Skip to main content

Parámetros de configuración

El plugin se configura mediante un fichero de configuración externo. Este archivo de configuración tiene una serie de parámetros «generales» , una serie de parámetros específicos para cada registro, y un conjunto de parámetros específicos para cada bloque de expresión regular.

Parametros generales

  • include
    Hace una llamada a otro fichero de configuración. Se puede anidar sin límite, y su orden de carga es secuencial.
    Es importante llamar a ficheros con rutas absolutas.
  • index_dir
    Utiliza este directorio para almacenar los archivos de índice. El plugin debe poder escribir y leer en el directorio
  • logfile
    Archivo de registro del plugin.

Parametros específicos de log

7.2.1. log_begin y log_end
Set marks of the beginning and end of a file definition logparser.log
7.2.2. log_module_name
Module name generated by the plugin.
7.2.3. log_type
Log module type, can be of three types:
• return_ocurrences: Returns a numeric data with the number of occurrences.
• return_lines: Returns the log lines that do match.
• return_message: Returns a message specified by the configuration file

7.2.4. log_rotate_mode
Can be of inode type or md5 type. This is the type detection is done to know if a log is rotated or
not.
7.2.5. log_force_readall
When this token is present, the log parser processes all the log from the beginning if you have not
already done (Is the first time I opened or detects a rotation). NOTE: You can generate large
volumes of data.
7.2.6. log_location_exec
Executes the specified command to obtain the name (absolute path) file to be processed.
7.2.7. log_location_filename
Specific the log name (absolute path) file to process.
7.2.8. log_location_multiple
Give you a way to specify a file or serveral files by using a wildcard, for example:
/tmp/apache/file_log*
or
/tmp/system*/mail*
Used in combination with log_create_module_for_each_log it will create a different module per
logfile or put all the information from different files in the same module.
7.2.9. log_create_module_for_each_log
If used with “log_location_multiple” will force the plugin to generate a different module for each
logfile.

Definicion de expresiones regulares

Para entender cada elemento, a continuación se muestra un ejemplo de fichero de configuración.

# Include, to load extenal/aditional configuration files
# include /tmp/my_other_configuration.conf

# Directory where temporal indexes will be stored (/tmp by default)
#index_dir /tmp

# Log problems with the logparser, (/tmp/pandora_logparser.log by default)
#logfile /tmp/pandora_logparser.log

# Sample of a single log match
log_begin
log_module_name Weekly
log_location_file /var/log/weekly.out
log_description Errors cannot find
log_type return_lines
log_regexp_begin
log_regexp_rule output
log_regexp_severity WARNING
log_return_message Cannot find process to run
log_regexp_end
log_end

# Sample of wildcard matching of several logfiles within the same module
log_begin
log_rotate_mode md5
log_module_name system_log
log_force_readall
log_location_multiple /var/log/system.log*
log_description Errors cannot find
log_type return_lines
log_regexp_begin
log_regexp_rule Cannot
log_regexp_severity WARNING
log_return_message Cannot find process to run
log_regexp_end
log_end

# Sample of several wildcard matching on the same file
log_begin
log_module_name hits_apache
log_location_file /var/log/apache2
log_description Access log from Apache, we will get the integria access
#log_create_module_for_each_log
log_type return_ocurrences
log_regexp_begin
log_regexp_rule Error -($1)\-($2) [0-9a-zA-Z]*
log_regexp_severity WARNING
log_return_message Otro bonito texto de error
log_regexp_end
log_regexp_begin
log_regexp_rule File\sdoes\snot\sexist
log_regexp_severity WARNING
log_regexp_end
log_regexp_begin
log_regexp_rule pandora_backend\.html
log_regexp_severity WARNING
log_return_message Something possible harmful happen
log_regexp_end
log_end

# Sample of wildcard matching of several logfiles with diferent dynamic modules
log_begin
log_rotate_mode inode
log_module_name test_log
log_force_readall
# If enabled, this token will create a different module using the module_name
# provided plus the full logfilename replacing / with " ".
log_create_module_for_each_log
log_location_multiple /tmp/log*/hola*
log_description Errors cannot find
log_type return_lines
log_regexp_begin
log_regexp_rule adios
log_regexp_severity WARNING
log_return_message Cannot find process to run
log_regexp_end
log_end

Back to top