I think there should be some way of getting the text without the numeric
value as well.
I actually don't understand why anyone would want both. If you are having
a system process it that understands the numbers, you don't need the text.
The text is there to make it human friendly, and the numbers sure don't
help that.
changing the exiting property to only be the text may break someone's
stuff, but only if they are either filtering on it, or have a custom
template. in either case it's a fairly small change to fix the
configuration.
This would not be a change to make to an existing stable branch, but I
could see it being reasonable as a cleanup in 6.x
David Lang
On Thu, 20 Oct 2011, Rainer Gerhards wrote:
Date: Thu, 20 Oct 2011 11:58:32 +0200
From: Rainer Gerhards <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] pri-text property incorrectly appending pri?
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of Gregory K. Ruiz-Ade
Sent: Wednesday, October 19, 2011 3:21 AM
To: [email protected]
Subject: [rsyslog] pri-text property incorrectly appending pri?
I've been doing some testing and debugging on my rules in rsyslog
(5.9.5, built from sources on CentOS 5.6), and I've discovered that the
property "pri-text" doesn't just give you the textual form.
using:
-----
$template testfmt, "%pri-text%\n"
*.* /var/log/testing;testfmt
-----
I end up with, for example:
-----
local0.notice<133>
-----
in my logfile.
On the bright side, I now know why my rules aren't working, like:
-----
:pri-text, !isequal, "local0.err" ~
*.* /var/log/local0.err.log
-----
Since there is always the contents of "%pri%" tacked on the end,
nothing will ever be equal to "local0.err" and my log file stays empty.
I can work around this for now by using startswith instead of isequal,
but the behavior still bugs me.
Is this a bug, or intended behavior?
That's a really ugly issue. I have checked to code, and it was this way all
the time. It's intentional. While I don't remember introducing this property
at all, I can see it is intentional by the way the property is formatted
("%s<%d>" basically). The doc does not have the number inside the spec, but
clearly shows it in examples.
Usually, I'd say I remove the numerical PRI, but I don't know who may be
relying on it. Tough call. Even more ugly is introducing something like
pri-text-alternate, but maybe that's the way to go.
Anybody with suggestions?
As a side-note, using
local0.err /var/log/local0.err.log
as a rule is much more efficient than what you wrote above.
Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
