Package: rsyslog
Version: 8.2512.0-2
Severity: minor
Tags: patch
Dear Maintainer,
>From "/usr/share/doc/debian/bug-reporting.txt.gz":
Don't file bugs upstream
If you file a bug in Debian, don't send a copy to the upstream software
maintainers yourself, as it is possible that the bug exists only in
Debian. If necessary, the maintainer of the package will forward the
bug upstream.
-.-
I do not send reports upstream if I have to get an account there.
The Debian maintainers have one already.
If I get a negative (or no) response from upstream, I send henceforth
bugs to Debian.
-.-
* What led up to the situation?
Checking for defects with a new version
test-[g|n]roff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z < "man page"
[Use
grep -n -e ' $' -e '\\~$' -e ' \\f.$' -e ' \\"' <file>
to find (most) trailing spaces.]
["test-groff" is a script in the repository for "groff"; is not shipped]
(local copy and "troff" slightly changed by me).
[The fate of "test-nroff" was decided in groff bug #55941.]
* What was the outcome of this action?
Output from "test-nroff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":
an.tmac:<stdin>:93: warning: cannot nest .TP or .TQ inside .TP; supply a tag
troff:<stdin>:540: warning [page 1, line 520]: cannot break line in l adjust
mode; overset by 2n
* What outcome did you expect instead?
No output (no warnings).
-.-
General remarks and further material, if a diff-file exist, are in the
attachments.
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 6.17.12+deb14-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1),
LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages rsyslog depends on:
ii libc6 2.42-6
ii libestr0 0.1.11-2
ii libfastjson4 1.2304.0-2
ii liblognorm5 2.0.9-1
ii libsystemd0 259-1
ii libuuid1 2.41.2-4
ii libzstd1 1.5.7+dfsg-2
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b2
Versions of packages rsyslog recommends:
ii logrotate 3.22.0-1
Versions of packages rsyslog suggests:
pn rsyslog-clickhouse <none>
ii rsyslog-doc 8.2512.0-2
pn rsyslog-docker <none>
pn rsyslog-elasticsearch <none>
pn rsyslog-gssapi <none>
pn rsyslog-hiredis <none>
pn rsyslog-kafka <none>
pn rsyslog-kubernetes <none>
pn rsyslog-mongodb <none>
pn rsyslog-mysql <none>
pn rsyslog-openssl | rsyslog-gnutls <none>
pn rsyslog-pgsql <none>
pn rsyslog-relp <none>
pn rsyslog-snmp <none>
-- no debconf information
Input file is rsyslog.conf.5
Output from "mandoc -T lint rsyslog.conf.5": (shortened list)
1 ERROR: skipping end of block that is not open: RE
124 STYLE: input text line longer than 80 bytes:
1 WARNING: line scope broken: TP breaks TP
1 WARNING: skipping paragraph macro: br before sp
1 WARNING: undefined escape, printing literally: \7
1 WARNING: undefined escape, printing literally: \\
Find most trailing spaces with:
grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>
-.-.
Output from
test-nroff -mandoc -t -ww -z rsyslog.conf.5: (shortened list)
1 cannot break line in l adjust mode; overset by 2n
1 cannot nest .TP or .TQ inside .TP; supply a tag
-.-.
Input file is rsyslog.conf.5
Change two HYPHEN-MINUSES (code 0x2D) to an em-dash (\(em),
if one is intended.
" \(em " creates a too big gap in the text (in "troff").
An en-dash is usually surrounded by a space,
while an em-dash is used without spaces.
"man" (1 byte characters in input) transforms an en-dash (\(en) to one
HYPHEN-MINUS,
and an em-dash to two HYPHEN-MINUSES without considering the space
around it.
If "--" are two single "-"
(begin of an option or end of options)
then use "\-\-".
rsyslog.conf.5:460: \\ = \\\\ --> '\\' is used to escape (as in C)
rsyslog.conf.5:728:by the string "--end". It denotes the end of the regular
expression and will not become part of it.
rsyslog.conf.5:731:expression is: "%msg:R:.*Sev:. \\(.*\\) \\[.*--end%"
-.-.
rsyslog.conf.5:4:.\" This file is part of the rsyslog package, an enhanced
system log daemon.
rsyslog.conf.5:805:.B https://www.rsyslog.com/doc/
-.-.
