[rsyslog-notify] Forum Thread: Re: syslogtag sporadic match - (Mode 'reply')

[noreply at adiscon.com]

User: skreienlzb 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26919#p26919

Message: 
----------
I guess the attachment will not work.  I apologize in advance, but I have
no choice but to post it inline.


[code:1w0d753y]
$template rawlogfwd,"%msg%\n"
$template logfwd,"%msg%\n"

template (name="unknown" type="string"
string="/opt/syslog/unknown/unknown-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls1accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls1serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/wls_server1-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls1serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/wls_server1-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitdvwls1accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitdvwls1serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/wls_server1-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitdvwls1serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server1/wls_server1-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitdvwls2accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitdvwls2serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/wls_server2-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitdvwls2serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/wls_server2-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitwls2accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls2serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/wls_server2-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls2serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server2/wls_server2-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitwls3accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server3/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls3serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server3/wls_server3-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls3serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server3/wls_server3-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitwls4accesslog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server4/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls4serverlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server4/wls_server4-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwls4serverout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_server4/wls_server4-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitwls1acclog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server1/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwlsa1srvlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server1/wls_auth_server1-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwlsa1srvout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server1/wls_auth_server1-%$YEAR%-%$MONTH%-%$DAY%.out")
template (name="sitwls2acclog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server2/access-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwlsa2srvlog" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server2/wls_auth_server2-%$YEAR%-%$MONTH%-%$DAY%.log")
template (name="sitwlsa2srvout" type="string"
string="/opt/syslog/%FROMHOST%/oracle/wls_auth_server2/wls_auth_server2-%$YEAR%-%$MONTH%-%$DAY%.out")

ruleset(name="Net-1524"
        queue.type="LinkedList"
        queue.workerThreads="4" 
        queue.workerThreadMinimumMessages="100"){

	if $syslogtag == "sitwls1accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls1accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls1serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls1serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls1serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls1serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls1accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls1accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls1serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls1serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls1serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls1serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls2accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls2accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls2serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls2serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitdvwls2serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitdvwls2serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls2accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls2accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls2serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls2serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls2serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls2serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls3accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls3accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls3serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls3serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls3serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls3serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls4accesslog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls4accesslog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls4serverlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls4serverlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls4serverout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls4serverout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls1acclog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls1acclog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwlsa1srvlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwlsa1srvlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwlsa1srvout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwlsa1srvout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwls2acclog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwls2acclog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwlsa2srvlog:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwlsa2srvlog" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
	if $syslogtag == "sitwlsa2srvout:" then {
	        action(type="omfile" dynafilecachesize="500"
DynaFile="sitwlsa2srvout" template="rawlogfwd" ioBufferSize="64k"
flushOnTXEnd="off" asyncWriting="on")
		stop
	}
}




input(type="imudp" port="1524" ruleset="Net-1524")
input(type="imptcp" port="1524" ruleset="Net-1524")

[/code:1w0d753y]