0

On this system, imagine that there is a program that detects whether or not it is day or night and sets and environment variable DAY. My environment variable DAY is picked up and used in this working fragment:

log {
    source {
        file("/var/log/special/xxx" flags(no-parse) );
    };
    destination {
        file("/var/log/special/yyy" template("`DAY` $MESSAGE\n"));
    };
};

But eventually I'll need to change DAY to "night". I experimented with global variables, but those are not retained between log messages nor can you use a rewrite rule and set DAY.

I think I could write a script that would run when it got dark that would update /etc/profile.d/day.csh

setenv DAY night

and do a systemctl restart syslog-ng

Wouldn't that put me at risk of losing some log messages? I am writing to tcp() and amqp() destinations that I would image would get aborted.

Would it be better to HUP it?

Is there an approach I missed?

3
  • This might better be done with python via a template: balabit.com/sites/default/files/documents/…
    – thrig
    Jan 31, 2017 at 21:03
  • Python in templates did the trick.
    – tpc1095
    Feb 6, 2017 at 22:16
  • Embedded Python turns out to be quite powerful. I was able to use Python to compute a result and I didn't even need the environment variable after all.
    – tpc1095
    Feb 9, 2017 at 22:24

1 Answer 1

0

If you are also using diskbuffer in syslog-ng (available in version 3.9) for the destinations, then you shouldn't lose messages during the restart on that side. (BTW, reloading the syslog-ng configuration should be enough, for example, syslog-ng-ctl reload). The source side might be more problematic if the message rate is very high and you are using unreliable protocols on the source side (for example, UDP).

But as thrig suggested, a better approach would be to write a template function in Python that queries an external process/environment variable.

1
  • This answer the loss of messages part
    – tpc1095
    Feb 9, 2017 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.