[rsyslog] Debug format on my dynamic template

Discussion:

Xavier Fustero

2015-02-02 12:48:36 UTC

Hi,

I am trying to fill my logs files with more information when debugging
applications. I am currently having application filtered locally using
different templates and creating dynamic files from these.

E.g.:

template (name="rails_app" type="string"
string="/var/log/rails/%programname%.log")

if (($syslogfacility-text == 'local0' or $syslogfacility-text == 'local1')
and ($programname != 'p1' and $programname != 'p2' and
$programname != 'p3' and not ( $programname startswith 'p4'))) then {
action(type="omfile" DynaFile="rails_app")

These produces logs like:
Feb 2 12:42:05 my_host TagService[17793]: CloudAnalyticsSqsHelper:
queue(ca_tag_denorm_staging), adding tags to resources.
{"type"=>"add_tags", "version"=>1422880925, "account_id"=>"XXXXX",
"rsids"=>["/clouds/2722/instances/DRRS"],
"tags"=>["rs_login:state=restricted"]}

I discard debug by default on my installation but if I remove my discard I
would like to produce much more verbose output on my logs. I need they show
facility-text and priority-text at least.

I tried several things in the above template but I am not doing it
correctly.
I also uncomment this line from rsyslog.conf:

# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

expecting it magically would take this format by default but nothing
changed.

How can I tell the above template to use debug format or include the
%syslogfacility-text% and %syslogpriority-text%?

Thanks a log,
Xavi
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Xavier Fustero

2015-02-02 15:01:31 UTC

Permalink

Replying myself....

It seems you need to redefine the generic template in the rsyslog.conf
adding these pri-text:

$template TraditionalFormatWithPRI,"%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate TraditionalFormatWithPRI

Now it works!

Xavi

Post by Xavier Fustero
Hi,
I am trying to fill my logs files with more information when debugging
applications. I am currently having application filtered locally using
different templates and creating dynamic files from these.
template (name="rails_app" type="string"
string="/var/log/rails/%programname%.log")
if (($syslogfacility-text == 'local0' or $syslogfacility-text == 'local1')
and ($programname != 'p1' and $programname != 'p2' and
$programname != 'p3' and not ( $programname startswith 'p4'))) then {
action(type="omfile" DynaFile="rails_app")
queue(ca_tag_denorm_staging), adding tags to resources.
{"type"=>"add_tags", "version"=>1422880925, "account_id"=>"XXXXX",
"rsids"=>["/clouds/2722/instances/DRRS"],
"tags"=>["rs_login:state=restricted"]}
I discard debug by default on my installation but if I remove my discard I
would like to produce much more verbose output on my logs. I need they show
facility-text and priority-text at least.
I tried several things in the above template but I am not doing it
correctly.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
expecting it magically would take this format by default but nothing
changed.
How can I tell the above template to use debug format or include the
%syslogfacility-text% and %syslogpriority-text%?
Thanks a log,
Xavi

_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Tait Clarridge

2015-02-02 15:30:25 UTC

Permalink

Post by Xavier Fustero
Replying myself....
It seems you need to redefine the generic template in the rsyslog.conf
$template TraditionalFormatWithPRI,"%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n"
$ActionFileDefaultTemplate TraditionalFormatWithPRI
Now it works!
Xavi

You can also specify a template for the output for specific actions.

eg.

template(name="TraditionalFormatWithPRI" type="string"
string="%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n")
action(type="omfile" DynaFile="rails_app" Template="TraditionalFormatWithPRI")

That way you don't have to override the default template.

Tait
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Xavier Fustero

2015-02-02 20:34:51 UTC

Permalink

Excellent Tait!

I didn't know you can create two templates: one for the DynaFile and
another for the format!

Thanks!
template(name="
TraditionalFormatWithPRI" type="string"
string="%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n")
action(type="omfile" DynaFile="rails_app"
Template="TraditionalFormatWithPRI")

Post by Tait Clarridge

You can also specify a template for the output for specific actions.
eg.
template(name="TraditionalFormatWithPRI" type="string"
string="%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n")
action(type="omfile" DynaFile="rails_app"
Template="TraditionalFormatWithPRI")
That way you don't have to override the default template.
Tait
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.

David Lang

2015-02-02 21:01:35 UTC

Permalink

you can create as many templates as you want.

You can use a different template for each output (as well as for the filename
for files) and with v8.x you can even use formats to assign values to variables
that you can then use in conditional tests and other formats.

David Lang

Post by Xavier Fustero
Excellent Tait!
I didn't know you can create two templates: one for the DynaFile and
another for the format!
Thanks!
template(name="
TraditionalFormatWithPRI" type="string"
string="%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n")
action(type="omfile" DynaFile="rails_app"
Template="TraditionalFormatWithPRI")

Post by Tait Clarridge

You can also specify a template for the output for specific actions.
eg.
template(name="TraditionalFormatWithPRI" type="string"
string="%pri-text%: %timestamp% %HOSTNAME%
%syslogtag%%msg:::drop-last-lf%\n")
action(type="omfile" DynaFile="rails_app"
Template="TraditionalFormatWithPRI")
That way you don't have to override the default template.
Tait
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.