Rsyslog archives err and info logs of local0 respectively.

There is a new requirement: PostgreSQL logs in the rsyslog server should be separated, according to priority, that is:

Logs of error and warn must be archived in one file;

Info and other levels of logs are archived in one file, and logs are automatically cut every hour;

Solution:

1. Create the configuration file PostgreSQL. conf in the/etc/rsyslog. d directory.

vi /etc/rsyslog.d/postgresql.conf

# Define the log storage path Template

$template postgresql_warn,"/data/syslog/%fromhost-ip%/error.log"$template postgresql_info,"/data/syslog/%fromhost-ip%/postgresql.%$year%-%$month%-%$day%-%$hour%"

# Define the log storage format and store only MSG Information

#Define log format to Postgresql$template pgsql_format, "%msg%\n"

# Define the log collection rules using the if condition method and apply the log format:

#Postgresql logif ($syslogfacility-text ==‘local0‘ and $syslogpriority-text == ‘warning‘ or $syslogpriority-text == ‘err‘) and $fromhost-ip == ‘10.1.1.11‘ then -?postgresql_warn;pgsql_formatif ($syslogfacility-text ==‘local0‘ and $syslogpriority-text != ‘warning‘ and $syslogpriority-text != ‘err‘) and $fromhost-ip == ‘10.1.1.11‘ then -?postgresql_info;pgsql_format

2. Restart Log Service

/etc/init.d/rsyslog restart

3. Go to the specified directory to view the collected logs

This article is from the "DBQ blog" and will not be reproduced!

Rsyslog archives err and info logs of local0 respectively.