> -----Original Message-----
> From: [email protected] [mailto:rsyslog-
> [email protected]] On Behalf Of Gregory K. Ruiz-Ade
> Sent: Wednesday, October 19, 2011 3:21 AM
> To: [email protected]
> Subject: [rsyslog] pri-text property incorrectly appending pri?
>
> I've been doing some testing and debugging on my rules in rsyslog
> (5.9.5, built from sources on CentOS 5.6), and I've discovered that the
> property "pri-text" doesn't just give you the textual form.
>
> using:
>
> -----
> $template testfmt, "%pri-text%\n"
> *.* /var/log/testing;testfmt
> -----
>
> I end up with, for example:
>
> -----
> local0.notice<133>
> -----
>
> in my logfile.
>
>
> On the bright side, I now know why my rules aren't working, like:
>
> -----
> :pri-text, !isequal, "local0.err" ~
> *.* /var/log/local0.err.log
> -----
>
> Since there is always the contents of "%pri%" tacked on the end,
> nothing will ever be equal to "local0.err" and my log file stays empty.
> I can work around this for now by using startswith instead of isequal,
> but the behavior still bugs me.
>
> Is this a bug, or intended behavior?
That's a really ugly issue. I have checked to code, and it was this way all
the time. It's intentional. While I don't remember introducing this property
at all, I can see it is intentional by the way the property is formatted
("%s<%d>" basically). The doc does not have the number inside the spec, but
clearly shows it in examples.
Usually, I'd say I remove the numerical PRI, but I don't know who may be
relying on it. Tough call. Even more ugly is introducing something like
pri-text-alternate, but maybe that's the way to go.
Anybody with suggestions?
As a side-note, using
local0.err /var/log/local0.err.log
as a rule is much more efficient than what you wrote above.
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
