1

I'm building an application that will have quite a few moving parts. Some of them will be scheduled by cron, others are triggered by a service using inotify to listen for file arrivals.

Because I would like all logs to end up in a uniform format, I find myself needing to tell rsyslog that it should handle all logs from a specific programname without any additional formatting.

I have managed to achieve this easily on a Red Hat 7.3 machine running rsyslogd 7.4.7 using the following configuration:

$template rawFormat,"%rawmsg%\n"
if $programname == 'forwardit' then /var/log/forwardit.log;rawFormat
& stop

However, I now need to have the exact same configuration on a Debian Stretch machine, running rsyslogd 8.24.0 and it's not really working...

1) I tried just using the same configuration file. The result is that the logs lines do get sent to the right file, but it's not using the template:

<30>Oct  2 09:51:09 forwardit[24602]: {"task": "forward_file", "event": "Failed.", "timestamp": "2018-10-02T07:51:09.973558Z"}

Note the odd appearance of a <30> at the front, which is not present in my syslog...

2) I assumed that the old style template declarations simply weren't valid anymore, so I tried:

template (name="rawFormat" type="string" string="%rawmsg%\n")
if $programname == 'forwardit' then /var/log/forwardit.log;rawFormat
& stop

Same result.

3) Going forward in the same direction, I tried to update the application of the template:

template (name="rawFormat" type="string" string="%rawmsg%\n")
if $programname == 'forwardit' then action(type="omfile" File="/var/log/forwardit.log" Template="rawFormat")
& stop

And still no change in the actual output.

Here's the /etc/rsyslog.conf file:

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
module(load="imklog")   # provides kernel logging support
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
#module(load="imudp")
#input(type="imudp" port="514")

# provides TCP syslog reception
#module(load="imtcp")
#input(type="imtcp" port="514")


###########################
#### GLOBAL DIRECTIVES ####
###########################

#
# Use traditional timestamp format.
# To enable high precision timestamps, comment out the following line.
#
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

#
# Set the default permissions for all log files.
#
$FileOwner root
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022

#
# Where to place spool and state files
#
$WorkDirectory /var/spool/rsyslog

#
# Include all config files in /etc/rsyslog.d/
#
$IncludeConfig /etc/rsyslog.d/*.conf


###############
#### RULES ####
###############

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*         /var/log/auth.log
*.*;auth,authpriv.none      -/var/log/syslog
#cron.*             /var/log/cron.log
daemon.*            -/var/log/daemon.log
kern.*              -/var/log/kern.log
lpr.*               -/var/log/lpr.log
mail.*              -/var/log/mail.log
user.*              -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
mail.info           -/var/log/mail.info
mail.warn           -/var/log/mail.warn
mail.err            /var/log/mail.err

#
# Some "catch-all" log files.
#
*.=debug;\
    auth,authpriv.none;\
    news.none;mail.none -/var/log/debug
*.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none      -/var/log/messages

#
# Emergencies are sent to everybody logged in.
#
*.emerg             :omusrmsg:*
3
  • The original syntax should continue working. It might be bug. As a workaround, try a substring: `"%rawmsg:4:$%\n" to omit the first 3 chars.
    – meuh
    Oct 2 '18 at 9:11
  • Hmmm, that removed the "<30" in front... Would that indicate that, at that point, somehow, the timestamp and everything is already part of %rawmsg%?
    – Falc
    Oct 2 '18 at 9:17
  • I dont know. I have 8.27 on Fedora and the rawmsg is just the message, as you wanted. Look for other rules in /etc/rsyslog.d/*. Perhaps your logs are being munged by some systemd/journald setting before ending up in the syslog socket? You should probably be using $ModLoad imjournal instead of imuxsock.
    – meuh
    Oct 2 '18 at 10:01
1

Alright, so after more digging I was looking at the available properties and found rawmsg-after-pri, which explains that the <30> I was seeing is what rsyslog calls the PRI.

This lead me to realize that probably, the actual content of rawmsg had changed between versions. So I changed the template to use msg instead and all is good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.