Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have created a rule to redirect messages containing {FILTER} in file /etc/rsyslog.d/40-filter.conf

:msg,contains,"{FILTER}" /var/log/filter.log
& ~

I have edited file /etc/rsyslog.conf so it accepts remote UDP messages by uncommenting lines

$ModLoad imudp
$UDPServerRun 514

The source of my syslog messages is the following simple python script

#! /usr/bin/python

import logging
import logging.handlers

logger = logging.getLogger('LoggingTest')
logger.setLevel(logging.DEBUG)

formatter = logging.Formatter('{FILTER} %(message)s')
handler = logging.handlers.SysLogHandler()
handler.setFormatter(formatter)
logger.addHandler(handler)

logger.info("Test Message")

I restarted rsyslog using

sudo service rsyslog restart

When I run my script the following line appears in /var/log/messages, /var/log/syslog and /var/log/user.log but it does not appear in /var/log/filter.log which exists but remains empty.

Jun 23 17:18:29 {FILTER} Test Message

If I use command line tool 'logger' (command line example given below) then the rule is applied correctly

$ logger "{FILTER} Test Message 2"
$ cat /var/log/filter.log
Jun 23 17:21:28 NDU1010 nick: {FILTER} Test Message 2

Why isn't the rule applied to messages from my python script? I'm at a loss to explain this.

share|improve this question
    
Any thoughts on this? I'm still stumped. –  SuperMe Jun 27 '11 at 10:05
    
You noted that you've configured rsyslog to accept remote messages; how is the syslogger configured on the remote machine? Is your manual run of logger run from the same remote box as your python script? What about the rest of your log host rsyslogd configuration? (pertinent contents of /etc/rsyslog.{conf,d/*} ) –  Eli Heady Jul 8 '11 at 0:14

1 Answer 1

From the output you've given it looks like the python script is not sending all the pieces of the syslog message that rsyslog is expecting. It appears as if the "{FILTER}" part is where the host and app name should be. You can pretty easily prove this by running rsyslogd with the -d flag then sending the message from python and then from logger. You'll see the raw message as it comes from the socket that way and I bet you'll see that logger is sending more fields in front of the "{FILTER}" part.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.