[rsyslog] Watch for message conditions

[Mark Olliver]

Hi All,

I am trying to get rsyslog to alert me on certain patterns in the log. At
the moment i have built a small config with the following sections However,
nothing is the Alert script is not being triggered as far as i can tell. I
have tested the alert script and it works ok.


#/etc/rsyslog.d/55-alert.conf
$template Alert, "'Rsyslog Alert' %msg%"
local5.info
:msg, content "warning"
^/var/c+i/bin/mail_alert Alert


I am testing the above by running the following command on the cli.

echo "warning: test message" | logger -t puppet -p local5.info


This does correctly log into my local.5 log in /var/logs .

Any ideas would be welcome.

Thanks

Mark