Thanks Rainer. This is great. I will create some of the custom string builder and put it back to your directory soon.
Sent from my HTC -----Original Message----- From: Rainer Gerhards <[email protected]> Sent: June 4, 2010 7:41 AM To: rsyslog-users <[email protected]> Subject: Re: [rsyslog] Where is the output modulefortheudptransportationtoremote syslog server John, David, I have just completed the implementation of this feature. The new code has been moved to the master branch and will probably released as a new version early next week. Details in my blog post (be sure to follow the links): http://blog.gerhards.net/2010/06/rsyslog-string-generators-done.html Any experience reports are appreciated. John, I think that you can use this for your project. The new modules are located in ./tools/sm*.[ch]. They are not in ./plugins because the current set are build-in modules, only. Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Wednesday, June 02, 2010 2:42 PM > To: rsyslog-users > Subject: Re: [rsyslog] Where is the output > modulefortheudptransportationtoremote syslog server > > I guess autoreconf -fvi (options!) is missing, please also see > > http://www.rsyslog.com/doc-build_from_repo.html > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of John Li > > Sent: Wednesday, June 02, 2010 4:57 AM > > To: rsyslog-users > > Subject: Re: [rsyslog] Where is the output module > > fortheudptransportationtoremote syslog server > > > > I cloned the rsyslog project and switched to master-templateFuncation > > but > > could not build it. Here is the output: > > > > [...@dev01 rsyslog]$ ./configure > > configure: error: cannot find install-sh or install.sh in "." "./.." > > "./../.." > > [...@dev01 rsyslog]$ autoconf > > configure.ac:29: warning: AC_CACHE_VAL(lt_prog_compiler_pic_works, > > ...): > > suspicious cache-id, must contain _cv_ to be cached > > ../../lib/autoconf/general.m4:1974: AC_CACHE_VAL is expanded from... > > ../../lib/autoconf/general.m4:1994: AC_CACHE_CHECK is expanded > from... > > aclocal.m4:621: AC_LIBTOOL_COMPILER_OPTION is expanded from... > > aclocal.m4:4829: AC_LIBTOOL_PROG_COMPILER_PIC is expanded from... > > aclocal.m4:2674: _LT_AC_LANG_C_CONFIG is expanded from... > > aclocal.m4:2673: AC_LIBTOOL_LANG_C_CONFIG is expanded from... > > aclocal.m4:86: AC_LIBTOOL_SETUP is expanded from... > > aclocal.m4:66: _AC_PROG_LIBTOOL is expanded from... > > aclocal.m4:31: AC_PROG_LIBTOOL is expanded from... > > configure.ac:29: the top level > > configure.ac:29: warning: AC_CACHE_VAL(lt_prog_compiler_static_works, > > ...): > > suspicious cache-id, must contain _cv_ to be cached > > aclocal.m4:666: AC_LIBTOOL_LINKER_OPTION is expanded from... > > configure.ac:29: warning: > AC_CACHE_VAL(lt_prog_compiler_pic_works_CXX, > > ...): > > suspicious cache-id, must contain _cv_ to be cached > > aclocal.m4:2751: _LT_AC_LANG_CXX_CONFIG is expanded from... > > aclocal.m4:2750: AC_LIBTOOL_LANG_CXX_CONFIG is expanded from... > > aclocal.m4:1810: _LT_AC_TAGCONFIG is expanded from... > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_static_works_CXX, > > ...): suspicious cache-id, must contain _cv_ to be cached > > configure.ac:29: warning: > AC_CACHE_VAL(lt_prog_compiler_pic_works_F77, > > ...): > > suspicious cache-id, must contain _cv_ to be cached > > aclocal.m4:3914: _LT_AC_LANG_F77_CONFIG is expanded from... > > aclocal.m4:3913: AC_LIBTOOL_LANG_F77_CONFIG is expanded from... > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_static_works_F77, > > ...): suspicious cache-id, must contain _cv_ to be cached > > configure.ac:29: warning: > AC_CACHE_VAL(lt_prog_compiler_pic_works_GCJ, > > ...): > > suspicious cache-id, must contain _cv_ to be cached > > aclocal.m4:4016: _LT_AC_LANG_GCJ_CONFIG is expanded from... > > aclocal.m4:4015: AC_LIBTOOL_LANG_GCJ_CONFIG is expanded from... > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_static_works_GCJ, > > ...): suspicious cache-id, must contain _cv_ to be cached > > > > In the same box, I am able to build with the 5.5.5 release download. > > > > Any idea? > > > > Thanks. > > > > > > -- > > John Jun Li > > [email protected] > > > > > > On Tue, Jun 1, 2010 at 1:03 PM, Rainer Gerhards > > <[email protected]>wrote: > > > > > David, John, > > > > > > I made excellent progress today (it looks like it pays to take a > few > > days > > > off). I have just committed