79167111

Date: 2024-11-07 15:28:43
Score: 0.5
Natty:
Report link

Still no sucess, when i include the if part (as per below) nothing works.

rsyslogd -N1

rsyslogd: version 8.2102.0-5.el8, config validation run (level 1), master config /etc/rsyslog.conf rsyslogd: error during parsing file /etc/rsyslog.d/tomcat.conf, on or before line 9: syntax error on token 'regex' [v8.2102.0-5.el8 try https://www.rsyslog.com/e/2207 ]

  module(load="imfile" PollingInterval="1") #needs to be done just once
#File 1
input(type="imfile"
File="/tomcat/logs/catalina.out"
Tag="catalina"
Severity="info"
Facility="local1")

if $msg regex "(?sm)org\.apache\.jasper\.JasperException:.* java\.lang\.NullPointerException[\r\n]{1,2}(\s+(?:at )?[^\s]+[\r\n]{1,2}){1,}" then {
    action(type="omfwd" target="192.168.0.1" port="514" protocol="udp" facility="local1" severity="err")
}

local1.* @192.168.0.1:514
Reasons:
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Self-answer (0.5):
  • Low reputation (1):
Posted by: John Paul Attard