Version 7 builds on the new config language introduced in v6 and extends it. Other than v6, it not just only extends the config language, but provides considerable changes to core elements as well. The result is much more power and ease of use as well (this time that is not contradictionary).
In legacy config format, the asterisk denotes writing the message to all users. This is usually used for emergency messages and configured like this:
*.emerg *
Unfortunately, the use of this single character conflicts with other uses, for example with the multiplication operator. While rsyslog up to versions v7.4 preserves the meaning of asterisk as an action, it is deprecated and will probably be removed in future versions. Consequently, a warning message is emitted. To make this warning go away, the action must be explicitly given, as follows:
*.emerg :omusrmsg:*
The same holds true for user names. For example
*.emerg john
at a minimum should be rewritten as
*.emerg :omusrmsg:john
Of course, for even more clarity the new RainerScript style of action can also be used:
*.emerg action(type="omusrmsg" users="john")
In Rainer's blog, there is more background information on why omusrmsg needed to be changed available.
Both continue to work, but have been replaced by better alternatives.
The discard action (tilde character) has been replaced by the "stop" RainerScript directive. It is considered more intuitive and offers slightly better performance.
The omruleset module has been replaced by the "call" RainerScript directive. Call permits to execute a ruleset like a subroutine, and does so with much higher performance than omruleset did. Note that omruleset could be run off an async queue. This was more a side than a desired effect and is not supported by the call statement. If that effect was needed, it can simply be simulated by running the called rulesets actions asynchronously (what in any case is the right way to handle this).
Note that the deprecated modules emit warning messages when being used. They tell that the construct is deprecated and which statement is to be used as replacement. This does not affect operations: both modules are still fully operational and will not be removed in the v7 timeframe.
Some output plugins may not be able to detect if their target is capable of accepting data again after an error (technically, they always return OK when TryResume is called). Previously, the rsyslog core engine suspended such an action after 1000 succesive failures. This lead to potentially a large amount of errors and error messages. Starting with 7.2.1, this has been reduced to 10 successive failures. This still gives the plugin a chance to recover. In extreme cases, a plugin may now enter suspend mode where it previously did not do so. In practice, we do NOT expect that.
This documentation is part of the
rsyslog project.
Copyright © 2011-2013 by Rainer Gerhards and
Adiscon. Released under the GNU GPL
version 2 or higher.