Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users

action names

 

 

RSyslog users RSS feed   Index | Next | Previous | View Threaded


briank at talksum

May 2, 2012, 3:20 AM

Post #1 of 13 (628 views)
Permalink
action names

I have an issue I'd like to solve concerning action names in the stats
module. While I could solve it in a local fork, if it can be solved in a
way that would be useful to others and incorporated back into rsyslog
that's my preference.

Here's some current output from a test configuration, with JSON impstats
enabled:

2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 1","processed":1696,"failed":0}
2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 2","processed":396,"failed":0}
2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 3","processed":1320,"failed":0}
2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 4","processed":1144,"failed":0}
2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 5","processed":1144,"failed":0}
2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 6","processed":68,"failed":0}
2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 7","processed":0,"failed":0}
2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 8","processed":26,"failed":0}
2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 9","processed":283,"failed":0}
2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 10","processed":0,"failed":0}
2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 11","processed":0,"failed":0}
2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 12","processed":520,"failed":0}
2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 12
queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
":0,"maxqsize":5}

My issue is that action names have spaces in them. This makes using the
action names as keys in some key value stores problematic. Ultimately, I
would love to be able to pass a configuration option to each action
explicitly naming it. Short term, my problem would be solved if the spaces
were replaced by an underscore.

Off the top of my head I can think of a couple of ways to do this:

1 - simply change whatever routine is generating the names to produce
"action_1", etc.
2 - add a property formatter that replaces spaces with underscores, that
could be used after passing this output to mmjsonparse.

Thoughts?

Brian
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

May 2, 2012, 3:55 AM

Post #2 of 13 (613 views)
Permalink
Re: action names [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Brian Knox
> Sent: Wednesday, May 02, 2012 12:20 PM
> To: rsyslog-users
> Subject: [rsyslog] action names
>
> I have an issue I'd like to solve concerning action names in the stats
> module. While I could solve it in a local fork, if it can be solved in a
> way that would be useful to others and incorporated back into rsyslog
> that's my preference.
>
> Here's some current output from a test configuration, with JSON impstats
> enabled:
>
> 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 1","processed":1696,"failed":0}
> 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 2","processed":396,"failed":0}
> 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 3","processed":1320,"failed":0}
> 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 4","processed":1144,"failed":0}
> 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 5","processed":1144,"failed":0}
> 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 6","processed":68,"failed":0}
> 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 7","processed":0,"failed":0}
> 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 8","processed":26,"failed":0}
> 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 9","processed":283,"failed":0}
> 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 10","processed":0,"failed":0}
> 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 11","processed":0,"failed":0}
> 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 12","processed":520,"failed":0}
> 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 12
> queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
> ":0,"maxqsize":5}
>
> My issue is that action names have spaces in them. This makes using the
> action names as keys in some key value stores problematic. Ultimately, I
> would love to be able to pass a configuration option to each action
> explicitly naming it.

$ActionName ;)

So I think we can keep the default names, right?

Rainer
< Short term, my problem would be solved if the spaces
> were replaced by an underscore.
>
> Off the top of my head I can think of a couple of ways to do this:
>
> 1 - simply change whatever routine is generating the names to produce
> "action_1", etc.
> 2 - add a property formatter that replaces spaces with underscores, that
> could be used after passing this output to mmjsonparse.
>
> Thoughts?
>
> Brian
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 3:58 AM

Post #3 of 13 (618 views)
Permalink
Re: action names [In reply to]

Oh! I must have missed that in the docs!

Is this also settable via the new config 6 syntax?

Brian

On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards <rgerhards [at] hq>wrote:

> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Brian Knox
> > Sent: Wednesday, May 02, 2012 12:20 PM
> > To: rsyslog-users
> > Subject: [rsyslog] action names
> >
> > I have an issue I'd like to solve concerning action names in the stats
> > module. While I could solve it in a local fork, if it can be solved in a
> > way that would be useful to others and incorporated back into rsyslog
> > that's my preference.
> >
> > Here's some current output from a test configuration, with JSON impstats
> > enabled:
> >
> > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 1","processed":1696,"failed":0}
> > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 2","processed":396,"failed":0}
> > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 3","processed":1320,"failed":0}
> > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 4","processed":1144,"failed":0}
> > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 5","processed":1144,"failed":0}
> > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 6","processed":68,"failed":0}
> > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 7","processed":0,"failed":0}
> > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 8","processed":26,"failed":0}
> > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 9","processed":283,"failed":0}
> > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 10","processed":0,"failed":0}
> > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 11","processed":0,"failed":0}
> > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 12","processed":520,"failed":0}
> > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> > {"name":"action 12
> > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
> > ":0,"maxqsize":5}
> >
> > My issue is that action names have spaces in them. This makes using the
> > action names as keys in some key value stores problematic. Ultimately, I
> > would love to be able to pass a configuration option to each action
> > explicitly naming it.
>
> $ActionName ;)
>
> So I think we can keep the default names, right?
>
> Rainer
> < Short term, my problem would be solved if the spaces
> > were replaced by an underscore.
> >
> > Off the top of my head I can think of a couple of ways to do this:
> >
> > 1 - simply change whatever routine is generating the names to produce
> > "action_1", etc.
> > 2 - add a property formatter that replaces spaces with underscores, that
> > could be used after passing this output to mmjsonparse.
> >
> > Thoughts?
> >
> > Brian
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

May 2, 2012, 4:00 AM

Post #4 of 13 (615 views)
Permalink
Re: action names [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Brian Knox
> Sent: Wednesday, May 02, 2012 12:59 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] action names
>
> Oh! I must have missed that in the docs!

Np

>
> Is this also settable via the new config 6 syntax?

name="xxx"
Rainer
>
> Brian
>
> On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> <rgerhards [at] hq>wrote:
>
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Brian Knox
> > > Sent: Wednesday, May 02, 2012 12:20 PM
> > > To: rsyslog-users
> > > Subject: [rsyslog] action names
> > >
> > > I have an issue I'd like to solve concerning action names in the stats
> > > module. While I could solve it in a local fork, if it can be solved in
a
> > > way that would be useful to others and incorporated back into rsyslog
> > > that's my preference.
> > >
> > > Here's some current output from a test configuration, with JSON
impstats
> > > enabled:
> > >
> > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 1","processed":1696,"failed":0}
> > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 2","processed":396,"failed":0}
> > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 3","processed":1320,"failed":0}
> > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 4","processed":1144,"failed":0}
> > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 5","processed":1144,"failed":0}
> > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 6","processed":68,"failed":0}
> > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 7","processed":0,"failed":0}
> > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 8","processed":26,"failed":0}
> > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 9","processed":283,"failed":0}
> > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 10","processed":0,"failed":0}
> > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 11","processed":0,"failed":0}
> > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 12","processed":520,"failed":0}
> > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> > > {"name":"action 12
> > >
queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
> > > ":0,"maxqsize":5}
> > >
> > > My issue is that action names have spaces in them. This makes using
the
> > > action names as keys in some key value stores problematic. Ultimately,
I
> > > would love to be able to pass a configuration option to each action
> > > explicitly naming it.
> >
> > $ActionName ;)
> >
> > So I think we can keep the default names, right?
> >
> > Rainer
> > < Short term, my problem would be solved if the spaces
> > > were replaced by an underscore.
> > >
> > > Off the top of my head I can think of a couple of ways to do this:
> > >
> > > 1 - simply change whatever routine is generating the names to produce
> > > "action_1", etc.
> > > 2 - add a property formatter that replaces spaces with underscores,
that
> > > could be used after passing this output to mmjsonparse.
> > >
> > > Thoughts?
> > >
> > > Brian
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 4:01 AM

Post #5 of 13 (613 views)
Permalink
Re: action names [In reply to]

Hmm just tried that and not seeing it take effect, let me poke at it for a
few.

