$UDPServerRun <port> (imudp) -- former
-r<port> option, default 514, start UDP server on this
@@ -302,18 +325,29 @@ template:
DynFile,"/var/log/system-%HOSTNAME%.log"
This template can then be used when defining an output
selector line. It will result in something like
-"/var/log/system-localhost.log"
Template
+"/var/log/system-localhost.log"
+Template
names beginning with "RSYSLOG_" are reserved for rsyslog use. Do NOT
use them if, otherwise you may receive a conflict in the future (and
quite unpredictable behaviour). There is a small set of pre-defined
-templates that you can use without the need to define it:
- RSYSLOG_TraditionalFileFormat - the "old style" default log file format with low-precision timestamps
- RSYSLOG_FileFormat - a modern-style logfile format similar to TraditionalFileFormat, buth with high-precision timestamps and timezone information
- RSYSLOG_TraditionalForwardFormat
+templates that you can use without the need to define it:
+
+- RSYSLOG_TraditionalFileFormat
+- the "old style" default log file format with low-precision timestamps
+- RSYSLOG_FileFormat
+- a modern-style logfile format similar to TraditionalFileFormat, buth
+with high-precision timestamps and timezone information
+- RSYSLOG_TraditionalForwardFormat
- the traditional forwarding format with low-precision timestamps. Most
-useful if you send messages to other syslogd's or rsyslogd below
-version 3.12.5.
- RSYSLOG_ForwardFormat
+useful if you send messages to other syslogd's or rsyslogd
+below
+version 3.12.5.
+- RSYSLOG_ForwardFormat
- a new high-precision forwarding format very similar to the
traditional one, but with high-precision timestamps and timezone
information. Recommended to be used when sending messages to rsyslog
-3.12.5 or above.
- RSYSLOG_SyslogProtocol23Format
+3.12.5 or above.
+- RSYSLOG_SyslogProtocol23Format
- the format specified in IETF's internet-draft
ietf-syslog-protocol-23, which is assumed to be come the new syslog
standard RFC. This format includes several improvements. The rsyslog
@@ -321,7 +355,8 @@ message parser understands this format, so you can use it together with
all relatively recent versions of rsyslog. Other syslogd's may get
hopelessly confused if receiving that format, so check before you use
it. Note that the format is unlikely to change when the final RFC comes
-out, but this may happen.
+out, but this may happen.
+
Output Channels
Output Channels are a new concept first introduced in rsyslog
0.9.0. As of this writing, it is most likely that they will
@@ -524,7 +559,8 @@ once they are implemented, it can make very much sense
regex |
-Compares the property against the provided POSIX regular
+ | Compares the property against the provided POSIX
+regular
expression. |
@@ -567,10 +603,12 @@ code), this can be done easily by:
"ID-4711". Please note that the comparison is case-sensitive, so it
would not match if "id-4711" would be contained in the message.
:msg, regex, "fatal .* error"
-This filter uses a POSIX regular expression. It matches when the
+
This filter uses a POSIX regular expression. It matches when
+the
string contains the words "fatal" and "error" with anything in between
(e.g. "fatal net error" and "fatal lib error" but not "fatal error" as
-two spaces are required by the regular expression!).
Getting property-based filters right can sometimes be
+two spaces are required by the regular expression!).
+Getting property-based filters right can sometimes be
challenging. In order to help you do it with as minimal effort as
possible, rsyslogd spits out debug information for all property-based
filters during their evaluation. To enable this, run rsyslogd in
@@ -635,9 +673,12 @@ startswith 'DEVNAME' and not
($msg contains 'error1' or $msg contains
'error0') then /var/log/somelog
-
If you would like to do case-insensitive comparisons, use
+
+If you would like to do case-insensitive comparisons, use
"contains_i" instead of "contains" and "startswith_i" instead of
-"startswith".
Note that regular expressions are currently NOT
+"startswith".
+
+Note that regular expressions are currently NOT
supported in expression-based filters. These will be added later when
function support is added to the expression engine (the reason is that
regular expressions will be a separate loadable module, which requires
diff --git a/syslogd.c b/syslogd.c
index 778fd713..b56c2f39 100644
--- a/syslogd.c
+++ b/syslogd.c
@@ -301,6 +301,7 @@ static uchar cCCEscapeChar = '\\';/* character to be used to start an escape seq
static int bEscapeCCOnRcv = 1; /* escape control characters on reception: 0 - no, 1 - yes */
int bReduceRepeatMsgs; /* reduce repeated message - 0 - no, 1 - yes */
int bActExecWhenPrevSusp; /* execute action only when previous one was suspended? */
+int iActExecOnceInterval = 0; /* execute action once every nn seconds */
uchar *pszWorkDir = NULL;/* name of rsyslog's spool directory (without trailing slash) */
uchar *glblModPath = NULL; /* module load path - only used during initial init, only settable via -M command line option */
/* end global config file state variables */
@@ -379,6 +380,7 @@ static rsRetVal resetConfigVariables(uchar __attribute__((unused)) *pp, void __a
{
cCCEscapeChar = '#';
bActExecWhenPrevSusp = 0;
+ iActExecOnceInterval = 0;
bDebugPrintTemplateList = 1;
bDebugPrintCfSysLineHandlerList = 1;
bDebugPrintModuleList = 1;
@@ -2692,6 +2694,7 @@ static rsRetVal loadBuildInModules(void)
CHKiRet(regCfSysLineHdlr((uchar *)"mainmsgqueuedequeuetimeend", 0, eCmdHdlrInt, NULL, &iMainMsgQueueDeqtWinToHr, NULL));
CHKiRet(regCfSysLineHdlr((uchar *)"repeatedmsgreduction", 0, eCmdHdlrBinary, NULL, &bReduceRepeatMsgs, NULL));
CHKiRet(regCfSysLineHdlr((uchar *)"actionexeconlywhenpreviousissuspended", 0, eCmdHdlrBinary, NULL, &bActExecWhenPrevSusp, NULL));
+ CHKiRet(regCfSysLineHdlr((uchar *)"actionexeconlyonceeveryinterval", 0, eCmdHdlrInt, NULL, &iActExecOnceInterval, NULL));
CHKiRet(regCfSysLineHdlr((uchar *)"actionresumeinterval", 0, eCmdHdlrInt, setActionResumeInterval, NULL, NULL));
CHKiRet(regCfSysLineHdlr((uchar *)"controlcharacterescapeprefix", 0, eCmdHdlrGetChar, NULL, &cCCEscapeChar, NULL));
CHKiRet(regCfSysLineHdlr((uchar *)"escapecontrolcharactersonreceive", 0, eCmdHdlrBinary, NULL, &bEscapeCCOnRcv, NULL));
diff --git a/syslogd.h b/syslogd.h
index 4eefd325..cbb4bb05 100644
--- a/syslogd.h
+++ b/syslogd.h
@@ -149,6 +149,7 @@ extern char ctty[];
extern int MarkInterval;
extern int bReduceRepeatMsgs;
extern int bActExecWhenPrevSusp;
+extern int iActExecOnceInterval;
/* Intervals at which we flush out "message repeated" messages,
* in seconds after previous message is logged. After each flush,
--
cgit v1.2.3