337a9dbcf4
### Why I did it Currently there is only rsyslog plugin support for /var/log/syslog, meaning we do not detect events that occur in frr logs such as BGP Hold Timer Expiry that appears in frr/bgpd.log. ##### Work item tracking - Microsoft ADO **(number only)**: 13366345 #### How I did it Add omprog action to frr/bgpd.log and frr/zebra.log. Add appropriate regex for both events. #### How to verify it sonic-mgmt test case
40 lines
941 B
Plaintext
40 lines
941 B
Plaintext
## Quagga rules
|
|
|
|
template(name="prog_msg" type="list") {
|
|
property(name="msg")
|
|
constant(value="\n")
|
|
}
|
|
|
|
$ModLoad omprog
|
|
|
|
if re_match($programname, "bgp[0-9]*#(frr|zebra|staticd|watchfrr)") then {
|
|
/var/log/frr/zebra.log
|
|
action(type="omprog"
|
|
binary="/usr/bin/rsyslog_plugin -r /etc/rsyslog.d/zebra_regex.json -m sonic-events-bgp"
|
|
output="/var/log/rsyslog_plugin.log"
|
|
template="prog_msg")
|
|
stop
|
|
}
|
|
|
|
if re_match($programname, "bgp[0-9]*#bgpd") then {
|
|
/var/log/frr/bgpd.log
|
|
action(type="omprog"
|
|
binary="/usr/bin/rsyslog_plugin -r /etc/rsyslog.d/bgpd_regex.json -m sonic-events-bgp"
|
|
output="/var/log/rsyslog_plugin.log"
|
|
template="prog_msg")
|
|
stop
|
|
}
|
|
|
|
## Teamd rules
|
|
|
|
if $programname contains "teamd_" then {
|
|
/var/log/teamd.log
|
|
stop
|
|
}
|
|
|
|
## telemetry rules
|
|
if $msg startswith " telemetry" or ($msg startswith " dialout" )then {
|
|
/var/log/telemetry.log
|
|
stop
|
|
}
|