Brian

On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards <rgerhards [at] hq>wrote:

> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Brian Knox
> > Sent: Wednesday, May 02, 2012 12:59 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] action names
> >
> > Oh! I must have missed that in the docs!
>
> Np
>
> >
> > Is this also settable via the new config 6 syntax?
>
> name="xxx"
> Rainer
> >
> > Brian
> >
> > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> > <rgerhards [at] hq>wrote:
> >
> > > > -----Original Message-----
> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > > bounces [at] lists] On Behalf Of Brian Knox
> > > > Sent: Wednesday, May 02, 2012 12:20 PM
> > > > To: rsyslog-users
> > > > Subject: [rsyslog] action names
> > > >
> > > > I have an issue I'd like to solve concerning action names in the
> stats
> > > > module. While I could solve it in a local fork, if it can be solved
> in
> a
> > > > way that would be useful to others and incorporated back into rsyslog
> > > > that's my preference.
> > > >
> > > > Here's some current output from a test configuration, with JSON
> impstats
> > > > enabled:
> > > >
> > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 1","processed":1696,"failed":0}
> > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 2","processed":396,"failed":0}
> > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 3","processed":1320,"failed":0}
> > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 4","processed":1144,"failed":0}
> > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 5","processed":1144,"failed":0}
> > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 6","processed":68,"failed":0}
> > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 7","processed":0,"failed":0}
> > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 8","processed":26,"failed":0}
> > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 9","processed":283,"failed":0}
> > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 10","processed":0,"failed":0}
> > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 11","processed":0,"failed":0}
> > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 12","processed":520,"failed":0}
> > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> > > > {"name":"action 12
> > > >
> queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
> > > > ":0,"maxqsize":5}
> > > >
> > > > My issue is that action names have spaces in them. This makes using
> the
> > > > action names as keys in some key value stores problematic.
> Ultimately,
> I
> > > > would love to be able to pass a configuration option to each action
> > > > explicitly naming it.
> > >
> > > $ActionName ;)
> > >
> > > So I think we can keep the default names, right?
> > >
> > > Rainer
> > > < Short term, my problem would be solved if the spaces
> > > > were replaced by an underscore.
> > > >
> > > > Off the top of my head I can think of a couple of ways to do this:
> > > >
> > > > 1 - simply change whatever routine is generating the names to produce
> > > > "action_1", etc.
> > > > 2 - add a property formatter that replaces spaces with underscores,
> that
> > > > could be used after passing this output to mmjsonparse.
> > > >
> > > > Thoughts?
> > > >
> > > > Brian
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

May 2, 2012, 4:02 AM

Post #6 of 13 (615 views)
Permalink
Re: action names [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Brian Knox
> Sent: Wednesday, May 02, 2012 1:02 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] action names
>
> Hmm just tried that and not seeing it take effect, let me poke at it for a
> few.

Maybe you hit a bug... have a look at the debug file when the action is
defined. It tells you which params it understood.

Raienr
>
> Brian
>
> On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
> <rgerhards [at] hq>wrote:
>
> > > -----Original Message-----
> > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > bounces [at] lists] On Behalf Of Brian Knox
> > > Sent: Wednesday, May 02, 2012 12:59 PM
> > > To: rsyslog-users
> > > Subject: Re: [rsyslog] action names
> > >
> > > Oh! I must have missed that in the docs!
> >
> > Np
> >
> > >
> > > Is this also settable via the new config 6 syntax?
> >
> > name="xxx"
> > Rainer
> > >
> > > Brian
> > >
> > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> > > <rgerhards [at] hq>wrote:
> > >
> > > > > -----Original Message-----
> > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > > > bounces [at] lists] On Behalf Of Brian Knox
> > > > > Sent: Wednesday, May 02, 2012 12:20 PM
> > > > > To: rsyslog-users
> > > > > Subject: [rsyslog] action names
> > > > >
> > > > > I have an issue I'd like to solve concerning action names in the
> > stats
> > > > > module. While I could solve it in a local fork, if it can be
solved
> > in
> > a
> > > > > way that would be useful to others and incorporated back into
rsyslog
> > > > > that's my preference.
> > > > >
> > > > > Here's some current output from a test configuration, with JSON
> > impstats
> > > > > enabled:
> > > > >
> > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 1","processed":1696,"failed":0}
> > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 2","processed":396,"failed":0}
> > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 3","processed":1320,"failed":0}
> > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 4","processed":1144,"failed":0}
> > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 5","processed":1144,"failed":0}
> > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 6","processed":68,"failed":0}
> > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 7","processed":0,"failed":0}
> > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 8","processed":26,"failed":0}
> > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 9","processed":283,"failed":0}
> > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 10","processed":0,"failed":0}
> > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 11","processed":0,"failed":0}
> > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 12","processed":520,"failed":0}
> > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> > > > > {"name":"action 12
> > > > >
> > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"discarded.nf
> > > > > ":0,"maxqsize":5}
> > > > >
> > > > > My issue is that action names have spaces in them. This makes
using
> > the
> > > > > action names as keys in some key value stores problematic.
> > Ultimately,
> > I
> > > > > would love to be able to pass a configuration option to each action
> > > > > explicitly naming it.
> > > >
> > > > $ActionName ;)
> > > >
> > > > So I think we can keep the default names, right?
> > > >
> > > > Rainer
> > > > < Short term, my problem would be solved if the spaces
> > > > > were replaced by an underscore.
> > > > >
> > > > > Off the top of my head I can think of a couple of ways to do this:
> > > > >
> > > > > 1 - simply change whatever routine is generating the names to
produce
> > > > > "action_1", etc.
> > > > > 2 - add a property formatter that replaces spaces with underscores,
> > that
> > > > > could be used after passing this output to mmjsonparse.
> > > > >
> > > > > Thoughts?
> > > > >
> > > > > Brian
> > > > > _______________________________________________
> > > > > rsyslog mailing list
> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > > http://www.rsyslog.com/professional-services/
> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > >
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 4:14 AM

Post #7 of 13 (617 views)
Permalink
Re: action names [In reply to]

It looks like maybe the ommongo output is accepting name and omfile may not
be - I'll start a debug log and take a look after I get some coffee!

Brian

On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards <rgerhards [at] hq>wrote:

>
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Brian Knox
> > Sent: Wednesday, May 02, 2012 1:02 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] action names
> >
> > Hmm just tried that and not seeing it take effect, let me poke at it for
> a
> > few.
>
> Maybe you hit a bug... have a look at the debug file when the action is
> defined. It tells you which params it understood.
>
> Raienr
> >
> > Brian
> >
> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
> > <rgerhards [at] hq>wrote:
> >
> > > > -----Original Message-----
> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > > bounces [at] lists] On Behalf Of Brian Knox
> > > > Sent: Wednesday, May 02, 2012 12:59 PM
> > > > To: rsyslog-users
> > > > Subject: Re: [rsyslog] action names
> > > >
> > > > Oh! I must have missed that in the docs!
> > >
> > > Np
> > >
> > > >
> > > > Is this also settable via the new config 6 syntax?
> > >
> > > name="xxx"
> > > Rainer
> > > >
> > > > Brian
> > > >
> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> > > > <rgerhards [at] hq>wrote:
> > > >
> > > > > > -----Original Message-----
> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > > > > > bounces [at] lists] On Behalf Of Brian Knox
> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
> > > > > > To: rsyslog-users
> > > > > > Subject: [rsyslog] action names
> > > > > >
> > > > > > I have an issue I'd like to solve concerning action names in the
> > > stats
> > > > > > module. While I could solve it in a local fork, if it can be
> solved
> > > in
> > > a
> > > > > > way that would be useful to others and incorporated back into
> rsyslog
> > > > > > that's my preference.
> > > > > >
> > > > > > Here's some current output from a test configuration, with JSON
> > > impstats
> > > > > > enabled:
> > > > > >
> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 1","processed":1696,"failed":0}
> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 2","processed":396,"failed":0}
> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 3","processed":1320,"failed":0}
> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 4","processed":1144,"failed":0}
> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 5","processed":1144,"failed":0}
> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 6","processed":68,"failed":0}
> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 7","processed":0,"failed":0}
> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 8","processed":26,"failed":0}
> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 9","processed":283,"failed":0}
> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 10","processed":0,"failed":0}
> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 11","processed":0,"failed":0}
> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 12","processed":520,"failed":0}
> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats: @cee:
> > > > > > {"name":"action 12
> > > > > >
> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
> discarded.nf
> > > > > > ":0,"maxqsize":5}
> > > > > >
> > > > > > My issue is that action names have spaces in them. This makes
> using
> > > the
> > > > > > action names as keys in some key value stores problematic.
> > > Ultimately,
> > > I
> > > > > > would love to be able to pass a configuration option to each
> action
> > > > > > explicitly naming it.
> > > > >
> > > > > $ActionName ;)
> > > > >
> > > > > So I think we can keep the default names, right?
> > > > >
> > > > > Rainer
> > > > > < Short term, my problem would be solved if the spaces
> > > > > > were replaced by an underscore.
> > > > > >
> > > > > > Off the top of my head I can think of a couple of ways to do
> this:
> > > > > >
> > > > > > 1 - simply change whatever routine is generating the names to
> produce
> > > > > > "action_1", etc.
> > > > > > 2 - add a property formatter that replaces spaces with
> underscores,
> > > that
> > > > > > could be used after passing this output to mmjsonparse.
> > > > > >
> > > > > > Thoughts?
> > > > > >
> > > > > > Brian
> > > > > > _______________________________________________
> > > > > > rsyslog mailing list
> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > > > http://www.rsyslog.com/professional-services/
> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > > _______________________________________________
> > > > > rsyslog mailing list
> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > > http://www.rsyslog.com/professional-services/
> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > > >
> > > > _______________________________________________
> > > > rsyslog mailing list
> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > > http://www.rsyslog.com/professional-services/
> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > > _______________________________________________
> > > rsyslog mailing list
> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > > http://www.rsyslog.com/professional-services/
> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 4:20 AM

Post #8 of 13 (616 views)
Permalink
Re: action names [In reply to]

Aha! The problem seems to by my omfile action is not correct to begin
with. I'm basing the config off of this post:

http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/

Here's what I'm trying:

$ModLoad immark # provides -MARK- message capability
$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)
$ModLoad impstats # impstats

$PStatsInterval 2
$PStatsSeverity 7
$PStatJSON on

if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log

if ($syslogfacility-text == 'authpriv') then {
action(type="omfile" target="/var/log/secure")
}
if ($syslogfacility-text == 'mail') then {
action(type="omfile" target="/var/log/maillog")
}

if ($syslogfacility-text == 'cron') then {
action(type="omfile" target="/var/log/cron")
}

if ($syslogpriority-text =='info') then {
action(type="omfile" target="/var/log/messages")
}

if ($syslogfacility-text == 'local7') then {
action(type="omfile" target="/var/log/boot.log")
}

and I'm getting:

[root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
rsyslogd: version 6.3.8, config validation run (level 1), master config
/etc/rsyslog.conf
rsyslogd: invalid or yet-unknown config file command - have you forgotten
to load a module? [try http://www.rsyslog.com/e/3003 ]
rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
[try http://www.rsyslog.com/e/2211 ]
rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
rsyslogd: warning: selector line without actions will be discarded
rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
[try http://www.rsyslog.com/e/2211 ]
rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
rsyslogd: warning: selector line without actions will be discarded
rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
[try http://www.rsyslog.com/e/2211 ]
rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
rsyslogd: warning: selector line without actions will be discarded
rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
[try http://www.rsyslog.com/e/2211 ]
rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
rsyslogd: warning: selector line without actions will be discarded
rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
[try http://www.rsyslog.com/e/2211 ]
rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
rsyslogd: warning: selector line without actions will be discarded
rsyslogd: End of config validation run. Bye.


On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:

> It looks like maybe the ommongo output is accepting name and omfile may
> not be - I'll start a debug log and take a look after I get some coffee!
>
> Brian
>
>
> On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards <rgerhards [at] hq>wrote:
>
>>
>>
>> > -----Original Message-----
>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > bounces [at] lists] On Behalf Of Brian Knox
>> > Sent: Wednesday, May 02, 2012 1:02 PM
>> > To: rsyslog-users
>> > Subject: Re: [rsyslog] action names
>> >
>> > Hmm just tried that and not seeing it take effect, let me poke at it
>> for a
>> > few.
>>
>> Maybe you hit a bug... have a look at the debug file when the action is
>> defined. It tells you which params it understood.
>>
>> Raienr
>> >
>> > Brian
>> >
>> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
>> > <rgerhards [at] hq>wrote:
>> >
>> > > > -----Original Message-----
>> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > > bounces [at] lists] On Behalf Of Brian Knox
>> > > > Sent: Wednesday, May 02, 2012 12:59 PM
>> > > > To: rsyslog-users
>> > > > Subject: Re: [rsyslog] action names
>> > > >
>> > > > Oh! I must have missed that in the docs!
>> > >
>> > > Np
>> > >
>> > > >
>> > > > Is this also settable via the new config 6 syntax?
>> > >
>> > > name="xxx"
>> > > Rainer
>> > > >
>> > > > Brian
>> > > >
>> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
>> > > > <rgerhards [at] hq>wrote:
>> > > >
>> > > > > > -----Original Message-----
>> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > > > > > bounces [at] lists] On Behalf Of Brian Knox
>> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
>> > > > > > To: rsyslog-users
>> > > > > > Subject: [rsyslog] action names
>> > > > > >
>> > > > > > I have an issue I'd like to solve concerning action names in the
>> > > stats
>> > > > > > module. While I could solve it in a local fork, if it can be
>> solved
>> > > in
>> > > a
>> > > > > > way that would be useful to others and incorporated back into
>> rsyslog
>> > > > > > that's my preference.
>> > > > > >
>> > > > > > Here's some current output from a test configuration, with JSON
>> > > impstats
>> > > > > > enabled:
>> > > > > >
>> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 1","processed":1696,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 2","processed":396,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 3","processed":1320,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 4","processed":1144,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 5","processed":1144,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 6","processed":68,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 7","processed":0,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 8","processed":26,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 9","processed":283,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 10","processed":0,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 11","processed":0,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 12","processed":520,"failed":0}
>> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
>> @cee:
>> > > > > > {"name":"action 12
>> > > > > >
>> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
>> discarded.nf
>> > > > > > ":0,"maxqsize":5}
>> > > > > >
>> > > > > > My issue is that action names have spaces in them. This makes
>> using
>> > > the
>> > > > > > action names as keys in some key value stores problematic.
>> > > Ultimately,
>> > > I
>> > > > > > would love to be able to pass a configuration option to each
>> action
>> > > > > > explicitly naming it.
>> > > > >
>> > > > > $ActionName ;)
>> > > > >
>> > > > > So I think we can keep the default names, right?
>> > > > >
>> > > > > Rainer
>> > > > > < Short term, my problem would be solved if the spaces
>> > > > > > were replaced by an underscore.
>> > > > > >
>> > > > > > Off the top of my head I can think of a couple of ways to do
>> this:
>> > > > > >
>> > > > > > 1 - simply change whatever routine is generating the names to
>> produce
>> > > > > > "action_1", etc.
>> > > > > > 2 - add a property formatter that replaces spaces with
>> underscores,
>> > > that
>> > > > > > could be used after passing this output to mmjsonparse.
>> > > > > >
>> > > > > > Thoughts?
>> > > > > >
>> > > > > > Brian
>> > > > > > _______________________________________________
>> > > > > > rsyslog mailing list
>> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > > > > http://www.rsyslog.com/professional-services/
>> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > > > _______________________________________________
>> > > > > rsyslog mailing list
>> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > > > http://www.rsyslog.com/professional-services/
>> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > > >
>> > > > _______________________________________________
>> > > > rsyslog mailing list
>> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > > http://www.rsyslog.com/professional-services/
>> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > > _______________________________________________
>> > > rsyslog mailing list
>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > > http://www.rsyslog.com/professional-services/
>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 4:23 AM

Post #9 of 13 (617 views)
Permalink
Re: action names [In reply to]

So I changed to this:

$ModLoad immark # provides -MARK- message capability
$ModLoad imuxsock # provides support for local system logging (e.g.
via logger command)
$ModLoad imklog # kernel logging (formerly provided by rklogd)
$ModLoad impstats # impstats

$PStatsInterval 2
$PStatsSeverity 7
$PStatJSON on

if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log

if ($syslogfacility-text == 'authpriv') then {
action(type="omfile" file="/var/log/secure" name="authpriv")
}
if ($syslogfacility-text == 'mail') then {
action(type="omfile" file="/var/log/maillog" name="mail")
}

if ($syslogfacility-text == 'cron') then {
action(type="omfile" file="/var/log/cron" name="cron")
}

if ($syslogpriority-text =='info') then {
action(type="omfile" file="/var/log/messages" name="info")
}

if ($syslogfacility-text == 'local7') then {
action(type="omfile" file="/var/log/boot.log" name="local7")
}

And this is working:

2012-05-02T07:22:31.236265-04:00 localhost rsyslogd-pstats: @cee:
{"name":"action 1","processed":184,"failed":0}
2012-05-02T07:22:31.236272-04:00 localhost rsyslogd-pstats: @cee:
{"name":"authpriv","processed":0,"failed":0}
2012-05-02T07:22:31.236278-04:00 localhost rsyslogd-pstats: @cee:
{"name":"mail","processed":0,"failed":0}
2012-05-02T07:22:31.236284-04:00 localhost rsyslogd-pstats: @cee:
{"name":"cron","processed":0,"failed":0}
2012-05-02T07:22:31.236289-04:00 localhost rsyslogd-pstats: @cee:
{"name":"info","processed":185,"failed":0}
2012-05-02T07:22:31.236295-04:00 localhost rsyslogd-pstats: @cee:
{"name":"local7","processed":0,"failed":0}
2012-05-02T07:22:31.236303-04:00 localhost rsyslogd-pstats: @cee:
{"name":"main Q","size":7,"enqueued":193,"full":0,"discarded.full":0,"
discarded.nf":0,"maxqsize":8}

