Rsyslog prepend text to messages in certain facility

user609425

5/8/24, 8:27 PM

OS: Debian 11 Rsyslog version 8.2102 Squid version 4.13

I am attempted to remote log squid logs without going through a file. I am using the following logging line for the store log in squid.conf:

cache_store_log syslog:local:6

These store logs appear in journal, so they are skipping the standard log file as intended.

When these logs are generated, they are not meaningfully distinguishable from the squid access logs. So in order to process these logs correctly, I want to add a string to the beginning of all local6 logs, something like squid-store

In rsyslog.conf I have the following relevant lines:

$template squidstore_tagged,"squid-store %msg%\n"
local6.* @192.168.3.2:1514;squidstore_tagged

*.* @192.168.3.2:1514

And although the rsyslog process restarts without error, and the squid store logs do arrive at the remote server, they are not tagged with "squid-store". I then attempted this configuration for troubleshooting, but the logs still arrived at the remote server:

#$template squidstore_tagged,"squid-store %msg%\n"
#local6.* @192.168.3.2:1514;squidstore_tagged
local6.* /dev/null
*.* @192.168.3.2:1514

How can I tag the logs coming from squid store with some text prior to being sent remotely?

1 + 0

squid

rsyslog

Score:0

Server

meuh

5/9/24, 6:09 AM

I'm not a squid user, but the documentation on v4 cache_store_log refers to access_log for the format to use, and it seems to be more like:

cache_store_log syslog:local6.info

Also, note that in the rsyslog.conf file, you should probably add a "stop" line below the filter line, for example:

local6.* @192.168.3.2:1514;squidstore_tagged
& stop

This stops further processing of the matched message, so you don't also log it locally.

+ 1

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Rsyslog prepend text to messages in certain facility

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.