Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to handle part of a log with a program:

if $programname == 'Security-Alert' then |/usr/local/bin/handler

The handler script works if I call echo blabla | /usr/local/bin/handler.

Now I got no output with logger -t Security-Alert 'This is an alert'

Debug output:

5210.871815399:b75a66c0: requested to include config file '/etc/rsyslog.d/60-sec.conf'
5210.871846408:b75a66c0: cfline: 'if $programname == 'Security-Alert' then |/usr/local/bin/handler'
5210.871865404:b75a66c0:  - general expression-based filter
5210.871886077:b75a66c0: skipped whitespace, stream now '$programname == 'Security-Alert' then |/usr/local/bin/handler'
5210.871907588:b75a66c0: ctok_token 0x8206dc8: token: 13
5210.871936361:b75a66c0: expr 0x8206a78: MSGVAR
5210.871959828:b75a66c0: skipped whitespace, stream now '== 'Security-Alert' then |/usr/local/bin/handler'
5210.871977706:b75a66c0: ctok_token 0x8206dc8: token: 100
5210.872020448:b75a66c0: expr 0x8206a78: cmp
5210.872041959:b75a66c0: skipped whitespace, stream now ''Security-Alert' then |/usr/local/bin/handler'
5210.872060397:b75a66c0: ctok_token 0x8207630: token: 14
5210.872079952:b75a66c0: expr 0x8206a78: simpstr
5210.872109005:b75a66c0: skipped whitespace, stream now 'then |/usr/local/bin/handler'
5210.872125766:b75a66c0: skipped whitespace, stream now 'then |/usr/local/bin/handler'
5210.872146439:b75a66c0: ctok_token 0x8207630: token: 18
5210.872166832:b75a66c0: expr 0x8206a78: successfully parsed/created expression
5210.872187225:b75a66c0: tried selector action for builtin-file: -2001
5210.872229408:b75a66c0: tried selector action for builtin-pipe: 0
5210.872246170:b75a66c0: Module builtin-pipe processed this config line.
5210.872269915:b75a66c0: template: 'RSYSLOG_TraditionalFileFormat' assigned
5210.872286677:b75a66c0: info: firehose mode disabled for action because iExecEveryNthOccur=0, ReduceRepeated=1, iSecsExecOnceInterval=0
5210.872309305:b75a66c0: action 11 queue: save on shutdown 1, max disk space allowed 0
5210.872340034:b75a66c0: action 11 queue: type 3, enq-only 0, disk assisted 0, maxFileSz 1048576, lqsize 0, pqsize 0, child 0, full delay 970, light delay 700, deq batch size 16 starting
5210.872360148:b75a66c0: Action 0x8207868: queue 0x8207910 created
5210.872378307:b75a66c0: selector line successfully processed

Anyone got a hint?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["                       <li><a href=\"//area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"//careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\n                </div>\n            </div>\n\n            <div id=\"copyright\">\n                site design / logo &#169; 2016 Stack Exchange Inc; user contributions licensed under <a href=\"https://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\n            </div>\n            <div id=\"svnrev\">\n                rev 2016.2.10.3242\n            </div>\n            \n        </div>\n    </div>\n    <noscript>\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\n    </noscript>\n<scrip"], "copyright__copyright__copyright": [" action 11 queue: type 3, enq-only 0, disk assisted 0, maxFileSz 1048576, lqsize 0, pqsize 0, child 0, full delay 970, light delay 700, deq batch size 16 starting\n5210.872360148:b75a66c0: Action 0x8207868: queue 0x8207910 created\n5210.872378307:b75a66c0: selector line successfully processed\n\nAnyone got a hint?\n\nshare|improve this question\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nBrowse other questions tagged or ask your own question."]}