Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a rsyslog config file for an application that filters logs as so:

if $msg contains 'sid:31147' then ~
if $programname == 'myprog' then /var/log/myprog.log

The idea is that if the msg contains sid:31147 the message is to be discarded, otherwise forward the message to the specified log directory and discard.
My problem is that 31147 is the sid of a process which changes every time it is restarted. Is there any way to dynamically set the value of sid?

I'm looking for something along the lines of:

getsid=$(ps xao sid,comm | grep ossec-logcollec | cut -d' ' -f 1)
if $msg contains 'sid:$getsid' then ~
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.