I am using CentOS6.5 that include rsyslogd v5.8.10

There are 20 process program in my server.I want to receive logs use rsyslogd and hope to store in different log file according identity of process program in message, so I decide send logs like following format: {PRC } example: {PRC server1_process_a10}this_is_message_text

I want to know how to check whether message is match filter/rule(use Regex?), then use the process_name,log_level in the log file name?

For example: the log message is(log level is debug): {PRC server1_process_a10}this_is_message_text we want this message store to /var/log/myprogram-server1_process_a10_debug.log

  • I tried to use following setting in rsyslog.conf, but always not match. $Template tpl,"/var/log/myprcs_%msg:R,ERE,0,ZERO:\{PRCS_[a-zA-Z0-9_\-]+\}--end%.log" local0.* ?tpl – user154728 Feb 27 '16 at 5:30
  • even use "%msg:R,ERE,0,ZERO:PRCS--end%.log" and message string "PRCS1234test", but result was didn't match and rsyslog only wrote message to /var/log/myprcs_0.log. The result of test make me confused, what happended? the regular expression check pass use the official tools(rsyslog.com/regex) – user154728 Feb 27 '16 at 6:33

Finally I solve this problem.

First step, send log text via program like following:

sender_host sender_program log_text

Second add following setting in /etc/rsyslog.conf

$template tpl,"/var/log/procs_%programname:R,ERE,0,ZERO:(PRCS_[A-Za-z0-9]+)--end%%syslogseverity-text%%$year%-%$month%-%$day%.log"

local0.* ?tpl

Then everything will be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.