Reading my original post again, I guess it shows to bugs:
1. The "JSON-variable equality issue" => That's now fixed
2. The "Nested if-statement issue"
Here is how I test for what I call the "nested if-statement issue" :
1. Run rsyslog with this conf:
---
module(load="imuxsock")
if $app-name startswith "FOO-" then {
set $!appname_starts_with_FOO = 1;
if re_match($app-name, '^FOO-[^-]+-([012])$') then {
set $!appname_matches_regexp = 1;
if field($app-name, 45, 2) == "BAR" then {
set $!appname_2nd_field_is_BAR = 1;
} else {
set $!appname_2nd_field_isnt_BAR = 1;
}
} else {
set $!appname_doesnt_match_regexp = 1;
}
} else {
set $!appname_doesnt_starts_with_FOO = 1;
}
template(name="cee-debug" type="string" string="msg: \"%msg%\", json:
%$!all-json%\n")
action(name="cee-debug" type="omfile" file="/tmp/cee-debug"
template="cee-debug")
---
2. Send messages with test tags using logger: for TAG in foo FOO-bar
FOO-BAR FOO-BAR-0 FOO-NOTBAR-0; do logger -t $TAG $TAG; done
3. Here is what I get in /tmp/cee-debug (same result with and without the
"JSON variable equality patch" - of course that was expected because that
conf snippet doesnt tests json-varaible equality) :
msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22861" x-info="
http://www.rsyslog.com";] start", json: { "appname_2nd_field_isnt_BAR": 1,
"appname_doesnt_match_regexp": 1, "appname_doesnt_starts_with_FOO": 1 }
msg: " foo", json: { "appname_2nd_field_isnt_BAR": 1,
"appname_doesnt_match_regexp": 1, "appname_doesnt_starts_with_FOO": 1 }
msg: " FOO-bar", json: { "appname_starts_with_FOO": 1,
"appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1 }
msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1,
"appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1 }
msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1,
"appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 }
msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1,
"appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 }
Here is what I expected :
msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22878" x-info="
http://www.rsyslog.com";] start", json: { "appname_doesnt_starts_with_FOO":
1 }
msg: " foo", json: { "appname_doesnt_starts_with_FOO": 1 }
msg: " FOO-bar", json: { "appname_starts_with_FOO": 1,
"appname_doesnt_match_regexp": 1 }
msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1,
"appname_doesnt_match_regexp": 1 }
msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1,
"appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 }
msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1,
"appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 }
Does it helps ?
Philippe Muller
On Thu, Apr 4, 2013 at 1:36 PM, Philippe Muller
<[email protected]>wrote:
> Hello,
>
> I did several tests. At first, I could'nt find any behavior difference
> with and without the patch. That's because I did the test with the last
> configuration snippet I posted. It was intended to illustrate an issue with
> nested if-statements.
>
> Reading rainerscript.c, I understood you fixed something else, then I came
> up with this test configuration :
> ---
> module(load="imuxsock")
>
> set $!match = re_match($msg, "test-token");
>
> if $!match then set $!match_debug = 1;
> else set $!match_debug = 0;
>
> if $!match == 1 then set $!match_eq_debug = 1;
> else set $!match_eq_debug = 0;
>
>
> template(name="cee-debug" type="string" string="msg: \"%msg%\", json:
> %$!all-json%\n")
> action(name="cee-debug" type="omfile" file="/tmp/cee-debug"
> template="cee-debug")
> ---
>
> Here is what's written to /tmp/cee-debug :
> - Vanilla 7.2.6:
> msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22829" x-info="
> http://www.rsyslog.com";] start", json: { "match": 0, "match_debug": 0,
> "match_eq_debug": 0 }
> msg: " test-token", json: { "match": 1, "match_debug": 1,
> "match_eq_debug": 0 }
> - Patched 7.2.6:
> msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22838" x-info="
> http://www.rsyslog.com";] start", json: { "match": 0, "match_debug": 0,
> "match_eq_debug": 0 }
> msg: " test-token", json: { "match": 1, "match_debug": 1,
> "match_eq_debug": 1 }
>
> So I confirm the patch fixes the results of equality tests on set-able
> variables (JSON variables ? not sure what's the good word). That's cool. :-)
>
> However, this patch doesn't fix the issue discussed earlier.