Use "\e" to print the escape character instead of "\\" (which gets
interpreted in copy mode).
446:contains a template. The backslash is an escape character. For example, \\7
rings the
447:bell (this is an ASCII value), \\n is a new line. The set in rsyslog is a
bit restricted
458: % = \\%
460: \\ = \\\\ --> '\\' is used to escape (as in C)
462:$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\\n"
490:("\'" and "\\") inside each field. Please note that in MySQL configuration,
the NO_BACKSLASH_ESCAPES
534:%syslogtag%%msg:::drop-last-lf%\\n"
542:%syslogtag%,%msg%\\n"
554:$template usermsg," XXXX%syslogtag%%msg%\\n\\r"
560:$template wallmsg,"\\r\\n\\7Message from syslogd@%HOSTNAME% at
%timegenerated%"
569:into systemevents\\r\\n", SQL
731:expression is: "%msg:R:.*Sev:. \\(.*\\) \\[.*--end%"
-.-.
Change a HYPHEN-MINUS (code 0x2D) to a minus(-dash) (\-),
if it
is in front of a name for an option,
is a symbol for standard input,
is a single character used to indicate an option,
or is in the NAME section (man-pages(7)).
N.B. - (0x2D), processed as a UTF-8 file, is changed to a hyphen
(0x2010, groff \[u2010] or \[hy]) in the output.
78:Input plugin for UDP syslog. Replaces the deprecated -r option. Can be
86:Input plugin for plain TCP syslog. Replaces the deprecated -t
168:below correspond to the similar LOG_-values in /usr/include/syslog.h.
262:file path with a minus sign ("-").
328:is happening with the system. To specify this wall(1)-feature use an
":omusrmsg:*".
334:use any other schema of your liking - you just need to define a proper
template and assign this
356:must start with a $-sign, e.g. if you would like to bind your output
channel definition "mychannel"
432:Every output in rsyslog uses templates - this holds true for files, user
460: \\ = \\\\ --> '\\' is used to escape (as in C)
479:See details below. Be sure NOT to mistake template options with property
options - the
520:it - among others, it takes some toll on the processing time. Not much, but
on
646:PRI part of the message - undecoded (single value)
652:the monitorware InfoUnitType - used when talking to a MonitorWare backend
(also for phpLogCon)
655:the facility from the message - in numerical form
658:the facility from the message - in text form
661:severity from the message - in numerical form
664:severity from the message - in text form
709:Properties starting with a $-sign are so-called system properties. These do
NOT stem from the
728:by the string "--end". It denotes the end of the regular expression and
will not become part of it.
731:expression is: "%msg:R:.*Sev:. \\(.*\\) \\[.*--end%"
777:drop control characters - the resulting string will neither contain control
characters, escape sequences nor any other replacement character like space.
-.-.
Find a repeated word
! 357 --> all
-.-.
Add a "\&" (or a comma (Oxford comma)) after an abbreviation
or use English words
(man-pages(7)).
Abbreviation points should be marked as such and protected against being
interpreted as an end of sentence, if they are not, and that independent
of the current place on the line.
175:specifies the subsystem that produced the message, i.e. all mail programs
log
356:must start with a $-sign, e.g. if you would like to bind your output
channel definition "mychannel"
610:or manipulate the value, e.g. by converting all characters to lower case.
649:the PRI part of the message in a textual form (e.g. "syslog.info")
719:(e.g. %msg:10:$%, which will extract from position 10 to the end of the
string).
-.-.
Wrong distance (not two spaces) between sentences in the input file.
Separate the sentences and subordinate clauses; each begins on a new
line. See man-pages(7) ("Conventions for source file layout") and
"info groff" ("Input Conventions").
The best procedure is to always start a new sentence on a new line,
at least, if you are typing on a computer.
Remember coding: Only one command ("sentence") on each (logical) line.
E-mail: Easier to quote exactly the relevant lines.
Generally: Easier to edit the sentence.
Patches: Less unaffected text.
Search for two adjacent words is easier, when they belong to the same line,
and the same phrase.
The amount of space between sentences in the output can then be
controlled with the ".ss" request.