Although I've still got a bug somewhere in my conf:

[root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
rsyslogd: version 6.3.8, config validation run (level 1), master config
/etc/rsyslog.conf
rsyslogd: invalid or yet-unknown config file command - have you forgotten
to load a module? [try http://www.rsyslog.com/e/3003 ]
rsyslogd: End of config validation run. Bye.
[root [at] monet log]#

Getting closer though :)

On Wed, May 2, 2012 at 7:20 AM, Brian Knox <briank [at] talksum> wrote:

> Aha! The problem seems to by my omfile action is not correct to begin
> with. I'm basing the config off of this post:
>
> http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
>
> Here's what I'm trying:
>
> $ModLoad immark # provides -MARK- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g.
> via logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
> $ModLoad impstats # impstats
>
> $PStatsInterval 2
> $PStatsSeverity 7
> $PStatJSON on
>
> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>
> if ($syslogfacility-text == 'authpriv') then {
> action(type="omfile" target="/var/log/secure")
> }
> if ($syslogfacility-text == 'mail') then {
> action(type="omfile" target="/var/log/maillog")
> }
>
> if ($syslogfacility-text == 'cron') then {
> action(type="omfile" target="/var/log/cron")
> }
>
> if ($syslogpriority-text =='info') then {
> action(type="omfile" target="/var/log/messages")
> }
>
> if ($syslogfacility-text == 'local7') then {
> action(type="omfile" target="/var/log/boot.log")
> }
>
> and I'm getting:
>
> [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
> rsyslogd: version 6.3.8, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: invalid or yet-unknown config file command - have you forgotten
> to load a module? [try http://www.rsyslog.com/e/3003 ]
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: End of config validation run. Bye.
>
>
>
> On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:
>
>> It looks like maybe the ommongo output is accepting name and omfile may
>> not be - I'll start a debug log and take a look after I get some coffee!
>>
>> Brian
>>
>>
>> On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards <rgerhards [at] hq
>> > wrote:
>>
>>>
>>>
>>> > -----Original Message-----
>>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>> > bounces [at] lists] On Behalf Of Brian Knox
>>> > Sent: Wednesday, May 02, 2012 1:02 PM
>>> > To: rsyslog-users
>>> > Subject: Re: [rsyslog] action names
>>> >
>>> > Hmm just tried that and not seeing it take effect, let me poke at it
>>> for a
>>> > few.
>>>
>>> Maybe you hit a bug... have a look at the debug file when the action is
>>> defined. It tells you which params it understood.
>>>
>>> Raienr
>>> >
>>> > Brian
>>> >
>>> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
>>> > <rgerhards [at] hq>wrote:
>>> >
>>> > > > -----Original Message-----
>>> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>> > > > bounces [at] lists] On Behalf Of Brian Knox
>>> > > > Sent: Wednesday, May 02, 2012 12:59 PM
>>> > > > To: rsyslog-users
>>> > > > Subject: Re: [rsyslog] action names
>>> > > >
>>> > > > Oh! I must have missed that in the docs!
>>> > >
>>> > > Np
>>> > >
>>> > > >
>>> > > > Is this also settable via the new config 6 syntax?
>>> > >
>>> > > name="xxx"
>>> > > Rainer
>>> > > >
>>> > > > Brian
>>> > > >
>>> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
>>> > > > <rgerhards [at] hq>wrote:
>>> > > >
>>> > > > > > -----Original Message-----
>>> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>> > > > > > bounces [at] lists] On Behalf Of Brian Knox
>>> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
>>> > > > > > To: rsyslog-users
>>> > > > > > Subject: [rsyslog] action names
>>> > > > > >
>>> > > > > > I have an issue I'd like to solve concerning action names in
>>> the
>>> > > stats
>>> > > > > > module. While I could solve it in a local fork, if it can be
>>> solved
>>> > > in
>>> > > a
>>> > > > > > way that would be useful to others and incorporated back into
>>> rsyslog
>>> > > > > > that's my preference.
>>> > > > > >
>>> > > > > > Here's some current output from a test configuration, with JSON
>>> > > impstats
>>> > > > > > enabled:
>>> > > > > >
>>> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 1","processed":1696,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 2","processed":396,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 3","processed":1320,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 4","processed":1144,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 5","processed":1144,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 6","processed":68,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 7","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 8","processed":26,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 9","processed":283,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 10","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 11","processed":0,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 12","processed":520,"failed":0}
>>> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
>>> @cee:
>>> > > > > > {"name":"action 12
>>> > > > > >
>>> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
>>> discarded.nf
>>> > > > > > ":0,"maxqsize":5}
>>> > > > > >
>>> > > > > > My issue is that action names have spaces in them. This makes
>>> using
>>> > > the
>>> > > > > > action names as keys in some key value stores problematic.
>>> > > Ultimately,
>>> > > I
>>> > > > > > would love to be able to pass a configuration option to each
>>> action
>>> > > > > > explicitly naming it.
>>> > > > >
>>> > > > > $ActionName ;)
>>> > > > >
>>> > > > > So I think we can keep the default names, right?
>>> > > > >
>>> > > > > Rainer
>>> > > > > < Short term, my problem would be solved if the spaces
>>> > > > > > were replaced by an underscore.
>>> > > > > >
>>> > > > > > Off the top of my head I can think of a couple of ways to do
>>> this:
>>> > > > > >
>>> > > > > > 1 - simply change whatever routine is generating the names to
>>> produce
>>> > > > > > "action_1", etc.
>>> > > > > > 2 - add a property formatter that replaces spaces with
>>> underscores,
>>> > > that
>>> > > > > > could be used after passing this output to mmjsonparse.
>>> > > > > >
>>> > > > > > Thoughts?
>>> > > > > >
>>> > > > > > Brian
>>> > > > > > _______________________________________________
>>> > > > > > rsyslog mailing list
>>> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > > > http://www.rsyslog.com/professional-services/
>>> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > > > _______________________________________________
>>> > > > > rsyslog mailing list
>>> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > > http://www.rsyslog.com/professional-services/
>>> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > > >
>>> > > > _______________________________________________
>>> > > > rsyslog mailing list
>>> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > > http://www.rsyslog.com/professional-services/
>>> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > > _______________________________________________
>>> > > rsyslog mailing list
>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > http://www.rsyslog.com/professional-services/
>>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> > >
>>> > _______________________________________________
>>> > rsyslog mailing list
>>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > http://www.rsyslog.com/professional-services/
>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>
>>
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 4:39 AM

Post #10 of 13 (614 views)
Permalink
Re: action names [In reply to]

Aha! PStatSeverity instead of PStatsSeverity.

Thanks Rainer!

Brian

On Wed, May 2, 2012 at 7:23 AM, Brian Knox <briank [at] talksum> wrote:

> So I changed to this:
>
>
> $ModLoad immark # provides -MARK- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g.
> via logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
> $ModLoad impstats # impstats
>
> $PStatsInterval 2
> $PStatsSeverity 7
> $PStatJSON on
>
> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>
> if ($syslogfacility-text == 'authpriv') then {
> action(type="omfile" file="/var/log/secure" name="authpriv")
>
> }
> if ($syslogfacility-text == 'mail') then {
> action(type="omfile" file="/var/log/maillog" name="mail")
>
> }
>
> if ($syslogfacility-text == 'cron') then {
> action(type="omfile" file="/var/log/cron" name="cron")
>
> }
>
> if ($syslogpriority-text =='info') then {
> action(type="omfile" file="/var/log/messages" name="info")
>
> }
>
> if ($syslogfacility-text == 'local7') then {
> action(type="omfile" file="/var/log/boot.log" name="local7")
> }
>
> And this is working:
>
> 2012-05-02T07:22:31.236265-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"action 1","processed":184,"failed":0}
> 2012-05-02T07:22:31.236272-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"authpriv","processed":0,"failed":0}
> 2012-05-02T07:22:31.236278-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"mail","processed":0,"failed":0}
> 2012-05-02T07:22:31.236284-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"cron","processed":0,"failed":0}
> 2012-05-02T07:22:31.236289-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"info","processed":185,"failed":0}
> 2012-05-02T07:22:31.236295-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"local7","processed":0,"failed":0}
> 2012-05-02T07:22:31.236303-04:00 localhost rsyslogd-pstats: @cee:
> {"name":"main Q","size":7,"enqueued":193,"full":0,"discarded.full":0,"
> discarded.nf":0,"maxqsize":8}
>
> Although I've still got a bug somewhere in my conf:
>
>
> [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
> rsyslogd: version 6.3.8, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: invalid or yet-unknown config file command - have you forgotten
> to load a module? [try http://www.rsyslog.com/e/3003 ]
> rsyslogd: End of config validation run. Bye.
> [root [at] monet log]#
>
> Getting closer though :)
>
>
> On Wed, May 2, 2012 at 7:20 AM, Brian Knox <briank [at] talksum> wrote:
>
>> Aha! The problem seems to by my omfile action is not correct to begin
>> with. I'm basing the config off of this post:
>>
>> http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
>>
>> Here's what I'm trying:
>>
>> $ModLoad immark # provides -MARK- message capability
>> $ModLoad imuxsock # provides support for local system logging (e.g.
>> via logger command)
>> $ModLoad imklog # kernel logging (formerly provided by rklogd)
>> $ModLoad impstats # impstats
>>
>> $PStatsInterval 2
>> $PStatsSeverity 7
>> $PStatJSON on
>>
>> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>>
>> if ($syslogfacility-text == 'authpriv') then {
>> action(type="omfile" target="/var/log/secure")
>> }
>> if ($syslogfacility-text == 'mail') then {
>> action(type="omfile" target="/var/log/maillog")
>> }
>>
>> if ($syslogfacility-text == 'cron') then {
>> action(type="omfile" target="/var/log/cron")
>> }
>>
>> if ($syslogpriority-text =='info') then {
>> action(type="omfile" target="/var/log/messages")
>> }
>>
>> if ($syslogfacility-text == 'local7') then {
>> action(type="omfile" target="/var/log/boot.log")
>> }
>>
>> and I'm getting:
>>
>> [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
>> rsyslogd: version 6.3.8, config validation run (level 1), master config
>> /etc/rsyslog.conf
>> rsyslogd: invalid or yet-unknown config file command - have you forgotten
>> to load a module? [try http://www.rsyslog.com/e/3003 ]
>> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> [try http://www.rsyslog.com/e/2211 ]
>> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
>> rsyslogd: warning: selector line without actions will be discarded
>> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> [try http://www.rsyslog.com/e/2211 ]
>> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
>> rsyslogd: warning: selector line without actions will be discarded
>> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> [try http://www.rsyslog.com/e/2211 ]
>> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
>> rsyslogd: warning: selector line without actions will be discarded
>> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> [try http://www.rsyslog.com/e/2211 ]
>> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
>> rsyslogd: warning: selector line without actions will be discarded
>> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> [try http://www.rsyslog.com/e/2211 ]
>> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
>> rsyslogd: warning: selector line without actions will be discarded
>> rsyslogd: End of config validation run. Bye.
>>
>>
>>
>> On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:
>>
>>> It looks like maybe the ommongo output is accepting name and omfile may
>>> not be - I'll start a debug log and take a look after I get some coffee!
>>>
>>> Brian
>>>
>>>
>>> On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards <
>>> rgerhards [at] hq> wrote:
>>>
>>>>
>>>>
>>>> > -----Original Message-----
>>>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>>> > bounces [at] lists] On Behalf Of Brian Knox
>>>> > Sent: Wednesday, May 02, 2012 1:02 PM
>>>> > To: rsyslog-users
>>>> > Subject: Re: [rsyslog] action names
>>>> >
>>>> > Hmm just tried that and not seeing it take effect, let me poke at it
>>>> for a
>>>> > few.
>>>>
>>>> Maybe you hit a bug... have a look at the debug file when the action is
>>>> defined. It tells you which params it understood.
>>>>
>>>> Raienr
>>>> >
>>>> > Brian
>>>> >
>>>> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
>>>> > <rgerhards [at] hq>wrote:
>>>> >
>>>> > > > -----Original Message-----
>>>> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>>> > > > bounces [at] lists] On Behalf Of Brian Knox
>>>> > > > Sent: Wednesday, May 02, 2012 12:59 PM
>>>> > > > To: rsyslog-users
>>>> > > > Subject: Re: [rsyslog] action names
>>>> > > >
>>>> > > > Oh! I must have missed that in the docs!
>>>> > >
>>>> > > Np
>>>> > >
>>>> > > >
>>>> > > > Is this also settable via the new config 6 syntax?
>>>> > >
>>>> > > name="xxx"
>>>> > > Rainer
>>>> > > >
>>>> > > > Brian
>>>> > > >
>>>> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
>>>> > > > <rgerhards [at] hq>wrote:
>>>> > > >
>>>> > > > > > -----Original Message-----
>>>> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>>>> > > > > > bounces [at] lists] On Behalf Of Brian Knox
>>>> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
>>>> > > > > > To: rsyslog-users
>>>> > > > > > Subject: [rsyslog] action names
>>>> > > > > >
>>>> > > > > > I have an issue I'd like to solve concerning action names in
>>>> the
>>>> > > stats
>>>> > > > > > module. While I could solve it in a local fork, if it can be
>>>> solved
>>>> > > in
>>>> > > a
>>>> > > > > > way that would be useful to others and incorporated back into
>>>> rsyslog
>>>> > > > > > that's my preference.
>>>> > > > > >
>>>> > > > > > Here's some current output from a test configuration, with
>>>> JSON
>>>> > > impstats
>>>> > > > > > enabled:
>>>> > > > > >
>>>> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 1","processed":1696,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 2","processed":396,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 3","processed":1320,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 4","processed":1144,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 5","processed":1144,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 6","processed":68,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 7","processed":0,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 8","processed":26,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 9","processed":283,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 10","processed":0,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 11","processed":0,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 12","processed":520,"failed":0}
>>>> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
>>>> @cee:
>>>> > > > > > {"name":"action 12
>>>> > > > > >
>>>> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
>>>> discarded.nf
>>>> > > > > > ":0,"maxqsize":5}
>>>> > > > > >
>>>> > > > > > My issue is that action names have spaces in them. This makes
>>>> using
>>>> > > the
>>>> > > > > > action names as keys in some key value stores problematic.
>>>> > > Ultimately,
>>>> > > I
>>>> > > > > > would love to be able to pass a configuration option to each
>>>> action
>>>> > > > > > explicitly naming it.
>>>> > > > >
>>>> > > > > $ActionName ;)
>>>> > > > >
>>>> > > > > So I think we can keep the default names, right?
>>>> > > > >
>>>> > > > > Rainer
>>>> > > > > < Short term, my problem would be solved if the spaces
>>>> > > > > > were replaced by an underscore.
>>>> > > > > >
>>>> > > > > > Off the top of my head I can think of a couple of ways to do
>>>> this:
>>>> > > > > >
>>>> > > > > > 1 - simply change whatever routine is generating the names to
>>>> produce
>>>> > > > > > "action_1", etc.
>>>> > > > > > 2 - add a property formatter that replaces spaces with
>>>> underscores,
>>>> > > that
>>>> > > > > > could be used after passing this output to mmjsonparse.
>>>> > > > > >
>>>> > > > > > Thoughts?
>>>> > > > > >
>>>> > > > > > Brian
>>>> > > > > > _______________________________________________
>>>> > > > > > rsyslog mailing list
>>>> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> > > > > > http://www.rsyslog.com/professional-services/
>>>> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> > > > > _______________________________________________
>>>> > > > > rsyslog mailing list
>>>> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> > > > > http://www.rsyslog.com/professional-services/
>>>> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> > > > >
>>>> > > > _______________________________________________
>>>> > > > rsyslog mailing list
>>>> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> > > > http://www.rsyslog.com/professional-services/
>>>> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> > > _______________________________________________
>>>> > > rsyslog mailing list
>>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> > > http://www.rsyslog.com/professional-services/
>>>> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> > >
>>>> > _______________________________________________
>>>> > rsyslog mailing list
>>>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> > http://www.rsyslog.com/professional-services/
>>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>> _______________________________________________
>>>> rsyslog mailing list
>>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>>> http://www.rsyslog.com/professional-services/
>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>>>
>>>
>>>
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


rgerhards at hq

May 2, 2012, 5:26 AM

Post #11 of 13 (613 views)
Permalink
Re: action names [In reply to]

I'll have the sample changed. I think it actually was "target=" initially,
and I later changed it to "file=" in order to make dynafile config more
intuitive.