> Of course, I stay available to test other patches. :-)
>
> Thanks!
>
> Philippe Muller
>
>
> On Thu, Apr 4, 2013 at 10:40 AM, Philippe Muller <
> [email protected]> wrote:
>
>> That's great. I'll test it ASAP. :-)
>>
>> Philippe Muller
>>
>>
>> On Thu, Apr 4, 2013 at 10:12 AM, Rainer Gerhards <
>> [email protected]> wrote:
>>
>>> > -----Original Message-----
>>> > From: [email protected] [mailto:rsyslog-
>>> > [email protected]] On Behalf Of Rainer Gerhards
>>> > Sent: Thursday, April 04, 2013 9:48 AM
>>> > To: Philippe Muller
>>> > Cc: rsyslog-users ([email protected])
>>> > Subject: Re: [rsyslog] Need help to understand RainerScript behavior
>>> (rsyslog
>>> > 7.2.6)
>>> >
>>> > Quick update: I have this in lab now. I can confirm the problem in
>>> 7.2.6, but it
>>> > seems to be gone in master branch (7.3.9+). Now need to dig down what's
>>> > going on.
>>>
>>> Yup, I accidently fixed the problem in 7.3 only. Here is the backport:
>>>
>>>
>>> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=cbf0ed9541fee2a480dda3533d1604a9df4ae9bb
>>>
>>> I'll release this with 7.2.7, hopefully very soon (there is another
>>> issue open that I would like to roll into the 7.2.7 release, otherwise I
>>> had released today).
>>>
>>> Philippe, if you have time to try out the patch, that would be great
>>> (but fully understandable if not;)). It worked in my lab with your config.
>>>
>>> Rainer
>>> >
>>> > Rainer
>>> >
>>> > > -----Original Message-----
>>> > > From: Philippe Muller [mailto:[email protected]]
>>> > > Sent: Friday, March 29, 2013 11:40 AM
>>> > > To: Rainer Gerhards; rsyslog-users
>>> > > Subject: Re: [rsyslog] Need help to understand RainerScript behavior
>>> > > (rsyslog
>>> > > 7.2.6)
>>> > >
>>> > > Not sure is it is related :
>>> > >
>>> > >
>>> > > I tried this configuration :
>>> > > ---
>>> > > if $app-name startswith "FOO-" then {
>>> > > set $!appname_starts_with_FOO = 1;
>>> > >
>>> > > if re_match($app-name, '^FOO-[^-]+-([012])$') then {
>>> > > set $!appname_matches_regexp = 1;
>>> > >
>>> > > if field($app-name, 45, 2) == "BAR" then {
>>> > > set $!appname_2nd_field_is_BAR = 1;
>>> > > } else {
>>> > > set $!appname_2nd_field_isnt_BAR = 1;
>>> > > }
>>> > > } else {
>>> > > set $!appname_doesnt_match_regexp = 1;
>>> > > }
>>> > > } else {
>>> > > set $!appname_doesnt_starts_with_FOO = 1; }
>>> > > ---
>>> > >
>>> > >
>>> > > Here is the rsyslog startup message :
>>> > > app-name: "rsyslogd", msg: " [origin software="rsyslogd"
>>> > swVersion="7.2.6"
>>> > > x-pid="28469" x-info="http://www.rsyslog.com";] start", json: {
>>> > > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1,
>>> > > "appname_doesnt_starts_with_FOO": 1 }
>>> > >
>>> > > => This message should only have "appname_doesnt_starts_with_FOO" ;
>>> > > why are tests inside "if $app-name startswith ..." evaluated ?