Mark a final abbreviation point as such by suffixing it with "\&".
Some sentences (etc.) do not begin on a new line.
Split (sometimes) lines after a punctuation mark; before a conjunction.
Lines with only one (or two) space(s) between sentences could be split,
so latter sentences begin on a new line.
Use
#!/usr/bin/sh
sed -e '/^\./n' \
-e 's/\([[:alpha:]]\)\. */\1.\n/g' $1
to split lines after a sentence period.
Check result with the difference between the formatted outputs.
See also the attachment "general.bugs"
[List of affected lines removed.]
-.-.
Split lines longer than 80 characters (fill completely
an A4 sized page line on a terminal)
into two or more lines.
Appropriate break points are the end of a sentence and a subordinate
clause; after punctuation marks.
Add "\:" to split the string for the output, "\<newline>" in the source.
[List of affected lines removed.]
Longest line is number 771 with 245 characters
replace control characters (ASCII value 127 and values less then 32) with an
escape sequence. The sequence is "#<charval>" where charval is the 3-digit
decimal value of the control character. For example, a tabulator would be
replaced by "#009".
-.-.
Use \(en (en-dash) for a dash at the beginning (end) of a line,
or between space characters,
not a minus (\-) or a hyphen (-), except in the NAME section.
rsyslog.conf.5:1:.\" rsyslog.conf - rsyslogd(8) configuration file
rsyslog.conf.5:18:.\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
02111, USA.
rsyslog.conf.5:334:use any other schema of your liking - you just need to
define a proper template and assign this
rsyslog.conf.5:432:Every output in rsyslog uses templates - this holds true for
files, user
rsyslog.conf.5:479:See details below. Be sure NOT to mistake template options
with property options - the
rsyslog.conf.5:517:vulnerable to SQL injection. The sql option can also be
useful with files -
rsyslog.conf.5:520:it - among others, it takes some toll on the processing
time. Not much, but on
rsyslog.conf.5:646:PRI part of the message - undecoded (single value)
rsyslog.conf.5:652:the monitorware InfoUnitType - used when talking to a
MonitorWare backend (also for phpLogCon)
rsyslog.conf.5:655:the facility from the message - in numerical form
rsyslog.conf.5:658:the facility from the message - in text form
rsyslog.conf.5:661:severity from the message - in numerical form
rsyslog.conf.5:664:severity from the message - in text form
rsyslog.conf.5:777:drop control characters - the resulting string will neither
contain control characters, escape sequences nor any other replacement
character like space.
-.-.
The name of a man page is typeset in bold (or italic) and the section in
roman (see man-pages(7)).
167:Both facilities and priorities are described in syslog(3). The names
mentioned
187:In addition to the above mentioned names the rsyslogd(8) understands the
265:This version of rsyslogd(8) has support for logging output to named pipes
(fifos). A fifo or
268:the mkfifo(1) command before rsyslogd(8) is started.
328:is happening with the system. To specify this wall(1)-feature use an
":omusrmsg:*".
-.-.
Put a parenthetical sentence, phrase on a separate line,
if not part of a code.
See man-pages(7), item "semantic newline".
[List of affected lines removed.]
-.-.
FSF office address update. See
https://lists.gnu.org/archive/html/bug-gnulib/2024-09/msg00004.html
18:.\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
-.-.
Use a character "\(->" instead of plain "->" or "\->", if not typeset with
a constant width font.
460: \\ = \\\\ --> '\\' is used to escape (as in C)
-.-.
Only one space character is after a possible end of sentence
(after a punctuation, that can end a sentence).
[List of affected lines removed.]
-.-.
Add "\&" after an ellipsis, when it does not end a sentence.
231:An easier approach is probably to do if ... then based matching in script.
-.-.
Change comment lines of type '.\" ====' (and an empty '.\"' line) to
a single period, as they contain no information and waste work each time
they are processed.
3:.\"
5:.\"
10:.\"
15:.\"
19:.\"
-.-.
