move generic syslog patterns to the end of syslog.cfg so we can ignore patterns first

3 files changed, 7 insertions, 2 deletions

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog_header.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_header.cfg
new file mode 100644
index 00000000..f60d752b
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_header.cfg
@@ -0,0 +1 @@
+/var/log/syslog
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg
index f3505c1c..450b9e90 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg
@@ -1,4 +1,3 @@
-/var/log/syslog
 # some general patterns
  C panic
  C Oops
diff --git a/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp b/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp
index ac3dda64..c927780d 100644
--- a/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/logwatch/syslog.pp
@@ -5,9 +5,14 @@ class site_check_mk::agent::logwatch::syslog {
   }
 
   concat::fragment { 'syslog_header':
-    source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog.cfg',
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog_header.cfg',
     target => '/etc/check_mk/logwatch.d/syslog.cfg',
     order  => '01';
   }
+  concat::fragment { 'syslog_tail':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/syslog_tail.cfg',
+    target => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order  => '99';
+  }
 
 }