1

I have a rule that was written over 2 years ago for an rsyslog listener that I discovered today has not been working. It is a basic RainerScript-based filter however it is not working. Can someone please look at the following and tell me what I am doing wrong? Thanks in advance.

call ruleset_em7

# Send to EM7
ruleset(name="ruleset_em7"){
 if ($msg contains "%ASA-4-313009" or $msg contains "%ASA-4-733100" or $msg contains "%ASA-3-202010") then {
   action(type="omfwd" name="omfwd_em7" target="x.x.x.x" protocol="udp" port="514")
 }
}

closed as off-topic by Jeff Schaller, Philippos, Satō Katsura, Archemar, dr01 Oct 19 '17 at 11:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, Philippos, Satō Katsura, Archemar, dr01
If this question can be reworded to fit the rules in the help center, please edit the question.

  • what is the error you are getting? and your rsyslog version? – Luv33preet Oct 11 '17 at 6:27
  • I am using rsyslog 7.4.10 however I discovered the problem - if you look at the code for this forwarding rule there are 2 sets of braces - now I am no RainerScript expert but it didn't look like the second set needed to be there based on examples from the rsyslog web site so after successfully sending the output of this rule to a file I attempted to forward it to another host and it worked perfectly. I just wish I knew when and when not to use the braces. – J Telep Oct 12 '17 at 20:44
2

In the code from the original question above there are 2 sets of braces - one around the entire if/then statement and yet another around the action portion. Unfortunately the built in syntax checker doesn't seem to pick up on the fact that this is a bad idea so it doesn't complain about the second set. As soon as they were removed rsyslog began forwarding to the host identified in the action statement.

Not the answer you're looking for? Browse other questions tagged or ask your own question.