Rainer

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Brian Knox
> Sent: Wednesday, May 02, 2012 1:20 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] action names
>
> Aha! The problem seems to by my omfile action is not correct to begin
> with. I'm basing the config off of this post:
>
> http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
>
> Here's what I'm trying:
>
> $ModLoad immark # provides -MARK- message capability
> $ModLoad imuxsock # provides support for local system logging (e.g.
> via logger command)
> $ModLoad imklog # kernel logging (formerly provided by rklogd)
> $ModLoad impstats # impstats
>
> $PStatsInterval 2
> $PStatsSeverity 7
> $PStatJSON on
>
> if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>
> if ($syslogfacility-text == 'authpriv') then {
> action(type="omfile" target="/var/log/secure")
> }
> if ($syslogfacility-text == 'mail') then {
> action(type="omfile" target="/var/log/maillog")
> }
>
> if ($syslogfacility-text == 'cron') then {
> action(type="omfile" target="/var/log/cron")
> }
>
> if ($syslogpriority-text =='info') then {
> action(type="omfile" target="/var/log/messages")
> }
>
> if ($syslogfacility-text == 'local7') then {
> action(type="omfile" target="/var/log/boot.log")
> }
>
> and I'm getting:
>
> [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
> rsyslogd: version 6.3.8, config validation run (level 1), master config
> /etc/rsyslog.conf
> rsyslogd: invalid or yet-unknown config file command - have you forgotten
> to load a module? [try http://www.rsyslog.com/e/3003 ]
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> [try http://www.rsyslog.com/e/2211 ]
> rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
> rsyslogd: warning: selector line without actions will be discarded
> rsyslogd: End of config validation run. Bye.
>
>
> On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:
>
> > It looks like maybe the ommongo output is accepting name and omfile may
> > not be - I'll start a debug log and take a look after I get some coffee!
> >
> > Brian
> >
> >
> > On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards
> <rgerhards [at] hq>wrote:
> >
> >>
> >>
> >> > -----Original Message-----
> >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > bounces [at] lists] On Behalf Of Brian Knox
> >> > Sent: Wednesday, May 02, 2012 1:02 PM
> >> > To: rsyslog-users
> >> > Subject: Re: [rsyslog] action names
> >> >
> >> > Hmm just tried that and not seeing it take effect, let me poke at it
> >> for a
> >> > few.
> >>
> >> Maybe you hit a bug... have a look at the debug file when the action is
> >> defined. It tells you which params it understood.
> >>
> >> Raienr
> >> >
> >> > Brian
> >> >
> >> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
> >> > <rgerhards [at] hq>wrote:
> >> >
> >> > > > -----Original Message-----
> >> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > > bounces [at] lists] On Behalf Of Brian Knox
> >> > > > Sent: Wednesday, May 02, 2012 12:59 PM
> >> > > > To: rsyslog-users
> >> > > > Subject: Re: [rsyslog] action names
> >> > > >
> >> > > > Oh! I must have missed that in the docs!
> >> > >
> >> > > Np
> >> > >
> >> > > >
> >> > > > Is this also settable via the new config 6 syntax?
> >> > >
> >> > > name="xxx"
> >> > > Rainer
> >> > > >
> >> > > > Brian
> >> > > >
> >> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> >> > > > <rgerhards [at] hq>wrote:
> >> > > >
> >> > > > > > -----Original Message-----
> >> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> >> > > > > > bounces [at] lists] On Behalf Of Brian Knox
> >> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
> >> > > > > > To: rsyslog-users
> >> > > > > > Subject: [rsyslog] action names
> >> > > > > >
> >> > > > > > I have an issue I'd like to solve concerning action names in
the
> >> > > stats
> >> > > > > > module. While I could solve it in a local fork, if it can be
> >> solved
> >> > > in
> >> > > a
> >> > > > > > way that would be useful to others and incorporated back into
> >> rsyslog
> >> > > > > > that's my preference.
> >> > > > > >
> >> > > > > > Here's some current output from a test configuration, with
JSON
> >> > > impstats
> >> > > > > > enabled:
> >> > > > > >
> >> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 1","processed":1696,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 2","processed":396,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 3","processed":1320,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 4","processed":1144,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 5","processed":1144,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 6","processed":68,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 7","processed":0,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 8","processed":26,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 9","processed":283,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 10","processed":0,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 11","processed":0,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 12","processed":520,"failed":0}
> >> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
> >> @cee:
> >> > > > > > {"name":"action 12
> >> > > > > >
> >> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
> >> discarded.nf
> >> > > > > > ":0,"maxqsize":5}
> >> > > > > >
> >> > > > > > My issue is that action names have spaces in them. This makes
> >> using
> >> > > the
> >> > > > > > action names as keys in some key value stores problematic.
> >> > > Ultimately,
> >> > > I
> >> > > > > > would love to be able to pass a configuration option to each
> >> action
> >> > > > > > explicitly naming it.
> >> > > > >
> >> > > > > $ActionName ;)
> >> > > > >
> >> > > > > So I think we can keep the default names, right?
> >> > > > >
> >> > > > > Rainer
> >> > > > > < Short term, my problem would be solved if the spaces
> >> > > > > > were replaced by an underscore.
> >> > > > > >
> >> > > > > > Off the top of my head I can think of a couple of ways to do
> >> this:
> >> > > > > >
> >> > > > > > 1 - simply change whatever routine is generating the names to
> >> produce
> >> > > > > > "action_1", etc.
> >> > > > > > 2 - add a property formatter that replaces spaces with
> >> underscores,
> >> > > that
> >> > > > > > could be used after passing this output to mmjsonparse.
> >> > > > > >
> >> > > > > > Thoughts?
> >> > > > > >
> >> > > > > > Brian
> >> > > > > > _______________________________________________
> >> > > > > > rsyslog mailing list
> >> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > > > > http://www.rsyslog.com/professional-services/
> >> > > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > > > _______________________________________________
> >> > > > > rsyslog mailing list
> >> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > > > http://www.rsyslog.com/professional-services/
> >> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > > >
> >> > > > _______________________________________________
> >> > > > rsyslog mailing list
> >> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > > http://www.rsyslog.com/professional-services/
> >> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > > _______________________________________________
> >> > > rsyslog mailing list
> >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > > http://www.rsyslog.com/professional-services/
> >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> > >
> >> > _______________________________________________
> >> > rsyslog mailing list
> >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> > http://www.rsyslog.com/professional-services/
> >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> >> _______________________________________________
> >> rsyslog mailing list
> >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> >> http://www.rsyslog.com/professional-services/
> >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> >>
> >
> >
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 10:35 AM

Post #12 of 13 (605 views)
Permalink
Re: action names [In reply to]

So - action names are working wonderfully. My only problem at this point
is that the main queue has a set name that I can't find a way to change
(the name is "main Q"). Other queue names seem to inherit from their
action name (the queue for an action I named "mongo" is named "mongo[DA]",
etc).

Brian

On Wed, May 2, 2012 at 8:26 AM, Rainer Gerhards <rgerhards [at] hq>wrote:

