• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

The Geek Diary

CONCEPTS | BASICS | HOWTO

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • Linux Services
    • VCS
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
    • Data Guard
  • DevOps
    • Docker
    • Shell Scripting
  • Interview Questions
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

Understanding rsyslog Templates

By admin

Templates modify and format output generated by rsyslog. They allow to specify any format a user might want. They are also used for dynamic file name generation. The following is the syntax to create a template:

$template TEMPLATE_NAME,"text %PROPERTY% text", [OPTION]

The fields are described as follows:

Field Purpose
$template Directive that defines a template
TEMPLATE_NAME Name of the template
“text” Actual template text surrounded by quotation marks
%PROPERTY% Specific message content surrounded by percent signs
OPTION Specifies options that modify the template functionality

Templates can be used to generate dynamic file names. Specify a property as a part of the file path to create a new file for each unique property. For example, use the timegenerated property to generate a unique file name for each rsyslog message:

$template DynamicFile,“/var/log/%timegenerated%-test.log”

Specify the template name in a rule to modify rsyslog output. Dynamic files are represented by a template and a question mark (?) prefix. Example:

*.* ?DynamicFile

Properties

You can use properties inside a template to reference specific contents of an rsyslog message. Use the following syntax to define a property inside a template:

%PROPERTY_NAME[:FROM_CHAR:TO_CHAR:OPTION]%

The fields are described as follows:

Field Purpose
PROPERTY_NAME Name of a property
FROM_CHAR and TO_CHAR Range of characters the specified property acts upon
OPTION Property options

A list of available properties and descriptions can be found at http://www.rsyslog.com/doc/property_replacer.html.

1. The following property represents the entire message text of an rsyslog message:

%msg%

2. The following example represents the first two characters of the message text:

%msg:1:2%

3. The following property represents the host name in an rsyslog message:

%hostname%

4. The following property represents the facility from the message in text form:

%syslogfacility-text%

Template: Example

The following example defines a template named class that formats an rsyslog message to output the message’s time stamp, facility in text form, priority in text form, host name, and message text, and ends with a new line:

$template class, "Time: %timestamp%, Facility: %syslogfacilitytext%, Priority: %syslogpriority-text%, Hostname: %hostname%,
Message: %msg%\n"

To use the template for /var/log/logfile messages, include the template name as follows:

*.* /var/log/logfile;class
CentOS / RedHat : Beginners guide to log file administration
Understanding rsyslog Actions
Understanding rsyslog Filter Options

Filed Under: Linux

Some more articles you might also be interested in …

  1. How To Setup mutt in CentOS/RHEL
  2. How to avoid ssh from prompting key passphrase for passwordless logins
  3. CentOS / RHEL 5 : How to rebuild Initial Ramdisk Image
  4. How to activate a “SUSPENDED” LVM physical volume
  5. How to Configure an NFSv4-only Client using nfsconf in CentOS/RHEL 8
  6. Where to find ASMLib / oracleasm RPMs for CentOS/RHEL, SUSE, OEL
  7. What are “segfault” messages in /var/log/messages file
  8. How to configure xhost to be persistent across reboots in Linux
  9. “docker dead but subsys locked” – error while starting docker
  10. How to Change the Default Timeout Settings for Telnet Session in CentOS/RHEL

You May Also Like

Primary Sidebar

Recent Posts

  • CentOS/RHEL 8: “ACPI MEMORY OR I/O RESET_REG” Server Hung after reboot
  • How to Create a Physical Standby Database by Using SQL and RMAN Commands
  • Basics of client connectivity in Oracle Data Guard configuration
  • ORA-354 ORA-353 and ORA-312: Possible corruption in Online Redo Log File Members in a Redo Log Group
  • Archives
  • Contact Us
  • Copyright

© 2021 · The Geek Diary