0

The question might be confusing... What I have:

*.local1 call rule1

I have a ruleset rule1, that has two actions, a1 and a2. a2 is only executed if a1 failes, something like

ruleset(name="rule1"){action(),
                      action(action.execOnlyWhenPreviousIsSuspended="0n")}

What I want is that action a2 calls a new ruleset rule2, which then does action a3 and 4.

Is that possible?

Alternatively, if there could be an a3 within rule 1, that is also executed if the previous fails, that would probably also solve it, I guess.

Thx.

2 Answers 2

1

The blog mentioned in related links in the documentation has an example.

module(load="imptcp" keepalive="on")
# use imptcp just as example for bind ruleset below
ruleset(name="rs1") {
        action(type="omfile" File="/var/log/test1.log")
}
ruleset(name="rs2") {
        action(type="omfile" File="/var/log/test2.log")
        call rs1
}
input(type="imptcp" port="13514" ruleset="rs2")

While not tailored to your original example it should be possible to adjust.

  1. Input sends to ruleset "rs2"
  2. "rs2" saves to file (action), and calls "rs1"
  3. "rs1" saves to a second file (action)
0

I think you are looking for the "call" statement: https://www.rsyslog.com/doc/v8-stable/rainerscript/rainerscript_call.html

1
  • yes, but I couldnt figure how to use it to get different actions, since call did not work within an action. I solved it now by creating some rulesets, and bound them to different ports. If an action fails, I send the message to localhost on another port, which has one of the rules bound on it. that works! But for some reasons not in CentOS... but this is a different topic.
    – Arpton
    Dec 10, 2019 at 10:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .