MonitorWare Knowledge Base

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

[root@logger log]# less /etc/rsyslog.conf
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
$template dbFormat,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%,%timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339
%,%timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%,%syslogtag%%msg%\n"
$template sqlFormat,"insert into SystemEvents (Message, Facility,FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, Sys
LogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%',%syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysq
l%', %iut%, '%syslogtag%')",sql

$ModLoad MySQL
*.* >127.0.0.1,rsyslog,rsysloguser,rsyslog;sqlFormat

$template DynaFile,"/var/log/system-%HOSTNAME%.log"
# *.* -?DynaFile

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
# *.info;mail.none;authpriv.none;cron.none /var/log/messages;dbFormat
*.info;mail.none;authpriv.none;cron.none -?DynaFile;dbFormat

# The authpriv file has restricted access.
authpriv.* /var/log/secure

# Log all the mail messages in one place.
mail.* -/var/log/maillog


# Log cron stuff
cron.* /var/log/cron

# Everybody gets emergency messages
*.emerg *

# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler

# Save boot messages also to boot.log
local7.* /var/log/boot.l

logger,2007-12-26,20:05:03,2007-12-26,20:05:03,5,3,rsyslogd:select
logger,2007-12-26,20:23:03,2007-12-26,20:23:03,5,3,rsyslogd:select
logger,2007-12-26,20:59:04,2007-12-26,20:59:04,5,3,rsyslogd:select
logger,2007-12-26,22:24:34,2007-12-26,22:24:34,5,3,rsyslogd:select
logger,2007-12-26,22:26:34,2007-12-26,22:26:34,5,3,rsyslogd:select
logger,2007-12-26,22:43:34,2007-12-26,22:43:34,5,3,rsyslogd:select
logger,2007-12-26,23:11:34,2007-12-26,23:11:34,5,3,rsyslogd:select
logger,2007-12-27,00:07:34,2007-12-27,00:07:34,5,3,rsyslogd:select
logger,2007-12-27,00:43:34,2007-12-27,00:43:34,5,3,rsyslogd:select
logger,2007-12-27,01:22:04,2007-12-27,01:22:04,5,3,rsyslogd:select
logger,2007-12-27,02:27:05,2007-12-27,02:27:05,5,3,rsyslogd:select
logger,2007-12-27,03:06:05,2007-12-27,03:06:05,0,6,rsyslogd:-- MARK --
logger,2007-12-27,04:02:18,2007-12-27,04:02:18,5,6,rsyslogd: [origin software="rsyslogd" swVersion="1.21.0" x-pid="1574"][x-configIn
fo udpReception="Yes" udpPort="514" tcpReception="No" tcpPort="0"] restart
logger,2007-12-27,04:03:35,2007-12-27,04:03:35,5,3,rsyslogd:select
logger,2007-12-27,04:26:35,2007-12-27,04:26:35,5,3,rsyslogd:select
logger,2007-12-27,04:53:05,2007-12-27,04:53:05,5,3,rsyslogd:select
logger,2007-12-27,05:36:35,2007-12-27,05:36:35,5,3,rsyslogd:select
logger,2007-12-27,05:51:35,2007-12-27,05:51:35,5,3,rsyslogd:select
logger,2007-12-27,06:34:05,2007-12-27,06:34:05,5,3,rsyslogd:select
logger,2007-12-27,06:41:35,2007-12-27,06:41:35,5,3,rsyslogd:select
logger,2007-12-27,06:44:05,2007-12-27,06:44:05,5,3,rsyslogd:select
logger,2007-12-27,07:19:05,2007-12-27,07:19:05,5,3,rsyslogd:select
logger,2007-12-27,07:35:05,2007-12-27,07:35:05,5,3,rsyslogd:select
logger,2007-12-27,07:42:05,2007-12-27,07:42:05,5,3,rsyslogd:select
logger,2007-12-27,07:47:35,2007-12-27,07:47:35,5,3,rsyslogd:select
logger,2007-12-27,08:04:35,2007-12-27,08:04:35,5,3,rsyslogd:select