Announcements :: rsyslog 3.17.0 released :: (857 Reads)
Posted by
friedl
on Wednesday, April 09, 2008 - 10:19 PM
Hi all,
rsyslog 3.17.0 has just been released. It is part of the development branch. The primary new feature is the ability to send email alerts based on syslog or file data. The action engine now has the ability to carry out an action only once within a configured interval and/or only during specific time frames. Option processing has been improved and a number of stability updates have been included. This is a recommended update for all users of the development version.
More information on the major new feature can be found here:
The following is a sample code snippet that alerts the operator when disk problems are detected:
$ModLoad ommail
$ActionMailSMTPServer mail.example.net
$ActionMailFrom rsyslog@example.net
$ActionMailTo operator@example.net
$template mailSubject,"disk problem on %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
# make sure we receive a mail only once in six
# hours (21,600 seconds ;))
$ActionExecOnlyOnceEveryInterval 21600
# the if ... then ... mailBody mus be on one line!
if $msg contains 'hard disk fatal failure' then :ommail:;mailBody
Note that we now have the ability to limit an action to be executed only once inside a specific period. In the above sample, the email alert happens only if there was no other such alert within the past 6 hours - this is absolutely vital to prevent an accidental DoS on your mailbox ;) ... but it may also be handy with other actions (e.g. SNMP trap notification etc etc). It's implemented at the action engine level, so it will work with any action, even file or database writes.
I would be most interested in feedback on the new email feature, including clever use cases. I am sure it can be quite useful (especially if you think about imfile...), but would really appreciate to hear from you (and prove this in practice)!
Thanks,
Rainer Gerhards
Only logged in users are allowed to comment.
register/log in
