MonitorWare Knowledge Base

OK, this has to be super easy, but I am just not seeing it:

Why doesn't this selector work right?
*.*;local2.warning;local3,local4,local5.none |/var/log/syslog;debug

To me, this should mean:
log everything, but only warning and above on local2, and nothing from local3,4,5
What I don't get is: the local3,4,5.none part is working, but I am still getting local2.notice messages:
local2.notice<149>: <149>cfengine:fms01[27156]: Cannot access file/directory /conf/foo.conf

here is the test1 template (made for debug)
$template debug,"%PRI-text%: %rawmsg%\n"

What am I doing wrong here? I know there's probably a more complex way, but I was hoping to keep it simple with just a selector line.

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

What actually are local2,3,4,5 are here.
If you want to get only logs that are warninig and more, I suggest you to use their priority and facility in place of *.*

Prakash.

prakash.akumalla wrote:What actually are local2,3,4,5 are here.
If you want to get only logs that are warninig and more, I suggest you to use their priority and facility in place of *.*

Prakash.

Sorry, I don't really understand your answer. Perhaps you misunderstood what I am trying to do:
I thought the local2.warning would "override" the *.* and exclude everything below warning on local2. This is clearly not working as I thought.

"Multiple selectors may be specified for a single action using the semicolon (";'') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern."

Hi,

What I mean to say is that for every type of the log message there will be certain priority and facility. yo can just know the priority of a warning message and use that in place of *.* For the values of priority and facility refer the documentation.

Regards,
Prakash.

What about ...

*.*,local2.warning,local3.none,local4.none,local5.none -/var/log/syslog;debug

no, i dont think so, dude. that syntax is all wrong.

Oddly, this seems to work:
local2.warning |/var/log/syslog;debug
*.*;local2,local3,local4,local5.none |/var/log/syslog;debug

which makes sense, but but i'm still scratching my head wondering why this selector doesn't:
*.*;local2.warning;local3,local4,local5.none |/var/log/syslog;debug
by all logic it should.