Output from "test-nroff -mandoc -t -K utf8 -rF0 -rHY=0 -rCHECKSTYLE=0 -ww -z ":
an.tmac:<stdin>:93: warning: cannot nest .TP or .TQ inside .TP; supply a tag
troff:<stdin>:540: warning [page 1, line 520]: cannot break line in l adjust
mode; overset by 2n
-.-
Generally:
Split (sometimes) lines after a punctuation mark; before a conjunction.
--- rsyslog.conf.5 2025-12-25 17:55:55.086990512 +0000
+++ rsyslog.conf.5.new 2025-12-25 18:58:45.108256491 +0000
@@ -1,8 +1,8 @@
.\" rsyslog.conf - rsyslogd(8) configuration file
.\" Copyright 2003-2008 Rainer Gerhards and Adiscon GmbH.
-.\"
-.\" This file is part of the rsyslog package, an enhanced system log daemon.
-.\"
+.
+.\" This file is part of the rsyslog package, an enhanced system log daemon.
+.
.\" This program is free software; you can redistribute it and/or modify
.\" it under the terms of the GNU General Public License as published by
.\" the Free Software Foundation; either version 2 of the License, or
@@ -12,11 +12,11 @@
.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\" GNU General Public License for more details.
-.\"
+.
.\" You should have received a copy of the GNU General Public License
.\" along with this program; if not, write to the Free Software
.\" Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
-.\"
+.
.TH RSYSLOG.CONF 5 "18 February 2025" "Version 8.2502.0" "Linux System
Administration"
.SH NAME
rsyslog.conf \- rsyslogd(8) configuration file
@@ -75,7 +75,7 @@ SQLite, Ingres, Oracle, mSQL)
Input module for text files
.TP
.I imudp
-Input plugin for UDP syslog. Replaces the deprecated -r option. Can be
+Input plugin for UDP syslog. Replaces the deprecated \-r option. Can be
used like this:
.IP
$ModLoad imudp
@@ -83,14 +83,13 @@ $ModLoad imudp
$UDPServerRun 514
.TP
.I imtcp
-Input plugin for plain TCP syslog. Replaces the deprecated -t
+Input plugin for plain TCP syslog. Replaces the deprecated \-t
option. Can be used like this:
.IP
$ModLoad imtcp
.IP
$InputTCPServerRun 514
.TP
-.TP
.I imrelp
Input plugin for the RELP protocol. RELP can be used instead
of UDP or plain TCP syslog to provide reliable delivery of
@@ -164,7 +163,9 @@ a pattern of facilities and priorities b
The selector field itself again consists of two parts, a facility and a
priority, separated by a period ('.'). Both parts are case insensitive and can
also be specified as decimal numbers, but don't do that, you have been warned.
-Both facilities and priorities are described in syslog(3). The names mentioned
+Both facilities and priorities are described in
+.BR syslog (3).
+The names mentioned
below correspond to the similar LOG_-values in /usr/include/syslog.h.
The facility is one of the following keywords: auth, authpriv, cron, daemon,
@@ -172,7 +173,7 @@ kern, lpr, mail, mark, news, security (s
local0 through local7. The keyword security should not be used anymore and mark
is only for internal use and therefore should not be used in applications.
Anyway, you may want to specify and redirect these messages here. The facility
-specifies the subsystem that produced the message, i.e. all mail programs log
+specifies the subsystem that produced the message, i.e.\& all mail programs log
with the mail facility (LOG_MAIL) if they log using syslog.
The priority is one of the following keywords, in ascending order: debug, info,
@@ -184,7 +185,9 @@ The behavior of the original BSD syslogd
priority and higher are logged according to the given action. Rsyslogd behaves
the same, but has some extensions.
-In addition to the above mentioned names the rsyslogd(8) understands the
+In addition to the above mentioned names the
+.BR rsyslogd (8)
+understands the
following extensions: An asterisk ('*') stands for all facilities or all
priorities, depending on where it is used (before or after the period). The
keyword none stands for no priority of the given facility.
@@ -228,7 +231,7 @@ BSD syslog selector:
*.debug;local6.!=info;local6.!=notice;local6.!=warn
-An easier approach is probably to do if ... then based matching in script.
+An easier approach is probably to do if ...\& then based matching in script.
.SH ACTIONS
The action field of a rule describes what to do with the message. In general,
message content
@@ -259,13 +262,19 @@ directive or the "sync" parameter to omf
degrades performance and it is advised not to enable syncing unless
you know what you are doing.
