Ok,I figured this out. I probably worded my issue badly but what i was looking for is the following:#this sets a variable at the entry[#] leveldefvar syslog /files/etc/syslog.conf/*[ ./action/file = "/var/log/messages"]#these two add in the new selector entries.set $syslog/selector[last() + 1]/facility local6set $syslog/selector[last() + 1]/facility local7#Now we put the selector[#] into a new variabledefvar syslog_selector1 $syslog/*[./facility = "local6"]defvar syslog_selector2 $syslog/*[./facility = "local7"]#configure the level for the two new entriesset $syslog_selector1/level noneset $syslog_selector2/level none#stupid bug in syslog.augrm $syslog/actionset $syslog/action/file /var/log/messages#save the changessaveThe bug, for some reason action and file has to be listed after all the selector entries. I have not checked for an updated syslog.aug this is on centos 5.10.I was able to write an augeas type for thisaugeas { "syslog_local6none":
incl => "/etc/syslog.conf",
lens => "Syslog.lns",
changes => [
"defvar syslog *[ ./action/file = \"/var/log/messages\" ]",
"set \$syslog/selector[last() + 1]/facility local6",
"defvar syslog_selector \$syslog/*[ ./facility = \"local6\" ]",
"set \$syslog_selector/level none",
# "rm \$syslog/action",
# "set \$syslog/action/file /var/log/messages",
],
}
Hopefully this helps someone else as I spent way too much time figuring this out...
augeas { "syslog_local6none":
incl => "/etc/syslog.conf",
lens => "Syslog.lns",
changes => [
"defvar syslog *[ ./action/file = \"/var/log/messages\" ]",
"set \$syslog/selector[last() + 1]/facility local6",
"defvar syslog_selector \$syslog/*[ ./facility = \"local6\" ]",
"set \$syslog_selector/level none",
# "rm \$syslog/action",
# "set \$syslog/action/file /var/log/messages",
],
onlyif => 'match *[ ./action/file = "/var/log/messages" ]/selector[facility = "local6" and level = "none" ] size == 0'
}
So as you can see, in the onlyif line, you can use expressions in the []'s and continue on to a lower level. On top of that you can use and and or's in those. I dont know why that type of expression is not documented well. If I didnt need to wipe out the action, it would make the manifest much shorter and ditch the need for the variables.