On Tue, 3 Mar 2009, Daniel Anson wrote: > Does anyone know of a quick and easy template to remove the double quote > character from a %msg% before it is inserted into the database (MySQL in > my case). I have a %msg% that looks like this: > > user pid=21214 uid=0 auid=4294967295 msg='PAM setcred: user="oracle" > exe="/bin/su" (hostname=?, addr=?, terminal=? result=Success)' > > I am reading the %msg% from the MySQL database and returning it in JSON > formatting. When it encounters a double-quote character, it causes > issues. I can always fix the program that returns it in JSON, but I > think rsyslog can pre-fix the %msg%.
you will need to change the mySQL template in rsyslog I think you have two options. 1. you can put any valid SQL in the rsyslog config that does the insert, so write SQL that eliminates the quote 2. I think you can change the template to remove the quotes before sending it to MySQL (but this may end up removing quotes needed for MySQL to work) David Lang _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