To selectively disable syncing for certain files, you may prefix the
-file path with a minus sign ("-").
+file path with a minus sign ("\-").
.SS Named pipes
-This version of rsyslogd(8) has support for logging output to named pipes
(fifos). A fifo or
+This version of
+.BR rsyslogd (8)
+has support for logging output to named pipes (fifos). A fifo or
named pipe can be used as a destination for log messages by prepending a pipe
symbol ('|')
to the name of the file. This is handy for debugging. Note that the fifo must
be created with
-the mkfifo(1) command before rsyslogd(8) is started.
+the
+.BR mkfifo (1)
+command before
+.BR rsyslogd (8)
+is started.
.SS Terminal and console
If the file you specified is a tty, special tty-handling is done, same with
/dev/console.
@@ -325,13 +334,15 @@ get the message (for example: ":omusrmsg
.SS Everyone logged on
Emergency messages often go to all users currently online to notify them that
something strange
-is happening with the system. To specify this wall(1)-feature use an
":omusrmsg:*".
+is happening with the system. To specify this
+.BR wall (1)-feature
+use an ":omusrmsg:*".
.SS Database table
This allows logging of the message to a database table.
By default, a MonitorWare-compatible schema is required for this to work. You
can
create that schema with the createDB.SQL file that came with the rsyslog
package. You can also
-use any other schema of your liking - you just need to define a proper
template and assign this
+use any other schema of your liking \(en you just need to define a proper
template and assign this
template to the action.
See the HTML documentation for further details on database logging.
@@ -353,8 +364,8 @@ Discard is just the single 'stop' comman
.SS Output channel
Binds an output channel definition (see there for details) to this action.
Output channel actions
-must start with a $-sign, e.g. if you would like to bind your output channel
definition "mychannel"
-to the action, use "$mychannel". Output channels support template definitions
like all all other
+must start with a $-sign, e.g.\& if you would like to bind your output channel
definition "mychannel"
+to the action, use "$mychannel". Output channels support template definitions
like all other
actions.
.SS Shell execute
@@ -377,7 +388,6 @@ Rsyslog offers three different types "fi
* property-based filters
.sp 0
* expression-based filters
-.RE
.SS Selectors
.B Selectors are the traditional way of filtering syslog messages.
@@ -429,7 +439,7 @@ See the HTML documentation for this feat
.SH TEMPLATES
-Every output in rsyslog uses templates - this holds true for files, user
+Every output in rsyslog uses templates \(en this holds true for files, user
messages and so on. Templates compatible with the stock syslogd
formats are hardcoded into rsyslogd. If no template is specified, we use
one of these hardcoded templates. Search for "template_" in syslogd.c and
@@ -439,12 +449,12 @@ A template consists of a template direct
and optional options. A sample is:
.RS
-.B $template MyTemplateName,"\\\\7Text %property% some more
text\\\\n",<options>
+.B $template MyTemplateName,"\e7Text %property% some more text\en",<options>
.RE
The "$template" is the template directive. It tells rsyslog that this line
-contains a template. The backslash is an escape character. For example, \\7
rings the
-bell (this is an ASCII value), \\n is a new line. The set in rsyslog is a bit
restricted
+contains a template. The backslash is an escape character. For example, \e7
rings the
+bell (this is an ASCII value), \en is a new line. The set in rsyslog is a bit
restricted
currently.
All text in the template is used literally, except for things within percent
@@ -455,11 +465,11 @@ section of this manpage.
To escape:
.sp 0
- % = \\%
+ % = \e%
.sp 0
- \\ = \\\\ --> '\\' is used to escape (as in C)
+ \e = \e\e \-\-> '\e' is used to escape (as in C)
.sp 0
-$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\\n"
+$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg%\en"
Properties can be accessed by the property replacer (see there for details).
@@ -476,7 +486,7 @@ result in something like "/var/log/syste
.SS Template options
The <options> part is optional. It carries options influencing the template as
whole.
-See details below. Be sure NOT to mistake template options with property
options - the
+See details below. Be sure NOT to mistake template options with property
options \(en the
later ones are processed by the property replacer and apply to a SINGLE
property, only
(and not the whole template).
