MonitorWare Knowledge Base

On my main box, I'm running 3.21.5. In production, they want the "stable" release, so we're looking at 3.18.x. I figured there weren't going to be *too* many chances to the configuration file ... but I was wrong!

$template prodea,"/logs/%HOSTNAME%/%syslogtag:R,ERE,1,FIELD:(.*)\:--end%.%$YEAR%%$MONTH%%$DAY%.log"

... produces ...

-rw------- 1 root root 27313 Oct 20 18:06 Syslog.boot.logERE,1,FIELD:(.*):--end**INVALID PROPERTY NAME**$YEAR**INVALID PROPERTY NAME**$MONTH**INVALID PROPERTY NAME**$DAY**INVALID PROPERTY NAME**

When was the $YEAR/$MONTH/$DAY added to be usable? How 'bout regex inline on the fields?

Thanks,

Tref

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

I found that the options I was using (except ERE) are supported by 3.18.5. The error is a bit misleading - the problem was with the regular expression match syntax, not with $year/$month/$day. Additionally, it seems like there's something different between 3.21.5. In 3.21.5 all my syslogtags end with a colon, and in 3.18.5 it does not (which made the need for a regular expression to pull out the colon not a requirement).

Not sure if this was a bug, or makes the current non-stable release a bug, but ... *shrug*