* ログフォーマットの変更 [#l1fb7824]
** テンプレートの変更 [#r2f4c04f]
*** 全体の変更 [#j1753113]
$ActionFileDefaultTemplate = RSYSLOG_FileFormat
*** 個別の変更 [#r799ce16]
*.info /var/log/messages;RSYSLOG_FileFormat
*** 設定済みのテンプレート詳細 [#acf898ca]
>Legacy String-based Template Samples
>
>This section provides some default templates in legacy format, as used in rsyslog previous to version 6. Note that this format is still supported, so there is no hard need to upgrade existing configurations. However, it is strongly recommended that the legacy constructs are not used when crafting new templates. Note that each $Template statement is on a single line, but probably broken accross several lines for display purposes by your browsers. Lines are separated by empty lines. Keep in mind, that line breaks are important in legacy format.
$template FileFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template TraditionalFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"
$template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
$template TraditionalForwardFormat,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%"
http://www.rsyslog.com/doc/rsyslog_conf_templates.html
** 自分でテンプレートを作成してそれに変更する [#g611a3e5]
*** テンプレートの作成 [#xed159f2]
$template myTmpl, "%timegenerated:0:19:date-rfc3339% %msg%\n"
*** テンプレートの変更 [#kb169751]
*.info /var/log/messages;myTmpl
*** テンプレートで使用できるプロパティ（とそのオプション） [#h4591133]
http://www.rsyslog.com/doc/property_replacer.html
*** 参考 [#y3b0e37f]
http://www.rsyslog.com/doc/rsyslog_conf_templates.html
** rsyslog.confの新しい書式 [#k1e1b0dd]
template(name="myTmpl" type="list") {
constant(value="DEBUG: ")
property(name="msfg")
constant(value="\n")
}
*.* action(type="omfile" file="/var/log/messages" template="myTmpl")
最近のバージョンのrsyslogにしか対応してない。
** 参考 [#z67ed7ef]
- rsyslog.conf configuration file http://www.rsyslog.com/doc/rsyslog_conf.html
- http://www.atmarkit.co.jp/ait/articles/0812/05/news152.html
- http://d.hatena.ne.jp/hogem/20120329
- http://baalzephon.no-ip.org/tech/index.php?rsyslogd
