Hi Rainer, The system is giving error like " rsyslogd-2159: Template 'TestTemplate': error -2159 defining template via strgen module [try http://www.rsyslog.com/e/2159 ]" when I try to use my strgen module with the test template.
I traced the call to FindStrgen and found the pStrgenLstRoot has only the four standard strgen there. I guess that I need to find a place to add the new strgen module there but exhausted my ideas on where that could be. Can you please give some hint? Thanks a lot. -- John Jun Li [email protected] On Fri, Jun 4, 2010 at 8:31 AM, John Li <[email protected]> wrote: > Thanks Rainer. This is great. I will create some of the custom string > builder and put it back to your directory soon. > > Sent from my HTC > > -----Original Message----- > From: Rainer Gerhards <[email protected]> > Sent: June 4, 2010 7:41 AM > To: rsyslog-users <[email protected]> > Subject: Re: [rsyslog] Where is the output > modulefortheudptransportationtoremote syslog server > > > John, David, > > I have just completed the implementation of this feature. The new code has > been moved to the master branch and will probably released as a new version > early next week. > > Details in my blog post (be sure to follow the links): > > http://blog.gerhards.net/2010/06/rsyslog-string-generators-done.html > > Any experience reports are appreciated. > > John, I think that you can use this for your project. The new modules are > located in ./tools/sm*.[ch]. They are not in ./plugins because the current > set are build-in modules, only. > > Rainer > > > -----Original Message----- > > From: [email protected] [mailto:rsyslog- > > [email protected]] On Behalf Of Rainer Gerhards > > Sent: Wednesday, June 02, 2010 2:42 PM > > To: rsyslog-users > > Subject: Re: [rsyslog] Where is the output > > modulefortheudptransportationtoremote syslog server > > > > I guess autoreconf -fvi (options!) is missing, please also see > > > > http://www.rsyslog.com/doc-build_from_repo.html > > > > Rainer > > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of John Li > > > Sent: Wednesday, June 02, 2010 4:57 AM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Where is the output module > > > fortheudptransportationtoremote syslog server > > > > > > I cloned the rsyslog project and switched to master-templateFuncation > > > but > > > could not build it. Here is the output: > > > > > > [...@dev01 rsyslog]$ ./configure > > > configure: error: cannot find install-sh or install.sh in "." "./.." > > > "./../.." > > > [...@dev01 rsyslog]$ autoconf > > > configure.ac:29: warning: AC_CACHE_VAL(lt_prog_compiler_pic_works, > > > ...): > > > suspicious cache-id, must contain _cv_ to be cached > > > ../../lib/autoconf/general.m4:1974: AC_CACHE_VAL is expanded from... > > > ../../lib/autoconf/general.m4:1994: AC_CACHE_CHECK is expanded > > from... > > > aclocal.m4:621: AC_LIBTOOL_COMPILER_OPTION is expanded from... > > > aclocal.m4:4829: AC_LIBTOOL_PROG_COMPILER_PIC is expanded from... > > > aclocal.m4:2674: _LT_AC_LANG_C_CONFIG is expanded from... > > > aclocal.m4:2673: AC_LIBTOOL_LANG_C_CONFIG is expanded from... > > > aclocal.m4:86: AC_LIBTOOL_SETUP is expanded from... > > > aclocal.m4:66: _AC_PROG_LIBTOOL is expanded from... > > > aclocal.m4:31: AC_PROG_LIBTOOL is expanded from... > > > configure.ac:29: the top level > > > configure.ac:29: warning: AC_CACHE_VAL(lt_prog_compiler_static_works, > > > ...): > > > suspicious cache-id, must contain _cv_ to be cached > > > aclocal.m4:666: AC_LIBTOOL_LINKER_OPTION is expanded from... > > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_pic_works_CXX, > > > ...): > > > suspicious cache-id, must contain _cv_ to be cached > > > aclocal.m4:2751: _LT_AC_LANG_CXX_CONFIG is expanded from... > > > aclocal.m4:2750: AC_LIBTOOL_LANG_CXX_CONFIG is expanded from... > > > aclocal.m4:1810: _LT_AC_TAGCONFIG is expanded from... > > > configure.ac:29: warning: > > > AC_CACHE_VAL(lt_prog_compiler_static_works_CXX, > > > ...): suspicious cache-id, must contain _cv_ to be cached > > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_pic_works_F77, > > > ...): > > > suspicious cache-id, must contain _cv_ to be cached > > > aclocal.m4:3914: _LT_AC_LANG_F77_CONFIG is expanded from... > > > aclocal.m4:3913: AC_LIBTOOL_LANG_F77_CONFIG is expanded from... > > > configure.ac:29: warning: > > > AC_CACHE_VAL(lt_prog_compiler_static_works_F77, > > > ...): suspicious cache-id, must contain _cv_ to be cached > > > configure.ac:29: warning: > > AC_CACHE_VAL(lt_prog_compiler_pic_works_GCJ, > > > ...): > > > suspicious cache-id, must contain _cv_ to be cached > > > aclocal.m4:4016: _LT_AC_LANG_GCJ_CONFIG is expanded from... > > > aclocal.m4:4015: AC_LIBTOOL_LANG_GCJ_CONFIG is expanded from... > > > configure.ac:29: warning: > > > AC_CACHE_VAL(lt_prog_compiler_static_works_GCJ, > > > ...): suspicious cache-id, must contain _cv_ to be cached > > > > > > In the same box, I am able to build with the 5.5.5 release download. > > > > > > Any idea? > > > > > > Thanks. > > > > > > > > > -- > > > John Jun Li > > > [email protected] > > > > > > > > > On Tue, Jun 1, 2010 at 1:03 PM, Rainer Gerhards > > > <[email protected]>wrote: > > > > > > > David, John, > > > > > > > > I made excellent progress today (it looks like it pays to take a > > few > > > days > > > > off). I have just committed a new version that contains the actual > > > plugin > > > > interface. I will work more on it tomorrow. If all goes well, the > > > full > > > > functionality may become available tomorrow :) [but no promises]. > > > > > > > > John may want to have a look at ./tools/smtradfile.c to get an idea > > > of what > > > > the module does and check if it is useful for him. > > > > > > > > Rainer > > > > > > > > > -----Original Message----- > > > > > From: [email protected] [mailto:rsyslog- > > > > > [email protected]] On Behalf Of [email protected] > > > > > Sent: Tuesday, June 01, 2010 4:08 PM > > > > > To: rsyslog-users > > > > > Subject: Re: [rsyslog] Where is the output module for > > > > > theudptransportationtoremote syslog server > > > > > > > > > > Ok, this looks like something I can test. I won't be working on > > it > > > > > today > > > > > (I've been on a call since 4am local time so won't be doing much > > of > > > > > anything today:-) > > > > > > > > > > David Lang > > > > > > > > > > On Tue, 1 Jun 2010, Rainer Gerhards wrote: > > > > > > > > > > >> -----Original Message----- > > > > > >> From: [email protected] [mailto:rsyslog- > > > > > >> [email protected]] On Behalf Of John Li > > > > > >> > > > > > >> Hi Rainer, > > > > > >> > > > > > >> Sorry I didn't finish reading the long email yet as I just > > dived > > > > > into > > > > > >> the > > > > > >> ruleset module and tried to rewrite the message with submitMsg > > > but > > > > > no > > > > > >> success yet. > > > > > > > > > > > > No problem, but keep on your mind that I have something boiling > > > right > > > > > now. I > > > > > > will blog about it soon, but am currently tied in some other > > > > > activity. But > > > > > > have a look at this git commit: > > > > > > > > > > > > > > > > > > > > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=59227a861821b2e0e3 > > > > > 7357c0 > > > > > > 695f6b3d9f11dd9d > > > > > > > > > > > >> > > > > > >> In general, the use case is for those SEM (Security Event > > > > > Management). > > > > > >> They > > > > > >> have their recommended syslog format and it will be much > > easier > > > to > > > > > >> convert > > > > > >> the event in their format before send it over. > > > > > > > > > > > > My question is why you need to persist the string you generate. > > > Do > > > > > you use it > > > > > > multiple times or just because you need to feed it ONE time > > into > > > ONE > > > > > other > > > > > > action? > > > > > > > > > > > > Rainer > > > > > > > > > > > >> I promise will read the long email and hope I can provide some > > > > > useful > > > > > >> things > > > > > >> here. > > > > > >> > > > > > >> Thanks a lot for your work. > > > > > >> > > > > > >> -- > > > > > >> John Jun Li > > > > > >> [email protected] > > > > > >> > > > > > >> > > > > > >> > > > > > >> On Tue, Jun 1, 2010 at 6:32 AM, Rainer Gerhards > > > > > >> <[email protected]>wrote: > > > > > >> > > > > > >>> John, > > > > > >>> > > > > > >>> quick question: > > > > > >>> > > > > > >>>> -----Original Message----- > > > > > >>>> From: [email protected] [mailto:rsyslog- > > > > > >>>> [email protected]] On Behalf Of John Li > > > > > >>>> Sent: Monday, May 31, 2010 2:17 PM > > > > > >>>> To: [email protected]; rsyslog-users > > > > > >>>> Subject: Re: [rsyslog] Where is the output module for the > > > > > >>>> udptransportationtoremote syslog server > > > > > >>>> > > > > > >>>> Thanks a lot. > > > > > >>>> Currently i am stucked at the design that output module can > > > not > > > > > >> modify > > > > > >>>> the msg to be seen by other output modules. > > > > > >>> > > > > > >>> While I think I understand why you need this functionality, I > > > would > > > > > >>> appreciate if you could elaborate on that need a bit. I am > > > asking > > > > > >> because I > > > > > >>> want to understand the potential use cases (hopefully all) > > > BEFORE I > > > > > >> even > > > > > >>> consider implementing a facility to support them. > > > > > >>> > > > > > >>> Also, do you have a comment to the longer message on template > > > > > modules > > > > > >> I > > > > > >>> posted yesterday? > > > > > >>> > > > > > >>> Thanks, > > > > > >>> Rainer > > > > > >>> _______________________________________________ > > > > > >>> rsyslog mailing list > > > > > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > >>> http://www.rsyslog.com > > > > > >>> > > > > > >> _______________________________________________ > > > > > >> rsyslog mailing list > > > > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > >> http://www.rsyslog.com > > > > > > _______________________________________________ > > > > > > rsyslog mailing list > > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > > http://www.rsyslog.com > > > > > > > > > > > _______________________________________________ > > > > > rsyslog mailing list > > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > > http://www.rsyslog.com > > > > _______________________________________________ > > > > rsyslog mailing list > > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > > http://www.rsyslog.com > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