> I'll have the sample changed. I think it actually was "target=" initially,
> and I later changed it to "file=" in order to make dynafile config more
> intuitive.
>
> Rainer
>
> > -----Original Message-----
> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > bounces [at] lists] On Behalf Of Brian Knox
> > Sent: Wednesday, May 02, 2012 1:20 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] action names
> >
> > Aha! The problem seems to by my omfile action is not correct to begin
> > with. I'm basing the config off of this post:
> >
> > http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
> >
> > Here's what I'm trying:
> >
> > $ModLoad immark # provides -MARK- message capability
> > $ModLoad imuxsock # provides support for local system logging (e.g.
> > via logger command)
> > $ModLoad imklog # kernel logging (formerly provided by rklogd)
> > $ModLoad impstats # impstats
> >
> > $PStatsInterval 2
> > $PStatsSeverity 7
> > $PStatJSON on
> >
> > if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
> >
> > if ($syslogfacility-text == 'authpriv') then {
> > action(type="omfile" target="/var/log/secure")
> > }
> > if ($syslogfacility-text == 'mail') then {
> > action(type="omfile" target="/var/log/maillog")
> > }
> >
> > if ($syslogfacility-text == 'cron') then {
> > action(type="omfile" target="/var/log/cron")
> > }
> >
> > if ($syslogpriority-text =='info') then {
> > action(type="omfile" target="/var/log/messages")
> > }
> >
> > if ($syslogfacility-text == 'local7') then {
> > action(type="omfile" target="/var/log/boot.log")
> > }
> >
> > and I'm getting:
> >
> > [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
> > rsyslogd: version 6.3.8, config validation run (level 1), master config
> > /etc/rsyslog.conf
> > rsyslogd: invalid or yet-unknown config file command - have you forgotten
> > to load a module? [try http://www.rsyslog.com/e/3003 ]
> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> > [try http://www.rsyslog.com/e/2211 ]
> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
> > rsyslogd: warning: selector line without actions will be discarded
> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> > [try http://www.rsyslog.com/e/2211 ]
> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
> > rsyslogd: warning: selector line without actions will be discarded
> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> > [try http://www.rsyslog.com/e/2211 ]
> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
> > rsyslogd: warning: selector line without actions will be discarded
> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> > [try http://www.rsyslog.com/e/2211 ]
> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
> > rsyslogd: warning: selector line without actions will be discarded
> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
> > [try http://www.rsyslog.com/e/2211 ]
> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
> > rsyslogd: warning: selector line without actions will be discarded
> > rsyslogd: End of config validation run. Bye.
> >
> >
> > On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:
> >
> > > It looks like maybe the ommongo output is accepting name and omfile may
> > > not be - I'll start a debug log and take a look after I get some
> coffee!
> > >
> > > Brian
> > >
> > >
> > > On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards
> > <rgerhards [at] hq>wrote:
> > >
> > >>
> > >>
> > >> > -----Original Message-----
> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > bounces [at] lists] On Behalf Of Brian Knox
> > >> > Sent: Wednesday, May 02, 2012 1:02 PM
> > >> > To: rsyslog-users
> > >> > Subject: Re: [rsyslog] action names
> > >> >
> > >> > Hmm just tried that and not seeing it take effect, let me poke at it
> > >> for a
> > >> > few.
> > >>
> > >> Maybe you hit a bug... have a look at the debug file when the action
> is
> > >> defined. It tells you which params it understood.
> > >>
> > >> Raienr
> > >> >
> > >> > Brian
> > >> >
> > >> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
> > >> > <rgerhards [at] hq>wrote:
> > >> >
> > >> > > > -----Original Message-----
> > >> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > > bounces [at] lists] On Behalf Of Brian Knox
> > >> > > > Sent: Wednesday, May 02, 2012 12:59 PM
> > >> > > > To: rsyslog-users
> > >> > > > Subject: Re: [rsyslog] action names
> > >> > > >
> > >> > > > Oh! I must have missed that in the docs!
> > >> > >
> > >> > > Np
> > >> > >
> > >> > > >
> > >> > > > Is this also settable via the new config 6 syntax?
> > >> > >
> > >> > > name="xxx"
> > >> > > Rainer
> > >> > > >
> > >> > > > Brian
> > >> > > >
> > >> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
> > >> > > > <rgerhards [at] hq>wrote:
> > >> > > >
> > >> > > > > > -----Original Message-----
> > >> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
> > >> > > > > > bounces [at] lists] On Behalf Of Brian Knox
> > >> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
> > >> > > > > > To: rsyslog-users
> > >> > > > > > Subject: [rsyslog] action names
> > >> > > > > >
> > >> > > > > > I have an issue I'd like to solve concerning action names in
> the
> > >> > > stats
> > >> > > > > > module. While I could solve it in a local fork, if it can
> be
> > >> solved
> > >> > > in
> > >> > > a
> > >> > > > > > way that would be useful to others and incorporated back
> into
> > >> rsyslog
> > >> > > > > > that's my preference.
> > >> > > > > >
> > >> > > > > > Here's some current output from a test configuration, with
> JSON
> > >> > > impstats
> > >> > > > > > enabled:
> > >> > > > > >
> > >> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 1","processed":1696,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 2","processed":396,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 3","processed":1320,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 4","processed":1144,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 5","processed":1144,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 6","processed":68,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 7","processed":0,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 8","processed":26,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 9","processed":283,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 10","processed":0,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 11","processed":0,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 12","processed":520,"failed":0}
> > >> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
> > >> @cee:
> > >> > > > > > {"name":"action 12
> > >> > > > > >
> > >> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
> > >> discarded.nf
> > >> > > > > > ":0,"maxqsize":5}
> > >> > > > > >
> > >> > > > > > My issue is that action names have spaces in them. This
> makes
> > >> using
> > >> > > the
> > >> > > > > > action names as keys in some key value stores problematic.
> > >> > > Ultimately,
> > >> > > I
> > >> > > > > > would love to be able to pass a configuration option to each
> > >> action
> > >> > > > > > explicitly naming it.
> > >> > > > >
> > >> > > > > $ActionName ;)
> > >> > > > >
> > >> > > > > So I think we can keep the default names, right?
> > >> > > > >
> > >> > > > > Rainer
> > >> > > > > < Short term, my problem would be solved if the spaces
> > >> > > > > > were replaced by an underscore.
> > >> > > > > >
> > >> > > > > > Off the top of my head I can think of a couple of ways to do
> > >> this:
> > >> > > > > >
> > >> > > > > > 1 - simply change whatever routine is generating the names
> to
> > >> produce
> > >> > > > > > "action_1", etc.
> > >> > > > > > 2 - add a property formatter that replaces spaces with
> > >> underscores,
> > >> > > that
> > >> > > > > > could be used after passing this output to mmjsonparse.
> > >> > > > > >
> > >> > > > > > Thoughts?
> > >> > > > > >
> > >> > > > > > Brian
> > >> > > > > > _______________________________________________
> > >> > > > > > rsyslog mailing list
> > >> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > > > > http://www.rsyslog.com/professional-services/
> > >> > > > > > What's up with rsyslog? Follow
> https://twitter.com/rgerhards
> > >> > > > > _______________________________________________
> > >> > > > > rsyslog mailing list
> > >> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > > > http://www.rsyslog.com/professional-services/
> > >> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > > >
> > >> > > > _______________________________________________
> > >> > > > rsyslog mailing list
> > >> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > > http://www.rsyslog.com/professional-services/
> > >> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > > _______________________________________________
> > >> > > rsyslog mailing list
> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > > http://www.rsyslog.com/professional-services/
> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> > >
> > >> > _______________________________________________
> > >> > rsyslog mailing list
> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> > http://www.rsyslog.com/professional-services/
> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >> _______________________________________________
> > >> rsyslog mailing list
> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >> http://www.rsyslog.com/professional-services/
> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >>
> > >
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards


briank at talksum

May 2, 2012, 10:56 AM

Post #13 of 13 (610 views)
Permalink
Re: action names [In reply to]

Found it and changed it locally (from "main Q" to mainQ) in the source for
now.

Brian

On Wed, May 2, 2012 at 1:35 PM, Brian Knox <briank [at] talksum> wrote:

