[rsyslog-notify] Forum Thread: Re: Can't get <PRI> to display - (Mode 'reply')

noreply at adiscon.com noreply at adiscon.com
Sun Jan 3 22:00:56 CET 2016


User: techcheez 
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26271#p26271

Message: 
----------
Finally got it to display. I used the following code in the new format:

# Provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="1470" ruleset="RemoteDevice")

#### TEMPLATES ####

# Log every host to its own directory
# Legacy syntax - $template
RemoteHost,"/data/logs/%HOSTNAME%/%YEAR%/%MONTH%/%DAY%/%HOSTNAME%.log"
template(name="RemoteDevice" type="string"
string="/data/logs/%HOSTNAME%/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%.log")
template(name="FileFormat" type="list") {
    constant(value="<")
    property(name="pri")
    constant(value=">")
    property(name="timestamp" dateFormat="rfc3339")
    constant(value=" ")
    property(name="hostname")
    constant(value=" ")
    property(name="syslogtag")
    property(name="msg" spifno1stsp="on" )
    property(name="msg" droplastlf="on")
    constant(value="\n")
    }
ruleset(name="RemoteDevice"){
	action(type="omfile" dynaFile="RemoteDevice" template="FileFormat")
}


More information about the rsyslog-notify mailing list