syslog-ng execute script on syslog patternFilter out a facility in syslog-ngSquid logging to syslog-ng - program name has bracketssyslog-ng and nginx logs to mysqlHow is “kernel.*” syslog spoofing prevented?How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?syslog-ng working as foreground process but not as daemonsyslog-ng logs storing with hostname year dateAvoid logging in /var/log/syslog only using /etc/syslog-ng/conf.d/unable to filter badly-formatted messages in syslog-ngSyslog-ng not triggering Python script
Latin words remembered from high school 50 years ago
Good examples of "two is easy, three is hard" in computational sciences
Have the writers and actors of Game Of Thrones responded to its poor reception?
On a piano, are the effects of holding notes and the sustain pedal the same for a single chord?
Why favour the standard WP loop over iterating over (new WP_Query())->get_posts()?
Can I have a delimited macro with a literal # in the parameter text?
Would it be possible to set up a franchise in the ancient world?
Isn't Kirchhoff's junction law a violation of conservation of charge?
In Dutch history two people are referred to as "William III"; are there any more cases where this happens?
Failing students when it might cause them economic ruin
Chain rule instead of product rule
Find the 3D region containing the origin bounded by given planes
Why aren't satellites disintegrated even though they orbit earth within earth's Roche Limits?
What is the backup for a glass cockpit, if a plane loses power to the displays/controls?
Addressing an email
Can a Warforged have a ranged weapon affixed to them like an armblade?
How can I prevent Bash expansion from passing files starting with "-" as argument?
Why does string strummed with finger sound different from the one strummed with pick?
How to fix "webpack Dev Server Invalid Options" in Vuejs
Print characters from list with a For-loop
What city and town structures are important in a low fantasy medieval world?
In how many ways can we partition a set into smaller subsets so the sum of the numbers in each subset is equal?
Is it possible to view all the attribute data in QGIS
Is there any official Lore on Keraptis the Wizard, apart from what is in White Plume Mountain?
syslog-ng execute script on syslog pattern
Filter out a facility in syslog-ngSquid logging to syslog-ng - program name has bracketssyslog-ng and nginx logs to mysqlHow is “kernel.*” syslog spoofing prevented?How do I filter on tags in syslog-ng when they don't seem to be available by the time it processes it?syslog-ng working as foreground process but not as daemonsyslog-ng logs storing with hostname year dateAvoid logging in /var/log/syslog only using /etc/syslog-ng/conf.d/unable to filter badly-formatted messages in syslog-ngSyslog-ng not triggering Python script
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
I have the following configuration,
destination d_logfile file("/var/log/logile.log"); ;
destination d_start_script program("/home/ubuntu/start-script.sh"); ;
destination d_stop_script program("/home/ubuntu/stop-script.sh"); ;
filter f_logfile facility(user) and not filter(f_debug); ;
filter f_filter_start facility(user) and message("start"); ;
filter f_filter_stop facility(user) and message("stop"); ;
log source(s_network_tcp); filter(f_logfile); destination(d_logfile); ;
log source(s_network_tcp); filter(f_filter_start); destination(d_start_script; ;
log source(s_network_tcp); filter(f_filter_stop; destination(d_stop_script); ;
when I start syslog-ng it seems to loop and execute both start and stop scripts on and off.
am I missing something?
linux syslog syslog-ng
asked May 6 at 21:41
David CalderonDavid Calderon
61
add a comment |
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
I have the following configuration,
destination d_logfile file("/var/log/logile.log"); ;
destination d_start_script program("/home/ubuntu/start-script.sh"); ;
destination d_stop_script program("/home/ubuntu/stop-script.sh"); ;
filter f_logfile facility(user) and not filter(f_debug); ;
filter f_filter_start facility(user) and message("start"); ;
filter f_filter_stop facility(user) and message("stop"); ;
log source(s_network_tcp); filter(f_logfile); destination(d_logfile); ;
log source(s_network_tcp); filter(f_filter_start); destination(d_start_script; ;
log source(s_network_tcp); filter(f_filter_stop; destination(d_stop_script); ;
when I start syslog-ng it seems to loop and execute both start and stop scripts on and off.
am I missing something?
linux syslog syslog-ng
asked May 6 at 21:41
David CalderonDavid Calderon
61
add a comment |
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
I have the following configuration,
destination d_logfile file("/var/log/logile.log"); ;
destination d_start_script program("/home/ubuntu/start-script.sh"); ;
destination d_stop_script program("/home/ubuntu/stop-script.sh"); ;
filter f_logfile facility(user) and not filter(f_debug); ;
filter f_filter_start facility(user) and message("start"); ;
filter f_filter_stop facility(user) and message("stop"); ;
log source(s_network_tcp); filter(f_logfile); destination(d_logfile); ;
log source(s_network_tcp); filter(f_filter_start); destination(d_start_script; ;
log source(s_network_tcp); filter(f_filter_stop; destination(d_stop_script); ;
when I start syslog-ng it seems to loop and execute both start and stop scripts on and off.
am I missing something?
linux syslog syslog-ng
asked May 6 at 21:41
David CalderonDavid Calderon
61
I have a simple requirement.