@@ -487,7 +497,7 @@ Template options are case-insensitive. C
sql
format the string suitable for a SQL statement in MySQL format. This will
replace single
quotes ("'") and the backslash character by their backslash-escaped counterpart
-("\'" and "\\") inside each field. Please note that in MySQL configuration,
the NO_BACKSLASH_ESCAPES
+("\'" and "\e") inside each field. Please note that in MySQL configuration,
the NO_BACKSLASH_ESCAPES
mode must be turned off for this format to work (this is the default).
.TP
@@ -514,10 +524,10 @@ So you yourself must make sure you are u
Please note that the database writer *checks* that the sql option is present
in the template. If it is not present, the write database action is disabled.
This is to guard you against accidental forgetting it and then becoming
-vulnerable to SQL injection. The sql option can also be useful with files -
+vulnerable to SQL injection. The sql option can also be useful with files \(en
especially if you want to import them into a database on another machine for
performance reasons. However, do NOT use it if you do not have a real need for
-it - among others, it takes some toll on the processing time. Not much, but on
+it \(en among others, it takes some toll on the processing time. Not much, but
on
a really busy system you might notice it ;)
The default template for the write to database action has the sql option set.
@@ -531,15 +541,15 @@ A template that resembles traditional sy
.RS
$template TraditionalFormat,"%timegenerated% %HOSTNAME%
.sp 0
-%syslogtag%%msg:::drop-last-lf%\\n"
+%syslogtag%%msg:::drop-last-lf%\en"
.RE
A template that tells you a little more about the message:
.sp
.RS
-$template
precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%,
+$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,
.sp 0
-%syslogtag%,%msg%\\n"
+%HOSTNAME%,%syslogtag%,%msg%\en"
.RE
A template for RFC 3164 format:
@@ -551,13 +561,13 @@ $template RFC3164fmt,"<%PRI%>%TIMESTAMP%
A template for the format traditionally used for user messages:
.sp
.RS
-$template usermsg," XXXX%syslogtag%%msg%\\n\\r"
+$template usermsg," XXXX%syslogtag%%msg%\en\er"
.RE
And a template with the traditional wall-message format:
.sp
.RS
-$template wallmsg,"\\r\\n\\7Message from syslogd@%HOSTNAME% at %timegenerated%"
+$template wallmsg,"\er\en\e7Message from syslogd@%HOSTNAME% at %timegenerated%"
.RE
.B A template that can be used for writing to a database (please note the SQL
template option)
@@ -566,7 +576,7 @@ $template wallmsg,"\\r\\n\\7Message from
.ad l
$template MySQLInsert,"insert iut, message, receivedat values
('%iut%', '%msg:::UPPERCASE%', '%timegenerated:::date-mysql%')
-into systemevents\\r\\n", SQL
+into systemevents\er\en", SQL
NOTE 1: This template is embedded into core application under name
.B StdDBFmt
@@ -607,7 +617,7 @@ name plus ":omfile:$" in front of it. A
The property replacer is a core component in rsyslogd's output system. A
syslog message has
a number of well-defined properties (see below). Each of this properties can
be accessed and
manipulated by the property replacer. With it, it is easy to use only part of
a property value
-or manipulate the value, e.g. by converting all characters to lower case.
+or manipulate the value, e.g.\& by converting all characters to lower case.
.SS Accessing Properties
Syslog message properties are used inside templates. They are accessed by
putting them between
@@ -643,25 +653,25 @@ the "static" part of the tag, as defined
programname is "named".
.TP
.B PRI
-PRI part of the message - undecoded (single value)
+PRI part of the message \(en undecoded (single value)
.TP
.B PRI-text
-the PRI part of the message in a textual form (e.g. "syslog.info")
+the PRI part of the message in a textual form (e.g.\& "syslog.info")
.TP
.B IUT
-the monitorware InfoUnitType - used when talking to a MonitorWare backend
(also for phpLogCon)
+the monitorware InfoUnitType \(en used when talking to a MonitorWare backend
(also for phpLogCon)
.TP
.B syslogfacility
-the facility from the message - in numerical form
+the facility from the message \(en in numerical form
.TP
.B syslogfacility-text
-the facility from the message - in text form
+the facility from the message \(en in text form
.TP
.B syslogseverity
-severity from the message - in numerical form
+severity from the message \(en in numerical form
.TP
.B syslogseverity-text
-severity from the message - in text form
+severity from the message \(en in text form
.TP
.B timegenerated
timestamp when the message was RECEIVED. Always in high resolution
@@ -716,7 +726,7 @@ the message text, you can use this synta
but you want to specify options, you still need to include the colons. For
example, if you would
like to convert the full message text to lower case, use "%msg:::lowercase%".