a new version that contains the actual > > plugin > > > interface. I will work more on it tomorrow. If all goes well, the > > full > > > functionality may become available tomorrow :) [but no promises]. > > > > > > John may want to have a look at ./tools/smtradfile.c to get an idea > > of what > > > the module does and check if it is useful for him. > > > > > > Rainer > > > > > > > -----Original Message----- > > > > From: [email protected] [mailto:rsyslog- > > > > [email protected]] On Behalf Of [email protected] > > > > Sent: Tuesday, June 01, 2010 4:08 PM > > > > To: rsyslog-users > > > > Subject: Re: [rsyslog] Where is the output module for > > > > theudptransportationtoremote syslog server > > > > > > > > Ok, this looks like something I can test. I won't be working on > it > > > > today > > > > (I've been on a call since 4am local time so won't be doing much > of > > > > anything today:-) > > > > > > > > David Lang > > > > > > > > On Tue, 1 Jun 2010, Rainer Gerhards wrote: > > > > > > > > >> -----Original Message----- > > > > >> From: [email protected] [mailto:rsyslog- > > > > >> [email protected]] On Behalf Of John Li > > > > >> > > > > >> Hi Rainer, > > > > >> > > > > >> Sorry I didn't finish reading the long email yet as I just > dived > > > > into > > > > >> the > > > > >> ruleset module and tried to rewrite the message with submitMsg > > but > > > > no > > > > >> success yet. > > > > > > > > > > No problem, but keep on your mind that I have something boiling > > right > > > > now. I > > > > > will blog about it soon, but am currently tied in some other > > > > activity. But > > > > > have a look at this git commit: > > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=59227a861821b2e0e3 > > > > 7357c0 > > > > > 695f6b3d9f11dd9d > > > > > > > > > >> > > > > >> In general, the use case is for those SEM (Security Event > > > > Management). > > > > >> They > > > > >> have their recommended syslog format and it will be much > easier > > to > > > > >> convert > > > > >> the event in their format before send it over. > > > > > > > > > > My question is why you need to persist the string you generate. > > Do > > > > you use it > > > > > multiple times or just because you need to feed it ONE time > into > > ONE > > > > other > > > > > action? > > > > > > > > > > Rainer > > > > > > > > > >> I promise will read the long email and hope I can provide some > > > > useful > > > > >> things > > > > >> here. > > > > >> > > > > >> Thanks a lot for your work. > > > > >> > > > > >> -- > > > > >> John Jun Li > > > > >> [email protected] > > > > >> > > > > >> > > > > >> > > > > >> On Tue, Jun 1, 2010 at 6:32 AM, Rainer Gerhards > > > > >> <[email protected]>wrote: > > > > >> > > > > >>> John, > > > > >>> > > > > >>> quick question: > > > > >>> > > > > >>>> -----Original Message----- > > > > >>>> From: [email protected] [mailto:rsyslog- > > > > >>>> [email protected]] On Behalf Of John Li > > > > >>>> Sent: Monday, May 31, 2010 2:17 PM > > > > >>>> To: [email protected]; rsyslog-users > > > > >>>> Subject: Re: [rsyslog] Where is the output module for the > > > > >>>> udptransportationtoremote syslog server > > > > >>>> > > > > >>>> Thanks a lot. > > > > >>>> Currently i am stucked at the design that output module can > > not > > > > >> modify > > > > >>>> the msg to be seen by other output modules. > > > > >>> > > > > >>> While I think I understand why you need this functionality, I > > would > > > > >>> appreciate if you could elaborate on that need a bit. I am > > asking > > > > >> because I > > > > >>> want to understand the potential use cases (hopefully all) > > BEFORE I > > > > >> even > > > > >>> consider implementing a facility to support them. > > > > >>> > > > > >>> Also, do you have a comment to the longer message on template > > > > modules > > > > >> I > > > > >>> posted yesterday? > > > > >>> > > > > >>> Thanks, > > > > >>> Rainer > > > > >>> _______________________________________________ > > > > >>> rsyslog mailing list > > > > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > >>> http://www.rsyslog.com > > > > >>> > > > > >> _______________________________________________ > > > > >> rsyslog mailing list > > > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > >> http://www.rsyslog.com > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > > > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
