0

I am working on filtering logs from syslog and forwading to another log.

I am able too capture/filter the log based on "internal-sftp". By using

if $programname == 'internal-sftp' then /var/log/sftp/sftp.log

above is working.

But I am unable to filter based on this "lstat name". I troed pri, syslogtag et., below is the log format.

Apr 24 02:16:30 ip-10-0-10-22 internal-sftp[4714]: lstat name "/settlement/universalpay/test_deletez.log"

So, how can I filter the line containing lstat name based on condition. Which properties i should use.

Below is sample code which I am trying.

if $programname == 'internal-sftp' then {
        if $syslogfacility-text contains 'lstat name' then {
                action(type="omfile" file="/var/log/sftp/sftp_lstat_files.log" template="outfmt")
        }
        action(type="omfile" file="/var/log/sftp/sftp.log" template="outfmt")
        & stop 
}
Improve this question
3
  • It is probably in the $msg property. see properties.
    – meuh
    Apr 24, 2020 at 12:40
  • I tried this and learnt "/settlement/universalpay/test_deletez.log" this part is the $msg
    – BalaB
    Apr 24, 2020 at 21:14
  • Look through the Reserved Template Names. It might be the $app-name. If not, use the RSYSLOG_DebugFormat template to break out the properties.
    – meuh
    Apr 24, 2020 at 21:33

1 Answer 1

Reset to default
1

Bala,

Could you please check as below

if $msg startswith ' lstat name' then { ....

make sure that you have space as shown above infront of ' lstat name'

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.