I have a rsyslog config file for an application that filters logs as so:
if $msg contains 'sid:31147' then ~ if $programname == 'myprog' then /var/log/myprog.log &~
The idea is that if the msg contains sid:31147 the message is to be discarded, otherwise forward the message to the specified log directory and discard.
My problem is that 31147 is the sid of a process which changes every time it is restarted. Is there any way to dynamically set the value of sid?
I'm looking for something along the lines of:
getsid=$(ps xao sid,comm | grep ossec-logcollec | cut -d' ' -f 1) if $msg contains 'sid:$getsid' then ~