Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to create rule to send data from facility to file AND to MySQL database.

How it can realized? Only by adding second line like:

syslog.*                         /var/log/syslog.log
syslog.*                         :ommysql:localhost,database,user,password

Or there is some more correct way?

share|improve this question
    
Your description doesn't match the example. Do you actuallty want all your syslog messages - regardless of level - in the database, or do you only want the warning messages? –  Jenny D Apr 14 at 13:21
    
Yep, you right - I just copy/paste it from my config. But - I interesting to AND for all severity. Will edit example, thanks. –  setevoy Apr 14 at 13:32

2 Answers 2

up vote 4 down vote accepted

Or there is some more correct way?

I don't know if it would be considered more correct, since I think it is an rsyslog specific feature (and it might be considered "more correct" to do things in a syslog compatible way whenever possible...or it might not) but there is the ampersand:

syslog.*      /var/log/syslog.log
&             :ommysql:localhost,database,user,password

It's documented here, if you search the page for "ampersand". I believe "legacy description" there refers to not to "syslog compatible" behaviour but to the legacy behavior of rsyslog, which now implements something called RainerScript for writing rules. As to whether that's really easier or more correct in this case I can't say.

share|improve this answer
    
Exactly what I need. –  setevoy Apr 14 at 13:15

Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one.

You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.*      /var/log/syslog.log
&             :ommysql:localhost,database,user,password

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.