AnswerBun.com

rainerscript: how to log to file named $programname substring?

Unix & Linux Asked on December 6, 2020

How can I write a rainerscript rule to log to a file whose name is a substring of $programname?

I want something along the lines of this pseudo-rule:

if $programname startswith "foo" then /path/to/<substring of $programname from 4 to end>

Also: is there a way to strip the "foo" prefix from $programname in the text that gets written to file?

One Answer

Actually I'm feeling unhelpful with my comment to the OP. I did some more testing and here's a solid answer that I'd like to share:

Create /etc/rsyslog.d/00-local.conf with the following:

template(name="AdminLog" type="string" string="/var/log/admin_%syslogtag:R,ERE,1,ZERO::(.*):--end%")

if ($programname == "admin") then {
  action(type="omfile" dynaFile="AdminLog")
  stop
}

systemctl restart rsyslog
logger -t admin:backup starting

That results in /var/log/admin_backup getting the log.

Notes:

  • I'm running Ubunto 20.04. Platform/version-specific nuances may affect your results.
  • All changes and commands have been done under sudo -s.
  • The template doesn't need to use a Regexp. The '%property:Field' notation would be more efficient. This is to demonstrate how to use the more complex Regexp. See syntax for both property replacer operations.
  • See at the end of the %syslogtag that a colon is appended and needs to be accommodated in parsing.
  • Use the very helpful regular expression test page for Rsyslog.
  • Creating new files in a folder other than /var/log presents known complications and is outside the scope of the OP request. Get this working for files in /var/log and then take on the challenge separately to get it to work with a different folder.
  • Note the action uses the dynaFile option.
  • This could also be done by putting the result of the template into a variable with exec_template and then manipulating it further. Here is an example page.
  • Rather than using a template, another way to do a regexp with Rainerscript is to use the re_extract function. Example:
    set $.thefunction = re_extract($syslogtag,...)

Answered by TonyG on December 6, 2020

Add your own answers!

Related Questions

Sorting by date with format dd-Mmm-yyyy from specific file

3  Asked on January 29, 2021 by jugarugabi

   

Why do Unix/Linux systems still need to depend on Microsoft?

1  Asked on January 29, 2021 by ray-butterworth

     

Pass Key value as Paramenter

0  Asked on January 29, 2021 by sivaguru

   

Apache vhost local request

2  Asked on January 29, 2021 by rumburak

   

Firejail/Network namespaces without sudo

0  Asked on January 28, 2021 by user27221

 

SSH Port Forwarding Using a Jump Host

1  Asked on January 27, 2021 by mike-slinn

   

include dot files (.x) with rsync -r command

3  Asked on January 25, 2021 by alexander-mills

       

can’t change some nfs options

0  Asked on January 25, 2021 by caduceus

       

User-based GPU priority

1  Asked on January 25, 2021

     

print lines as columns two by two

3  Asked on January 24, 2021 by djabri-josef

   

Ask a Question

Get help from others!

© 2022 AnswerBun.com. All rights reserved. Sites we Love: PCI Database, MenuIva, UKBizDB, Menu Kuliner, Sharing RPP, SolveDir