I want to create rule to send data from facility to file AND to MySQL database.

How it can realized? Only by adding second line like:

syslog.*                         /var/log/syslog.log
syslog.*                         :ommysql:localhost,database,user,password

Or there is some more correct way?

  • Your description doesn't match the example. Do you actuallty want all your syslog messages - regardless of level - in the database, or do you only want the warning messages? – Jenny D Apr 14 '14 at 13:21
  • Yep, you right - I just copy/paste it from my config. But - I interesting to AND for all severity. Will edit example, thanks. – setevoy Apr 14 '14 at 13:32

Or there is some more correct way?

I don't know if it would be considered more correct, since I think it is an rsyslog specific feature (and it might be considered "more correct" to do things in a syslog compatible way whenever possible...or it might not) but there is the ampersand:

syslog.*      /var/log/syslog.log
&             :ommysql:localhost,database,user,password

It's documented here, if you search the page for "ampersand". I believe "legacy description" there refers to not to "syslog compatible" behaviour but to the legacy behavior of rsyslog, which now implements something called RainerScript for writing rules. As to whether that's really easier or more correct in this case I can't say.

  • 1
    Exactly what I need. – setevoy Apr 14 '14 at 13:15

Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one.

You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database:

syslog.*      /var/log/syslog.log
&             :ommysql:localhost,database,user,password

to reduce the amount of CPU used to evaluate the filter. But that is not the case here, so your solution is the correct one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.