I want to receive all syslog messages coming from user facility and store them in a file. If the syslog message contains a specific pattern, I want to execute a script.
I have the following configuration,
destination d_logfile file("/var/log/logile.log"); ;
destination d_start_script program("/home/ubuntu/start-script.sh"); ;
destination d_stop_script program("/home/ubuntu/stop-script.sh"); ;
filter f_logfile facility(user) and not filter(f_debug); ;
filter f_filter_start facility(user) and message("start"); ;
filter f_filter_stop facility(user) and message("stop"); ;
log source(s_network_tcp); filter(f_logfile); destination(d_logfile); ;
log source(s_network_tcp); filter(f_filter_start); destination(d_start_script; ;
log source(s_network_tcp); filter(f_filter_stop; destination(d_stop_script); ;
when I start syslog-ng it seems to loop and execute both start and stop scripts on and off.
am I missing something?
linux syslog syslog-ng
linux syslog syslog-ng
asked May 6 at 21:41
David CalderonDavid Calderon
61
asked May 6 at 21:41
David CalderonDavid Calderon
61
asked May 6 at 21:41
David CalderonDavid Calderon
61
asked May 6 at 21:41
David CalderonDavid Calderon
61
asked May 6 at 21:41
David CalderonDavid Calderon
61
61
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
If I understand correctly, then instead of a start/stop script, you really want to have one script that processes a sequence of messages, and a way to create this sequence. Check if you can create this sequence using the grouping-by() parser, for example using the $HOST$PROGRAM$PID scope.
If it's not adequate, in newer syslog-ng versions you can write your own syslog-ng destination in Python, that probably gives you enough flexibility to get the job done (but you can also write parsers in Python if needed).
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966111%2fsyslog-ng-execute-script-on-syslog-pattern%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If I understand correctly, then instead of a start/stop script, you really want to have one script that processes a sequence of messages, and a way to create this sequence. Check if you can create this sequence using the grouping-by() parser, for example using the $HOST$PROGRAM$PID scope.
If it's not adequate, in newer syslog-ng versions you can write your own syslog-ng destination in Python, that probably gives you enough flexibility to get the job done (but you can also write parsers in Python if needed).
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
add a comment |
If I understand correctly, then instead of a start/stop script, you really want to have one script that processes a sequence of messages, and a way to create this sequence. Check if you can create this sequence using the grouping-by() parser, for example using the $HOST$PROGRAM$PID scope.
If it's not adequate, in newer syslog-ng versions you can write your own syslog-ng destination in Python, that probably gives you enough flexibility to get the job done (but you can also write parsers in Python if needed).
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
add a comment |
If I understand correctly, then instead of a start/stop script, you really want to have one script that processes a sequence of messages, and a way to create this sequence. Check if you can create this sequence using the grouping-by() parser, for example using the $HOST$PROGRAM$PID scope.
If it's not adequate, in newer syslog-ng versions you can write your own syslog-ng destination in Python, that probably gives you enough flexibility to get the job done (but you can also write parsers in Python if needed).
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
If I understand correctly, then instead of a start/stop script, you really want to have one script that processes a sequence of messages, and a way to create this sequence. Check if you can create this sequence using the grouping-by() parser, for example using the $HOST$PROGRAM$PID scope.
If it's not adequate, in newer syslog-ng versions you can write your own syslog-ng destination in Python, that probably gives you enough flexibility to get the job done (but you can also write parsers in Python if needed).
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
answered May 7 at 6:35
Robert FeketeRobert Fekete
461135
461135
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
add a comment |
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
Is there a simpler way to comply with the requirement?
– David Calderon
May 7 at 20:34
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
I guess it depends on what your incoming log messages that you want to group look like. Can you post some examples?
– Robert Fekete
May 9 at 8:06
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966111%2fsyslog-ng-execute-script-on-syslog-pattern%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
