Revision 0615da4f
Added by Nicolas CHARLES almost 7 years ago
| techniques/system/distributePolicy/1.0/rudder-rsyslog-relay.st | ||
|---|---|---|
|
#
|
||
|
|
||
|
# 1 - Send every matching report to the root server
|
||
|
:msg, ereregex, "R: @@[ a-zA-Z0-9_\-]+?@@[a-zA-Z0-9_\-]{1,64}?@@[a-zA-Z0-9\-]+@@[a-zA-Z0-9\-]+?@@[0-9]+?@@.*?@@.*?@@[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[+-][0-9]{1,2}:[0-9]{2}##[a-zA-Z0-9\-]+?@#.*" ${check_log_system.rsyslog_rule_prefix}${server_info.cfserved}:&SYSLOGPORT&
|
||
|
:msg, ereregex, "(R: )?@@[ a-zA-Z0-9_\-]+?@@[a-zA-Z0-9_\-]{1,64}?@@[a-zA-Z0-9\-]+@@[a-zA-Z0-9\-]+?@@[0-9]+?@@.*?@@.*?@@[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[+-][0-9]{1,2}:[0-9]{2}##[a-zA-Z0-9\-]+?@#.*" ${check_log_system.rsyslog_rule_prefix}${server_info.cfserved}:&SYSLOGPORT&
|
||
|
|
||
|
# 2 - Drop the remaining rudder logs to prevent local storage cluttering
|
||
|
|
||
| techniques/system/distributePolicy/1.0/rudder-rsyslog-root.st | ||
|---|---|---|
|
# The report format is @@Policy@@State@@RuleId@@DirectiveId@@VersionId@@Component@@Key@@ExecutionTimeStamp##NodeId@#HumanReadableMessage
|
||
|
#
|
||
|
# 1 - Send every matching report in the database...
|
||
|
:msg, ereregex, "R: @@[ a-zA-Z0-9_\-]+?@@[a-zA-Z0-9_\-]{1,64}?@@[a-zA-Z0-9\-]+@@[a-zA-Z0-9\-]+?@@[0-9]+?@@.*?@@.*?@@[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[+-][0-9]{1,2}:[0-9]{2}##[a-zA-Z0-9\-]+?@#.*" :ompgsql:${install_rsyslogd.rudder_postgres_server},${install_rsyslogd.rudder_reports_db_name},${install_rsyslogd.rudder_reports_db_user},${p.psql_password[2]};RudderReportsFormat
|
||
|
:msg, ereregex, "(R: )?@@[ a-zA-Z0-9_\-]+?@@[a-zA-Z0-9_\-]{1,64}?@@[a-zA-Z0-9\-]+@@[a-zA-Z0-9\-]+?@@[0-9]+?@@.*?@@.*?@@[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[+-][0-9]{1,2}:[0-9]{2}##[a-zA-Z0-9\-]+?@#.*" :ompgsql:${install_rsyslogd.rudder_postgres_server},${install_rsyslogd.rudder_reports_db_name},${install_rsyslogd.rudder_reports_db_user},${p.psql_password[2]};RudderReportsFormat
|
||
|
|
||
|
# 2 - Drop the remaining rudder logs to prevent local storage cluttering
|
||
|
|
||
Also available in: Unified diff
Fixes #10829: Accept logs reports which don't start by \"R: \"