0

The following rsyslog configuration is used to monitor the apache access file.

# Apache access file:
$InputFileName /var/log/apache2/access.log
$InputFileTag apache-access:
$InputFileStateFile stat-apache-access
#$InputFileSeverity info  //This is commented because I wanted to set this based on condition.
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

if $programname == "apache-access" then {
    if ($msg contains " 500 ") then $InputFileSeverity 'error';
    action(type="ommysql" server="127.0.0.1" serverport="3306" db="Syslog" uid="rsyslog" pwd="somepasswd")
    stop
}

This was tested with a php code that uses header("HTTP/1.1 500 Internal Server Error")

and used curl -I localhost/phpinfo.php which returned a 500.

However, rsyslog is logging it as Severity NOTICE. The facility which it recorded was LOCAL0.

I was looking to change the severity to Error if there is a 500 in the message, which is not working as expected, and logs as Notice.

Thank you.

0

Managed to figure out.

# Apache access file:
$InputFileName /var/log/apache2/access.log
$InputFileTag apache-access:
$InputFileStateFile stat-apache-access
#$InputFileSeverity crit
$InputFilePersistStateInterval 20000

if $programname == "apache-access" then {
    #if ($msg contains " 500 ") then  $InputFileSeverity error 
    if ($msg contains " 500 ") then  $InputFileSeverity info
    action(type="ommysql" server="127.0.0.1" serverport="3306" db="Syslog" uid="rsyslog" pwd="somepasswd")
    stop
}


$InputRunFileMonitor

Put the $InputRunFileMonitor after the conditional, and it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.