> So - action names are working wonderfully. My only problem at this point
> is that the main queue has a set name that I can't find a way to change
> (the name is "main Q"). Other queue names seem to inherit from their
> action name (the queue for an action I named "mongo" is named "mongo[DA]",
> etc).
>
> Brian
>
>
> On Wed, May 2, 2012 at 8:26 AM, Rainer Gerhards <rgerhards [at] hq>wrote:
>
>> I'll have the sample changed. I think it actually was "target=" initially,
>> and I later changed it to "file=" in order to make dynafile config more
>> intuitive.
>>
>> Rainer
>>
>> > -----Original Message-----
>> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > bounces [at] lists] On Behalf Of Brian Knox
>> > Sent: Wednesday, May 02, 2012 1:20 PM
>> > To: rsyslog-users
>> > Subject: Re: [rsyslog] action names
>> >
>> > Aha! The problem seems to by my omfile action is not correct to begin
>> > with. I'm basing the config off of this post:
>> >
>> > http://www.rsyslog.com/rsyslog-6-3-3-config-format-improvements-2/
>> >
>> > Here's what I'm trying:
>> >
>> > $ModLoad immark # provides -MARK- message capability
>> > $ModLoad imuxsock # provides support for local system logging
>> (e.g.
>> > via logger command)
>> > $ModLoad imklog # kernel logging (formerly provided by rklogd)
>> > $ModLoad impstats # impstats
>> >
>> > $PStatsInterval 2
>> > $PStatsSeverity 7
>> > $PStatJSON on
>> >
>> > if ($programname == 'rsyslogd-pstats') then /var/log/rsyslog_stats.log
>> >
>> > if ($syslogfacility-text == 'authpriv') then {
>> > action(type="omfile" target="/var/log/secure")
>> > }
>> > if ($syslogfacility-text == 'mail') then {
>> > action(type="omfile" target="/var/log/maillog")
>> > }
>> >
>> > if ($syslogfacility-text == 'cron') then {
>> > action(type="omfile" target="/var/log/cron")
>> > }
>> >
>> > if ($syslogpriority-text =='info') then {
>> > action(type="omfile" target="/var/log/messages")
>> > }
>> >
>> > if ($syslogfacility-text == 'local7') then {
>> > action(type="omfile" target="/var/log/boot.log")
>> > }
>> >
>> > and I'm getting:
>> >
>> > [root [at] monet log]# rsyslogd -N1 -c6 -f /etc/rsyslog.conf
>> > rsyslogd: version 6.3.8, config validation run (level 1), master config
>> > /etc/rsyslog.conf
>> > rsyslogd: invalid or yet-unknown config file command - have you
>> forgotten
>> > to load a module? [try http://www.rsyslog.com/e/3003 ]
>> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> > [try http://www.rsyslog.com/e/2211 ]
>> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 13
>> > rsyslogd: warning: selector line without actions will be discarded
>> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> > [try http://www.rsyslog.com/e/2211 ]
>> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 16
>> > rsyslogd: warning: selector line without actions will be discarded
>> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> > [try http://www.rsyslog.com/e/2211 ]
>> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 20
>> > rsyslogd: warning: selector line without actions will be discarded
>> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> > [try http://www.rsyslog.com/e/2211 ]
>> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 24
>> > rsyslogd: warning: selector line without actions will be discarded
>> > rsyslogd: omfile: either the "file" or "dynfile" parameter must be given
>> > [try http://www.rsyslog.com/e/2211 ]
>> > rsyslogd: errors occured in file '/etc/rsyslog.conf' around line 28
>> > rsyslogd: warning: selector line without actions will be discarded
>> > rsyslogd: End of config validation run. Bye.
>> >
>> >
>> > On Wed, May 2, 2012 at 7:14 AM, Brian Knox <briank [at] talksum> wrote:
>> >
>> > > It looks like maybe the ommongo output is accepting name and omfile
>> may
>> > > not be - I'll start a debug log and take a look after I get some
>> coffee!
>> > >
>> > > Brian
>> > >
>> > >
>> > > On Wed, May 2, 2012 at 7:02 AM, Rainer Gerhards
>> > <rgerhards [at] hq>wrote:
>> > >
>> > >>
>> > >>
>> > >> > -----Original Message-----
>> > >> > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > >> > bounces [at] lists] On Behalf Of Brian Knox
>> > >> > Sent: Wednesday, May 02, 2012 1:02 PM
>> > >> > To: rsyslog-users
>> > >> > Subject: Re: [rsyslog] action names
>> > >> >
>> > >> > Hmm just tried that and not seeing it take effect, let me poke at
>> it
>> > >> for a
>> > >> > few.
>> > >>
>> > >> Maybe you hit a bug... have a look at the debug file when the action
>> is
>> > >> defined. It tells you which params it understood.
>> > >>
>> > >> Raienr
>> > >> >
>> > >> > Brian
>> > >> >
>> > >> > On Wed, May 2, 2012 at 7:00 AM, Rainer Gerhards
>> > >> > <rgerhards [at] hq>wrote:
>> > >> >
>> > >> > > > -----Original Message-----
>> > >> > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > >> > > > bounces [at] lists] On Behalf Of Brian Knox
>> > >> > > > Sent: Wednesday, May 02, 2012 12:59 PM
>> > >> > > > To: rsyslog-users
>> > >> > > > Subject: Re: [rsyslog] action names
>> > >> > > >
>> > >> > > > Oh! I must have missed that in the docs!
>> > >> > >
>> > >> > > Np
>> > >> > >
>> > >> > > >
>> > >> > > > Is this also settable via the new config 6 syntax?
>> > >> > >
>> > >> > > name="xxx"
>> > >> > > Rainer
>> > >> > > >
>> > >> > > > Brian
>> > >> > > >
>> > >> > > > On Wed, May 2, 2012 at 6:55 AM, Rainer Gerhards
>> > >> > > > <rgerhards [at] hq>wrote:
>> > >> > > >
>> > >> > > > > > -----Original Message-----
>> > >> > > > > > From: rsyslog-bounces [at] lists [mailto:rsyslog-
>> > >> > > > > > bounces [at] lists] On Behalf Of Brian Knox
>> > >> > > > > > Sent: Wednesday, May 02, 2012 12:20 PM
>> > >> > > > > > To: rsyslog-users
>> > >> > > > > > Subject: [rsyslog] action names
>> > >> > > > > >
>> > >> > > > > > I have an issue I'd like to solve concerning action names
>> in
>> the
>> > >> > > stats
>> > >> > > > > > module. While I could solve it in a local fork, if it can
>> be
>> > >> solved
>> > >> > > in
>> > >> > > a
>> > >> > > > > > way that would be useful to others and incorporated back
>> into
>> > >> rsyslog
>> > >> > > > > > that's my preference.
>> > >> > > > > >
>> > >> > > > > > Here's some current output from a test configuration, with
>> JSON
>> > >> > > impstats
>> > >> > > > > > enabled:
>> > >> > > > > >
>> > >> > > > > > 2012-05-02T05:55:15.345697-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 1","processed":1696,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345701-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 2","processed":396,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345704-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 3","processed":1320,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345707-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 4","processed":1144,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345709-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 5","processed":1144,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345711-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 6","processed":68,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345714-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 7","processed":0,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345716-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 8","processed":26,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345718-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 9","processed":283,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345721-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 10","processed":0,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345723-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 11","processed":0,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345726-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 12","processed":520,"failed":0}
>> > >> > > > > > 2012-05-02T05:55:15.345730-04:00 localhost rsyslogd-pstats:
>> > >> @cee:
>> > >> > > > > > {"name":"action 12
>> > >> > > > > >
>> > >> > > queue","size":0,"enqueued":520,"full":0,"discarded.full":0,"
>> > >> discarded.nf
>> > >> > > > > > ":0,"maxqsize":5}
>> > >> > > > > >
>> > >> > > > > > My issue is that action names have spaces in them. This
>> makes
>> > >> using
>> > >> > > the
>> > >> > > > > > action names as keys in some key value stores problematic.
>> > >> > > Ultimately,
>> > >> > > I
>> > >> > > > > > would love to be able to pass a configuration option to
>> each
>> > >> action
>> > >> > > > > > explicitly naming it.
>> > >> > > > >
>> > >> > > > > $ActionName ;)
>> > >> > > > >
>> > >> > > > > So I think we can keep the default names, right?
>> > >> > > > >
>> > >> > > > > Rainer
>> > >> > > > > < Short term, my problem would be solved if the spaces
>> > >> > > > > > were replaced by an underscore.
>> > >> > > > > >
>> > >> > > > > > Off the top of my head I can think of a couple of ways to
>> do
>> > >> this:
>> > >> > > > > >
>> > >> > > > > > 1 - simply change whatever routine is generating the names
>> to
>> > >> produce
>> > >> > > > > > "action_1", etc.
>> > >> > > > > > 2 - add a property formatter that replaces spaces with
>> > >> underscores,
>> > >> > > that
>> > >> > > > > > could be used after passing this output to mmjsonparse.
>> > >> > > > > >
>> > >> > > > > > Thoughts?
>> > >> > > > > >
>> > >> > > > > > Brian
>> > >> > > > > > _______________________________________________
>> > >> > > > > > rsyslog mailing list
>> > >> > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> > > > > > http://www.rsyslog.com/professional-services/
>> > >> > > > > > What's up with rsyslog? Follow
>> https://twitter.com/rgerhards
>> > >> > > > > _______________________________________________
>> > >> > > > > rsyslog mailing list
>> > >> > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> > > > > http://www.rsyslog.com/professional-services/
>> > >> > > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >> > > > >
>> > >> > > > _______________________________________________
>> > >> > > > rsyslog mailing list
>> > >> > > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> > > > http://www.rsyslog.com/professional-services/
>> > >> > > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >> > > _______________________________________________
>> > >> > > rsyslog mailing list
>> > >> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> > > http://www.rsyslog.com/professional-services/
>> > >> > > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >> > >
>> > >> > _______________________________________________
>> > >> > rsyslog mailing list
>> > >> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> > http://www.rsyslog.com/professional-services/
>> > >> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >> _______________________________________________
>> > >> rsyslog mailing list
>> > >> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > >> http://www.rsyslog.com/professional-services/
>> > >> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> > >>
>> > >
>> > >
>> > _______________________________________________
>> > rsyslog mailing list
>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>> > http://www.rsyslog.com/professional-services/
>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>
>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

RSyslog users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.