From 4f8bba55d24ce3c66afa3d0cc1d5d1246cadf112 Mon Sep 17 00:00:00 2001 From: Jonathan Clarke Date: Wed, 12 Mar 2014 19:52:41 +0100 Subject: [PATCH] Fixes #4602: Don't write reports to linuxlog.log, winlog.log and extLinuxReport.log since they are already all in all.log --- .../system/distributePolicy/1.0/rudder-rsyslog-root.st | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/techniques/system/distributePolicy/1.0/rudder-rsyslog-root.st b/techniques/system/distributePolicy/1.0/rudder-rsyslog-root.st index cb63feaf3..3e240bc78 100644 --- a/techniques/system/distributePolicy/1.0/rudder-rsyslog-root.st +++ b/techniques/system/distributePolicy/1.0/rudder-rsyslog-root.st @@ -36,7 +36,6 @@ $ModLoad ompgsql $EscapeControlCharactersOnReceive off # Log everything -#*.* /var/log/all.log *.* /var/log/rudder/reports/all.log # Direct to DB @@ -57,17 +56,10 @@ $ActionQueueSaveOnShutdown on $template RudderReportsFormat,"insert into RudderSysEvents (executionDate, nodeId, ruleId, directiveId, serial, Component, KeyValue, executionTimeStamp, eventType, msg, Policy) values ('%timereported:::date-rfc3339%','%msg:R,ERE,1,DFLT:.*##(.*)@#.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@.*@@(.*)@@.*@@.*@@.*@@.*@@.*##.*--end%' , '%msg:R,ERE,1,ZERO:.*@@.*@@.*@@.*@@(.*)@@.*@@.*@@.*@@.*##.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@.*@@.*@@.*@@(.*)@@.*@@.*@@.*##.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@.*@@.*@@.*@@.*@@(.*)@@.*@@.*##.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@.*@@.*@@.*@@.*@@.*@@(.*)@@.*##.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@.*@@.*@@.*@@.*@@.*@@.*@@(.*)##.*--end%', '%msg:R,ERE,1,DFLT:.*@@.*@@(.*)@@.*@@.*@@.*@@.*@@.*@@.*##.*--end%', '%msg:R,ERE,1,DFLT:.*@#(.*)--end%', '%msg:R,ERE,1,DFLT:.*@@(.*)@@.*@@.*--end%' )",stdsql - -# We start by logging all the Windows and Linux message -:programname, contains, "rudder" /var/log/rudder/reports/linuxlog.log -:programname, contains, "Cfengine_Nova" /var/log/rudder/reports/winlog.log - # Filtering by content # Process : -# We first log the data in the file, then in the database, and we drop the message - +# We first log the data in the database, then we drop the message -if $programname startswith 'rudder' and $msg startswith ' R: @@' then /var/log/rudder/reports/extLinuxReport.log # Enforce the content of the line with a regular expression :msg, ereregex, "R: @@[ a-zA-Z0-9_\-]+?@@[a-zA-Z0-9_\-]{1,64}?@@[a-zA-Z0-9\-]+@@[a-zA-Z0-9\-]+?@@[0-9]+?@@.*?@@.*?@@[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}[+-][0-9]{1,2}:[0-9]{2}##[a-zA-Z0-9\-]+?@#.*" :ompgsql:localhost,rudder,rudder,${p.psql_password[2]};RudderReportsFormat