MonitorWare Knowledge Base

Hello:

I have a log file that I need to split in two. I am using the imfile module and templates in my rsyslog.conf. I unrdestand about using conditional testing on the msg part. Here is my example of rsyslog.conf:

$InputFileName /home/msglog.0
$InputFileTag msglog;
$InputFileStateFile msglog_state
$InputFileSeverity info
$InsputFileFacility local0
$InputRunFileMonitor

$template Testlog ,"%msg%"

if $systemfacility-text="local0" and not( $msg contains '*+*+*') then /var/log/testlog.1;Testlog.
Of course this would log anything but the string '*+*+*' to my /var/log/testlog.1 file

Basically, I would like to send the part of the msglog.0 until string "*+*+*" is encountered to a file name with a different name and then send the remainder to the testolog.1. How can I do this? I found no way of setting a flag or some sort of local variable with in rsyslog. thanks for any help

Alex

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?