If you would like to
extract from a position until the end of the string, you can place a
dollar-sign ("$") in toChar
-(e.g. %msg:10:$%, which will extract from position 10 to the end of the
string).
+(e.g.\& %msg:10:$%, which will extract from position 10 to the end of the
string).
There is also support for
.B regular expressions.
@@ -725,10 +735,10 @@ This tells rsyslog that a regular expres
actual regular expression
.B must
then be provided in toChar. The regular expression must be followed
-by the string "--end". It denotes the end of the regular expression and will
not become part of it.
+by the string "\-\-end". It denotes the end of the regular expression and will
not become part of it.
If you are using regular expressions, the property replacer will return the
part of the property text
that matches the regular expression. An example for a property replacer
sequence with a regular
-expression is: "%msg:R:.*Sev:. \\(.*\\) \\[.*--end%"
+expression is: "%msg:R:.*Sev:. \e(.*\e) \e[.*\-\-end%"
Also, extraction can be done based on so-called "fields". To do so, place a
"F" into FromChar. A field
in its current definition is anything that is delimited by a delimiter
character. The delimiter by
@@ -774,7 +784,7 @@ space-cc
replace control characters by spaces
.TP
drop-cc
-drop control characters - the resulting string will neither contain control
characters, escape sequences nor any other replacement character like space.
+drop control characters \(en the resulting string will neither contain control
characters, escape sequences nor any other replacement character like space.
.SH QUEUED OPERATIONS
Rsyslogd supports queued operations to handle offline outputs
Any program (person), that produces man pages, should check the output
for defects by using (both groff and nroff)
[gn]roff -mandoc -t -ww -b -z -K utf8 <man page>
To find trailing space use
grep -n -e ' $' -e ' \\f.$' -e ' \\"' <man page>
The same goes for man pages that are used as an input.
-.-
For a style guide use
mandoc -T lint
-.-
For general input conventions consult the man page "nroff(7)" (item
"Input conventions") or the Texinfo manual about the same item.
-.-
Any "autogenerator" should check its products with the above mentioned
'groff', 'mandoc', and additionally with 'nroff ...'.
It should also check its input files for too long (> 80) lines.
This is just a simple quality control measure.
The "autogenerator" may have to be corrected to get a better man page,
the source file may, and any additional file may.
-.-
Common defects:
Not removing trailing spaces (in in- and output).
The reason for these trailing spaces should be found and eliminated.
"git" has a "tool" to point out whitespace,
see for example "git-apply(1)" and git-config(1)")
-.-
Not beginning each input sentence on a new line.
Line length and patch size should thus be reduced when that has been fixed.
The script "reportbug" uses 'quoted-printable' encoding when a line is
longer than 1024 characters in an 'ascii' file.
See man-pages(7), item "semantic newline".
-.-
The difference between the formatted output of the original
and patched file can be seen with:
nroff -mandoc <file1> > <out1>
nroff -mandoc <file2> > <out2>
diff -d -u <out1> <out2>
and for groff, using
\"printf '%s\n%s\n' '.kern 0' '.ss 12 0' | groff -mandoc -Z - \"
instead of 'nroff -mandoc'
Add the option '-t', if the file contains a table.
Read the output from 'diff -d -u ...' with 'less -R' or similar.
-.-.
If 'man' (man-db) is used to check the manual for warnings,
the following must be set:
The option "-warnings=w"
The environmental variable:
export MAN_KEEP_STDERR=yes (or any non-empty value)
or
(produce only warnings):
export MANROFFOPT="-ww -b -z"
export MAN_KEEP_STDERR=yes (or any non-empty value)
-.-
