Question

以下是我的conf文件。我想为val button : Button = getView()?.findViewById<Button>(R.id.testButton) as Button button.setOnClickListener {view -> Toast.makeText(context, "Write your message here", Toast.LENGTH_LONG).show() } }添加配置。

我在配置文件中添加了以下行

startmsg.regex

  startmsg.regex="^[[:digit:]]{4}\/[[:digit:]]{2}\/[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}"

当我使用ModLoad imfile $InputFilePollInterval 10 $PrivDropToGroup proxy $WorkDirectory /var/spool/rsyslog $InputFileName /var/log/app/cache.log $InputFileTag app-error: $InputFileStateFile stat-app-error $InputFileSeverity error $InputFilePersistStateInterval 20000 $InputRunFileMonitor startmsg.regex="^[[:digit:]]{4}\/[[:digit:]]{2}\/[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2}" $template AppError,"error %msg%\n" if $programname == 'app-error' then @@0.0.0.0:12345;AppError if $programname == 'app-error' then ~检查我的配置文件时，我收到错误。使用此功能的正确方法是什么？

Answer 1

以下是我用来通过rsyslog发送日志的conf文件。我也在添加样本日志。

此配置将匹配每个事件以YYYY / MM / DD HH：MM：SS开头然后发送到我的TCP端点。此配置可与多行日志一起使用

module(load="imfile" PollingInterval="10") #needs to be done just once
# File 1
input(type="imfile"
  File="/var/log/app/my.log"
  Tag="app-error"
  Severity="error"
  startmsg.regex="^[[:digit:]]{4}/[[:digit:]]{2}/[[:digit:]]{2} [[:digit:]]{1,2}:[[:digit:]]{1,2}:[[:digit:]]{1,2}"
)


$PrivDropToGroup proxy
$WorkDirectory /var/spool/rsyslog


$template AppError,"error %msg%\n"

if $programname == 'app-error' then @@0.0.0.0:12345;AppError
if $programname == 'app-error' then ~

示例日志：

2017/10/24 09:14:06 id1|   Took 0.00 seconds (  0.00 entries/sec).
CPU Usage: 0.052 seconds = 0.032 user + 0.020 sys
Maximum Resident Size: 104944 KB
Page faults with physical i/o: 0
2017/10/24 09:14:06 id1| found error

现在rsyslog会将我的多行日志作为单个事件发送到我的tcp端点，如下所示：

2017/10/24 09:14:06 id1|   Took 0.00 seconds (  0.00 entries/sec). \nCPU Usage: 0.052 seconds = 0.032 user + 0.020 sys \nMaximum Resident Size: 104944 KB \nPage faults with physical i/o: 0
2017/10/24 09:14:06 id1| found error

如何在Rsyslog中使用startmsg.regex

1 个答案: