Mailing List Archive: rsyslog error trying to resolve

I am trying to pick a filename based on the IP of the machine sending the log. I have this:

if ($FROMHOST-IP=="10.200.0.1") then {
$template DynFile,"/var/log/remotelogs/CS Lab Head - %timestamp:::date-day%.log"
} else {
$template Dynfile,"/var/log/remotelogs/CS Lab Head Backup - %timestamp:::date-day%.log"
}

But when checking the rsyslog status, I'm seeing:

Sep 19 10:46:59 syslog systemd[1]: Starting System Logging Service...
Sep 19 10:46:59 syslog systemd[1]: Started System Logging Service.
Sep 19 10:46:59 syslog rsyslogd[66896]: error during parsing file /etc/rsyslog.conf, on or before line 26: syntax error on token '}' [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
Sep 19 10:46:59 syslog rsyslogd[66896]: could not interpret master config file '/etc/rsyslog.conf'. [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
Sep 19 10:46:59 syslog rsyslogd[66896]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0]
Sep 19 10:46:59 syslog rsyslogd[66896]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="66896" x-info="https://www.rsyslog.com"] start

What am I missing??
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

template definitions happen at startup time, you don't define them during the
log processing, so your config is exactly the same as:

$template DynFile,"/var/log/remotelogs/CS Lab Head - %timestamp:::date-day%.log"
$template Dynfile,"/var/log/remotelogs/CS Lab Head Backup - %timestamp:::date-day%.log"
if ($FROMHOST-IP=="10.200.0.1") then {
} else {
}

which doesn't make any sense.

what you can do is define a $. variable and use that variable in your template,
then populate that variable with different things during log processing.

David Lang

On Tue, 19 Sep 2023, Steve G via rsyslog wrote:

> Date: Tue, 19 Sep 2023 18:37:06 +0000
> From: Steve G via rsyslog <rsyslog@lists.adiscon.com>
> To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
> Cc: Steve G <sgboise@outlook.com>
> Subject: [rsyslog] rsyslog error trying to resolve
>
> I am trying to pick a filename based on the IP of the machine sending the log. I have this:
>
> if ($FROMHOST-IP=="10.200.0.1") then {
> $template DynFile,"/var/log/remotelogs/CS Lab Head - %timestamp:::date-day%.log"
> } else {
> $template Dynfile,"/var/log/remotelogs/CS Lab Head Backup - %timestamp:::date-day%.log"
> }
>
> But when checking the rsyslog status, I'm seeing:
>
> Sep 19 10:46:59 syslog systemd[1]: Starting System Logging Service...
> Sep 19 10:46:59 syslog systemd[1]: Started System Logging Service.
> Sep 19 10:46:59 syslog rsyslogd[66896]: error during parsing file /etc/rsyslog.conf, on or before line 26: syntax error on token '}' [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
> Sep 19 10:46:59 syslog rsyslogd[66896]: could not interpret master config file '/etc/rsyslog.conf'. [v8.2001.0 try https://www.rsyslog.com/e/2207 ]
> Sep 19 10:46:59 syslog rsyslogd[66896]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.2001.0]
> Sep 19 10:46:59 syslog rsyslogd[66896]: [origin software="rsyslogd" swVersion="8.2001.0" x-pid="66896" x-info="https://www.rsyslog.com"] start
>
> What am I missing??
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.