Defined Type: rsyslog::rule

Defined in:
manifests/rule.pp

Overview

Adds a rule

This is used by the various rsyslog::rule::* Defined Types to apply rules to the system.

Feel free to use this Defined Type to add your own rules but remember that order matters!

In general, the order will be:

  • 05 - Data Source Rules

  • 06 - Console Rules

  • 07 - Drop Rules

  • 10 - Remote Rules

  • 20 - Other/Miscellaneous Rules

  • 99 - Local Rules

Examples:

Collect All kern.err Messages

rsyslog::rule { '99_collect_kernel_errors.conf':
  rule =>  "if prifilt('kern.err') then /var/log/kernel_errors.log"
}

Discard All info Messages

rsyslog::rule::other { '98_discard_info.conf':
  rule =>  "if prifilt('*.info') then stop"
}

Parameters:

  • name (Pattern['^[^/]\S+/\S+\.conf$'])

    The filename that you will be dropping into place

    • WARNING: This must NOT be an absolute path!

  • content (String)

    The exact content of the rule to place in the target file

See Also:



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# File 'manifests/rule.pp', line 42

define rsyslog::rule (
  String $content
) {
  if $name !~ Pattern['^[^/]\S+/\S+\.conf$'] {
    fail('The $name must be a valid un-pathed configuration file')
  }
  if !empty(grep([$name],'/.*/')) {
    fail('Error: You cannot have two slashes in the $name')
  }

  include '::rsyslog'

  $_name_array = split($name,'/')
  $_base_directory = "${::rsyslog::rule_dir}/${_name_array[0]}"

  if !defined(File[$_base_directory]) {
    file { $_base_directory:
      ensure  => 'directory',
      owner   => 'root',
      group   => 'root',
      recurse => true,
      purge   => true,
      force   => true,
      mode    => '0640'
    }
  }

  if !defined(File["${_base_directory}.conf"]) {
    file { "${_base_directory}.conf":
      ensure  => 'file',
      owner   => 'root',
      group   => 'root',
      mode    => '0640',
      content => "\$IncludeConfig ${_base_directory}/*.conf\n",
      notify  => Class['rsyslog::service']
    }
  }

  file { "${::rsyslog::rule_dir}/${name}":
    ensure  => 'file',
    owner   => 'root',
    group   => 'root',
    mode    => '0640',
    content => $content,
    notify  => Class['rsyslog::service']
  }
}