> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of [email protected] > Sent: Thursday, October 20, 2011 8:04 PM > To: rsyslog-users > Subject: Re: [rsyslog] pri-text property incorrectly appending pri? > > I think there should be some way of getting the text without the > numeric > value as well. > > I actually don't understand why anyone would want both. If you are > having > a system process it that understands the numbers, you don't need the > text. > The text is there to make it human friendly, and the numbers sure don't > help that. > > changing the exiting property to only be the text may break someone's > stuff, but only if they are either filtering on it, or have a custom > template. in either case it's a fairly small change to fix the > configuration. > > This would not be a change to make to an existing stable branch, but I > could see it being reasonable as a cleanup in 6.x
That sounds like a good solution! Acutally, I would bet that nobody actually uses this property -- otherwise the question should have come up before. But you never know... Rainer > > David Lang > > > On Thu, 20 Oct 2011, Rainer Gerhards wrote: > > > Date: Thu, 20 Oct 2011 11:58:32 +0200 > > From: Rainer Gerhards <[email protected]> > > Reply-To: rsyslog-users <[email protected]> > > To: rsyslog-users <[email protected]> > > Subject: Re: [rsyslog] pri-text property incorrectly appending pri? > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Gregory K. Ruiz-Ade > >> Sent: Wednesday, October 19, 2011 3:21 AM > >> To: [email protected] > >> Subject: [rsyslog] pri-text property incorrectly appending pri? > >> > >> I've been doing some testing and debugging on my rules in rsyslog > >> (5.9.5, built from sources on CentOS 5.6), and I've discovered that > the > >> property "pri-text" doesn't just give you the textual form. > >> > >> using: > >> > >> ----- > >> $template testfmt, "%pri-text%\n" > >> *.* /var/log/testing;testfmt > >> ----- > >> > >> I end up with, for example: > >> > >> ----- > >> local0.notice<133> > >> ----- > >> > >> in my logfile. > >> > >> > >> On the bright side, I now know why my rules aren't working, like: > >> > >> ----- > >> :pri-text, !isequal, "local0.err" ~ > >> *.* /var/log/local0.err.log > >> ----- > >> > >> Since there is always the contents of "%pri%" tacked on the end, > >> nothing will ever be equal to "local0.err" and my log file stays > empty. > >> I can work around this for now by using startswith instead of > isequal, > >> but the behavior still bugs me. > >> > >> Is this a bug, or intended behavior? > > > > That's a really ugly issue. I have checked to code, and it was this > way all > > the time. It's intentional. While I don't remember introducing this > property > > at all, I can see it is intentional by the way the property is > formatted > > ("%s<%d>" basically). The doc does not have the number inside the > spec, but > > clearly shows it in examples. > > > > Usually, I'd say I remove the numerical PRI, but I don't know who may > be > > relying on it. Tough call. Even more ugly is introducing something > like > > pri-text-alternate, but maybe that's the way to go. > > > > Anybody with suggestions? > > > > > > As a side-note, using > > > > local0.err /var/log/local0.err.log > > > > as a rule is much more efficient than what you wrote above. > > > > Rainer > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com
