|
|
| Zeile 4: |
Zeile 4: |
| *[[Rsyslog Netzwerkports öffnen]] | | *[[Rsyslog Netzwerkports öffnen]] |
| *[[Rsyslog Logger Test]] | | *[[Rsyslog Logger Test]] |
| | | *[[Rsyslog Eigne Regeln]] |
| =Eigene Regeln=
| |
| ==Einfache Regeln==
| |
| ===Programname===
| |
| *Logfile for tftpd
| |
| if $programname == 'in.tftpd' then /var/log/tftpd.log
| |
| | |
| ===facility-text===
| |
| *60-meinlog.conf
| |
| if $syslogfacility-text == 'local3' then /var/log/meinelog
| |
| *systemctl restart rsyslog.service
| |
| *echo "Hallo Welt" | logger -p local3.warn
| |
| *tail -n 1 -f /var/log/meinelog
| |
| Sep 5 14:21:04 bajor root: Hallo Welt
| |
| | |
| ===contains===
| |
| Prevent rsyslog logging to /var/log/syslog
| |
| *10-iptables.conf
| |
| if $msg contains '-iptables-' then /var/log/firewall
| |
| & ~
| |
| | |
| ==expressions in parenthesis==
| |
| * not, unary minus
| |
| * *, /, % (modulus, as in C)
| |
| * +, -, & (string concatenation)
| |
| * ==, !=, <>, <, >, <=, >=, contains (strings!), startswith (strings!)
| |
| * and
| |
| * or
| |
| | |
| | |
| | |
| | |
| <b>legacy rsyslog</b>
| |
| | |
| Beginnen mit einem $-Zeichen. Zum Setzen von Konfigurationsparametern.
| |
| $FileOwner syslog
| |
| | |
| <b>RainerScript</b>
| |
| | |
| Neues Format.
| |
| | |
| | |
| Generator für eine Konfigurationsdatei: http://www.rsyslog.com/rsyslog-configuration-builder/
| |
| | |
| ===Templates - Anpassen des Ausgabeformates===
| |
| | |
| $template MyOwnFormat,"Debug line with all properties:\nFROMHOST: '%FROMHOST%', HOSTNAME: '%HOSTNAME%', PRI: %PRI%,\nsyslogtag '%syslogtag%',
| |
| programname: '%programname%', APP-NAME: '%APP-NAME%', PROCID: '%PROCID%', MSGID: '%MSGID%',\nTIMESTAMP: '%TIMESTAMP%', STRUCTURED-DATA: '%STRUCTURED-DATA%',
| |
| \nmsg: '%msg%'\nescaped msg: '%msg:::drop-cc%'\nrawmsg: '%rawmsg%'\n\n"
| |
|
| |
| *.*;auth,authpriv.none /var/log/syslog;MyOwnFormat
| |
|
| |
|
| =Quellen= | | =Quellen= |