I have a simple requirement. I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.

destination d_logfile { file("/var/log/logile.log"); };
destination d_start_script { program("/home/ubuntu/start-script.sh"); };
destination d_stop_script { program("/home/ubuntu/stop-script.sh"); };

filter f_logfile { facility(user) and not filter(f_debug); };
filter f_filter_start { facility(user) and message("start"); };
filter f_filter_stop { facility(user) and message("stop"); };

log { source(s_network_tcp); filter(f_logfile); destination(d_logfile); };
log { source(s_network_tcp); filter(f_filter_start); destination(d_start_script; };
log { source(s_network_tcp); filter(f_filter_stop; destination(d_stop_script); };

when I run the syslog-ng the start and stop script execute in an apparent loop even though no syslog traffic is being received.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.