[syslog-ng] separe files question

[Mártha Csaba]

Hello

Sorry, i think local0.


Mártha Csaba


On 2008.10.01., at 10:05, Geller, Sandor (IT) wrote:

> Hello,
>
>> Hello
>>
>> I have a question, i get logfiles from facility0, with these matter:
>
> facility0, really? facility 0 is the kernel.
>
>> AppID(0-9a-Z)-ThreadID(0-9a-Z)-DATE-TIME-MESSAGE
>
> This format won't get parsed the way you're expecting. Syslog isn't
> about feeding random data to the syslog daemon and expect the daemon
> to read your mind about what you want to achieve.
>
>> i created  a filter, with this content:
>> filter f_flash_msg { match ("[0-9a-zA-Z]+-[0-9a-zA-Z]-*"); };
>
> This filter doesn't do capturing. You should look after regexps,
> especially about how to use parentheses.
>
> For example "([0-9a-zA-Z]+)-([0-9a-zA-Z]+)-" does capturing.
>
>> and destination
>> destination df_out {
>> file("/var/log/client/flashlog/$1/$2/$YEAR/$MONTH/
>> $DAY/$TIME.txt"); };
>
> As your regexp doesn't do clustering $1 $2 ... are uninitialised. And
> $YEAR $MONTH etc. contain the timestamp of the log - not the DATE-TIME
> part of the line you showed.
>
>> i need separate folders/files.
>>
>> the log line contains these datas:
>>
>> 1234-ABCD-2008-09-30-16-20-35-FatalError
>> AppID-Thread-Date-Time-MSG
>
> I recommend to experiment a little with regexps. For example use sed
> (although a lot of escaping is needed in sed for extended regexps).
> When the sed expression works as you want then it is easy to transform
> it into a regexp usable in syslog-ng.
>
> For example capturing the first 4 fields of you log you should use  
> this
> sed command (note the ^ anchor):
> sed 's/^\([0-9a-zA-Z]\+\)-\([0-9a-zA-Z]\+\)-\([0-9]\{4\}\)-\ 
> ([0-9]\{2\}\)-/\1 \2 \3 \4 /'
>
> The regexp usable in syslog-ng would be:
> "^([0-9a-zA-Z]+)-([0-9a-zA-Z]+)-([0-9]{4})-([0-9]{2})"
> and $1 $2 $3 $4 contain the data, so the destination filename would be
> "/var/log/syslog-ng/flashlogs/${1}/${2}/${3}/{4}"
>
>> i need this structure:
>>
>> /var/log/syslog-ng/flashlogs/1234/ABCD/2008/09/30/16.txt
>>
>> what is my mistake?
>
> See above.
>
> hth,
>
> Sandor
> --------------------------------------------------------
>
> NOTICE: If received in error, please destroy and notify sender.  
> Sender does not intend to waive confidentiality or privilege. Use of  
> this email is prohibited when received in error.
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>