Have a look at ./runtime/parser.c, function SanitizeMsg. It builds a new buffer and uses MsgSetRawMsg to set the new buffer. MsgSetRawMsg handles the "dirty" internals of message object buffer manipulation.
Note that it may be quicker to manipulate the buffer pointers yourself. But then you must be very careful. MsgSetRawMsg should provide the necessary hints. The thing to keep on your mind is that up to a certain message length, a buffer is used from the msg object itself (thus saving one malloc/free call) whereas for larger size messages, memory is allocated. You need to keep that straight during manipulation. As a side-note, it would probably be useful if you could take some bullet points on how to modify things, so that others can find that information in the case they want to do that themselves. Could go to the wiki or I could include it in the doc set. Just a suggestion, though... Rainer > -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Friday, February 11, 2011 5:38 AM > To: rsyslog-users > Subject: [rsyslog] how can a parser insert data into a message > > the various parser modules that I've submitted are all removing data > from > the log message or overwriting the data in place. > > But I've now run across a situation where I need to insert information > into the message. I know that this can be done because the sanitizing > call > does exactly this. I am assuming that this is doing something like > allocating a new string and copying the data into the new string. > > the concern is how to do this in a way that will survive the exit from > the > module, not confuse any of the many pointers or sizes that are > involved, > and make sure everything is properly freed afterwords. > > should I just search for the sanitizing routine and copy what it does > (and > can you point me at it?), or do you want me to wait until you have time > to > write something up on this? > > David Lang > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
