syslog-ng: wildcard-file en niet wildcard bestanden

[MisterE]

Vanaf mijn client zou ik graag een map willen monitoren op nieuwe logfiles. Vandaar de "wildcard-file" module.
Maar er kunnen ook volledige paden gedefinieerd zijn. In mijn voorbeeld "/var/log/messages"

Schijnbaar raakt de FILE_NAME verloren over het netwerk. Bron: https://stackoverflow.com...-when-using-wildcard-file

Met onderstaande commando's op de client.

code:

logger -p syslog.info "Dit is een test logregel"
echo "$(date) at client" >>  /var/log_syslog/client2.log

komen deze aan in de "default.log" en de "catchall.log".

Dus de "f_has_sdata" bepaling lijkt niet te werken.
Het idee hiervan is dat ik daarna de uit-gehekte "destination d_sdata_logs" code kan gebruiken om de regel in het juiste bestand te loggen.


CLIENT:

code:

source s_wildcard {
  wildcard-file (
    base-dir("/var/log_syslog")
    filename-pattern("*")
    recursive(no)
    follow-freq(1)
  );
};

source s_singlefile {
  file (
    "/var/log/messages"
    follow-freq(1)
    flags(no-parse)
  );
};

rewrite r_set_filename {
  set (
    "$FILE_NAME",
    value("[e-mail]")
  );
};

rewrite r_use_basename {
  subst (
    "/var/log_syslog/",
    "",
    value("[e-mail]")
    type("string")
    flags("prefix")
  );
};

destination d_container_logs {
  syslog (
    "192.168.1.246"
    transport("tcp")
    port(5141)
  );
};

log {
  source(s_wildcard);
  rewrite(r_set_filename);
  rewrite(r_use_basename);
  destination(d_container_logs);
};

log {
  source(s_singlefile);
  #rewrite(r_set_filename);
  #rewrite(r_use_basename);
  destination(d_container_logs);
};

SERVER:

code:

source s_network {
  syslog (
  transport("tcp")
  port(5141)
  keep_hostname(yes)
  );
};



filter f_has_sdata {
  match("[e-mail]=.*");
};


filter f_no_sdata {
  not match("[e-mail]=.*");
};


# destination d_sdata_logs {
#   file (
#     "/var/sys_log/${[e-mail]}"
#     create_dirs(yes)
#   );
# };


destination d_sdata_logs {
  file (
    "/var/sys_log/sdata.log"
    create_dirs(yes)
  );
};

destination d_default_logs {
  file (
    "/var/sys_log/default.log"
    create_dirs(yes)
  );
};


destination d_catchall_logs {
  file (
    "/var/sys_log/catchall.log"
    create_dirs(yes)
  );
};

log {
  source(s_network);
  destination(d_catchall_logs);
};

log {
  source(s_network);
  filter(f_has_sdata);
  destination(d_sdata_logs);
};

log {
  source(s_network);
  filter(f_no_sdata);
  destination(d_default_logs);
};

[MisterE]

dit lijkt te werken

CLIENT:

code:

source s_wildcard {
  wildcard-file (
    base-dir("/var/log_syslog")
    filename-pattern("*")
    recursive(no)
    follow-freq(1)
  );
};

source s_singlefile {
  file (
    "/var/log/messages"
    follow-freq(1)
    flags(no-parse)
    program-override(messages_override)
  );
};

rewrite r_set_filename {
  set (
    "$FILE_NAME",
    value("[e-mail]")
  );
};

rewrite r_use_basename {
  subst (
    "/var/log_syslog/",
    "",
    value("[e-mail]")
    type("string")
    flags("prefix")
  );
};

destination d_container_logs {
  syslog (
    "192.168.1.246"
    transport("tcp")
    port(5141)
  );
};

log {
  source(s_wildcard);
  rewrite(r_set_filename);
  rewrite(r_use_basename);
  destination(d_container_logs);
};

log {
  source(s_singlefile);
  destination(d_container_logs);
};

SERVER:

code:

source s_network {
  syslog (
  transport("tcp")
  port(5141)
  keep_hostname(yes)
  );
};


filter f_has_sdata {
  match(".+" value("[e-mail]"))
};


filter f_no_sdata {
  not match(".+" value("[e-mail]"))
};

destination d_sdata_log {
  file (
    "/var/sys_log/${[e-mail]}"
    create_dirs(yes)
  );
};

destination d_nosdata_log {
  file (
    "/var/sys_log/$PROGRAM.log"
    create_dirs(yes)
  );
};


log {
  source(s_network);
  filter(f_has_sdata);
  destination(d_sdata_log);
};

log {
  source(s_network);
  filter(f_no_sdata);
  destination(d_nosdata_log);
};