TransWikia.com

rainerscript: how to log to file named $programname substring?

Unix & Linux Asked on December 6, 2020

How can I write a rainerscript rule to log to a file whose name is a substring of $programname?

I want something along the lines of this pseudo-rule:

if $programname startswith "foo" then /path/to/<substring of $programname from 4 to end>

Also: is there a way to strip the "foo" prefix from $programname in the text that gets written to file?

One Answer

Actually I'm feeling unhelpful with my comment to the OP. I did some more testing and here's a solid answer that I'd like to share:

Create /etc/rsyslog.d/00-local.conf with the following:

template(name="AdminLog" type="string" string="/var/log/admin_%syslogtag:R,ERE,1,ZERO::(.*):--end%")

if ($programname == "admin") then {
  action(type="omfile" dynaFile="AdminLog")
  stop
}

systemctl restart rsyslog
logger -t admin:backup starting

That results in /var/log/admin_backup getting the log.

Notes:

  • I'm running Ubunto 20.04. Platform/version-specific nuances may affect your results.
  • All changes and commands have been done under sudo -s.
  • The template doesn't need to use a Regexp. The '%property:Field' notation would be more efficient. This is to demonstrate how to use the more complex Regexp. See syntax for both property replacer operations.
  • See at the end of the %syslogtag that a colon is appended and needs to be accommodated in parsing.
  • Use the very helpful regular expression test page for Rsyslog.
  • Creating new files in a folder other than /var/log presents known complications and is outside the scope of the OP request. Get this working for files in /var/log and then take on the challenge separately to get it to work with a different folder.
  • Note the action uses the dynaFile option.
  • This could also be done by putting the result of the template into a variable with exec_template and then manipulating it further. Here is an example page.
  • Rather than using a template, another way to do a regexp with Rainerscript is to use the re_extract function. Example:
    set $.thefunction = re_extract($syslogtag,...)

Answered by TonyG on December 6, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP