ログフォーマットの変更

テンプレートの変更

全体の変更

 $ActionFileDefaultTemplate = RSYSLOG_FileFormat

個別の変更

 *.info   /var/log/messages;RSYSLOG_FileFormat

設定済みのテンプレート詳細

Legacy String-based Template Samples

This section provides some default templates in legacy format, as used in rsyslog previous to version 6. Note that this format is still supported, so there is no hard need to upgrade existing configurations. However, it is strongly recommended that the legacy constructs are not used when crafting new templates. Note that each $Template statement is on a single line, but probably broken accross several lines for display purposes by your browsers. Lines are separated by empty lines. Keep in mind, that line breaks are important in legacy format.

 $template FileFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" 
 $template TraditionalFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" 
 $template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" 
 $template TraditionalForwardFormat,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" 

http://www.rsyslog.com/doc/rsyslog_conf_templates.html

自分でテンプレートを作成してそれに変更する

テンプレートの作成

 $template myTmpl, "%timegenerated:0:19:date-rfc3339% %msg%\n"

テンプレートの変更

 *.info   /var/log/messages;myTmpl

テンプレートで使用できるプロパティ（とそのオプション）

http://www.rsyslog.com/doc/property_replacer.html

参考

http://www.rsyslog.com/doc/rsyslog_conf_templates.html

rsyslog.confの新しい書式

 template(name="myTmpl" type="list") {
  constant(value="DEBUG: ")
  property(name="msfg")
  constant(value="\n")
 }
 
 *.* action(type="omfile" file="/var/log/messages" template="myTmpl")

最近のバージョンのrsyslogにしか対応してない。

参考

• rsyslog.conf configuration file http://www.rsyslog.com/doc/rsyslog_conf.html
• http://www.atmarkit.co.jp/ait/articles/0812/05/news152.html
• http://d.hatena.ne.jp/hogem/20120329
• http://baalzephon.no-ip.org/tech/index.php?rsyslogd