isequal 和startswith 使用

isequal 和startswith 使用

如果要把不同服务器发送过来的日志保存到不同的文件, 可以这样 *** 作:

:fromhost-ip, isequal, “192.168.0.160″ /var/log/host160.log

:FROMHOST-IP, isequal, “192.168.0.161″ /var/log/host161.log

:FROMHOST-IP, startswith, “192.168.1.” /var/log/network1.log

:FROMHOST-IP, startswith, “192.168.2.” /var/log/network2.log

$EscapeControlCharactersOnReceive off      #关闭rsyslog默认转译ASCII<32的所有怪异字符，包括换行符等

$template tocFormat,"%syslogtag%,%FROMHOST-IP%,%msg%\n"

$template zjzc-flow01,"/data01/applog_backup/zjzc_log/zj-flow01-catalina.out.%$year%-%$month%-%$day%"       #定义TC：日志存放路径

:syslogtag,isequal,"zjzc-flow01"  -?zjzc-flow01;tocFormat

#if $syslogfacility-text == 'local5' and $msg startswith 'zjzc-flow01'  then   -?zjzc-flow01;tocFormat

dr-mysql01:/data01/applog_backup/zjzc_log#