg.com.uy
window=600
to test the sec i do :
echo "Dec 21 16:55:48 10.250.200.5 SOMEHOST02: SOMEHOST02 new critical,
VMwareAdapter,"|/usr/bin/perl -w /usr/local/bin/sec --conf=/etc/sec/sec.conf
This is a valid way to check if the sec will work with my event?
anyways , i dont know how to check if the event is sended correctly to sec
or if is a problem.
anyone has faced something like this?
Regards
Martin
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
