Can you use something like Ansible (or Puppet or Chef or...) to parameterize the configuration file?
________________________________________
From: rsyslog <rsyslog-bounces@lists.adiscon.com> on behalf of Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
Sent: Friday, May 6, 2022 1:21 PM
To: David Lang
Cc: Derek Atkins; Derek Atkins via rsyslog
Subject: [EXT]Re: [rsyslog] How to parameterize an action?
External Email
Hi,
On Fri, May 6, 2022 4:14 pm, David Lang wrote:
>
>> But it sounds like the approach won't work. So I'll need to figure out
>> another way. Any suggestions?
>
> specify a name and set the name -> IP mapping in /etc/hosts (or via DNS)
Unfortunately that wont work. I won't know until deployment if I need to
log to logger.example.com, logger.foo.org, logger.x.y, etc. And from the
container I am pretty sure I do not have access to overwrite /etc/hosts
(and I have a feeling /etc/hosts in the container won't do anything).
It sounds like the only thing I can do is $Include the local config file
and within that file define the WHOLE action.
Definitely not ideal.
Ah well.
> David Lang
-derek
>> Thanks,
>>
>>> David Lang
>>
>> -derek
>>
>>> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>>>
>>>> Date: Fri, 6 May 2022 15:49:17 -0400
>>>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>>>> To: rsyslog@lists.adiscon.com
>>>> Cc: Derek Atkins <derek@ihtfp.com>
>>>> Subject: [rsyslog] How to parameterize an action?
>>>>
>>>> HI,
>>>>
>>>> I am trying to parameterize an action in rsyslog.conf, but I can't
>>>> seem
>>>> to
>>>> get the configuration right. For example, I am trying to do something
>>>> that looks like:
>>>>
>>>> $.server = "1.2.3.4";
>>>>
>>>> ....
>>>>
>>>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>>>> template="MyTemplate")
>>>>
>>>>
>>>> But rsyslog is complaining that the '$' an '.' are invalid characters
>>>> in
>>>> the object definition.
>>>>
>>>> I've been searching but cannot find the right syntax. So what IS the
>>>> right syntax to do this?
>>>>
>>>> Thanks,
>>>>
>>>> -derek
>>>>
>>>
>>
>>
>>
>
--
Derek Atkins 617-623-3745
derek@ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
________________________________________
From: rsyslog <rsyslog-bounces@lists.adiscon.com> on behalf of Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
Sent: Friday, May 6, 2022 1:21 PM
To: David Lang
Cc: Derek Atkins; Derek Atkins via rsyslog
Subject: [EXT]Re: [rsyslog] How to parameterize an action?
External Email
Hi,
On Fri, May 6, 2022 4:14 pm, David Lang wrote:
>
>> But it sounds like the approach won't work. So I'll need to figure out
>> another way. Any suggestions?
>
> specify a name and set the name -> IP mapping in /etc/hosts (or via DNS)
Unfortunately that wont work. I won't know until deployment if I need to
log to logger.example.com, logger.foo.org, logger.x.y, etc. And from the
container I am pretty sure I do not have access to overwrite /etc/hosts
(and I have a feeling /etc/hosts in the container won't do anything).
It sounds like the only thing I can do is $Include the local config file
and within that file define the WHOLE action.
Definitely not ideal.
Ah well.
> David Lang
-derek
>> Thanks,
>>
>>> David Lang
>>
>> -derek
>>
>>> On Fri, 6 May 2022, Derek Atkins via rsyslog wrote:
>>>
>>>> Date: Fri, 6 May 2022 15:49:17 -0400
>>>> From: Derek Atkins via rsyslog <rsyslog@lists.adiscon.com>
>>>> To: rsyslog@lists.adiscon.com
>>>> Cc: Derek Atkins <derek@ihtfp.com>
>>>> Subject: [rsyslog] How to parameterize an action?
>>>>
>>>> HI,
>>>>
>>>> I am trying to parameterize an action in rsyslog.conf, but I can't
>>>> seem
>>>> to
>>>> get the configuration right. For example, I am trying to do something
>>>> that looks like:
>>>>
>>>> $.server = "1.2.3.4";
>>>>
>>>> ....
>>>>
>>>> action(type="omfwd" Target=$.server Port="514" Protocol="tcp"
>>>> template="MyTemplate")
>>>>
>>>>
>>>> But rsyslog is complaining that the '$' an '.' are invalid characters
>>>> in
>>>> the object definition.
>>>>
>>>> I've been searching but cannot find the right syntax. So what IS the
>>>> right syntax to do this?
>>>>
>>>> Thanks,
>>>>
>>>> -derek
>>>>
>>>
>>
>>
>>
>
--
Derek Atkins 617-623-3745
derek@ihtfp.com www.ihtfp.com
Computer and Internet Security Consultant
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.