>>> > >
>>> > > Message : logger -t foo test foo
>>> > >
>>> > > Result : app-name: "foo", msg: " test foo", json: {
>>> > > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1,
>>> > > "appname_doesnt_starts_with_FOO": 1 } => This message should only
>>> > have
>>> > > "appname_doesnt_starts_with_FOO"
>>> > >
>>> > >
>>> > > Message : logger -t FOO-bar test foo
>>> > >
>>> > > Result : app-name: "FOO-bar", msg: " test foo", json: {
>>> > > "appname_starts_with_FOO": 1, "appname_2nd_field_isnt_BAR": 1,
>>> > > "appname_doesnt_match_regexp": 1 }
>>> > >
>>> > > => Should only have "appname_starts_with_FOO" and
>>> > > "appname_doesnt_match_regexp"
>>> > >
>>> > >
>>> > > Message : logger -t FOO-BAR test foo
>>> > >
>>> > > Result : app-name: "FOO-BAR", msg: " test foo", json: {
>>> > > "appname_starts_with_FOO": 1, "appname_2nd_field_isnt_BAR": 1,
>>> > > "appname_doesnt_match_regexp": 1 }
>>> > >
>>> > > => Should only have "appname_starts_with_FOO" and
>>> > > "appname_doesnt_match_regexp"
>>> > >
>>> > >
>>> > > Message : logger -t FOO-BAR-0 test foo
>>> > >
>>> > > Result : app-name: "FOO-BAR-0", msg: " test foo", json: {
>>> > > "appname_starts_with_FOO": 1, "appname_matches_regexp": 1,
>>> > > "appname_2nd_field_is_BAR": 1 }
>>> > >
>>> > > => Works as expected
>>> > >
>>> > >
>>> > >
>>> > >
>>> > >
>>> > >
>>> > > Philippe Muller
>>> > >
>>> > >
>>> > > On Thu, Mar 28, 2013 at 11:12 PM, Philippe Muller
>>> > > <[email protected]> wrote:
>>> > >
>>> > >
>>> > > Here is the full debug log : http://pastebin.com/SMtnZNuL
>>> > >
>>> > >
>>> > >
>>> > >
>>> > >
>>> > > Philippe Muller
>>> > >
>>> > >
>>> > > On Thu, Mar 28, 2013 at 10:57 PM, Rainer Gerhards
>>> > > <[email protected]> wrote:
>>> > >
>>> > >
>>> > > No, should work. Debug log?
>>> > >
>>> > >
>>> > > Sent from phone, thus brief.
>>> > >
>>> > >
>>> > >
>>> > > -------- Ursprüngliche Nachricht --------
>>> > > Von: Philippe Muller <[email protected]>
>>> > > Datum: 28.03.2013 22:53 (GMT+01:00)
>>> > > An: rsyslog-users <[email protected]>
>>> > > Betreff: Re: [rsyslog] Need help to understand
>>> RainerScript
>>> > behavior
>>> > > (rsyslog 7.2.6)
>>> > >
>>> > >
>>> > >
>>> > > I guess using set-able variables in if-statement is not
>>> > supported.
>>> > > Rainer : can you confirm that ?
>>> > >
>>> > > Philippe Muller
>>> > >
>>> > >
>>> > > On Thu, Mar 28, 2013 at 7:18 PM, Philippe Muller
>>> > > <[email protected]>wrote:
>>> > >
>>> > > > Hi rsyslog users,
>>> > > >
>>> > > > I try to define a scheme which gives users a way to
>>> chose if
>>> > > messages
>>> > > > should be written on their server filesystem and if
>>> they
>>> > should be
>>> > > > forwarded to syslog collectors.
>>> > > >
>>> > > > Here is my test configuration :
>>> > > > ---
>>> > > > module(load="imuxsock")
>>> > > >
>>> > > > # Default: All messages should be written locally
>>> > > > set $!rsyslog_write = 1;
>>> > > > # Default: All messages should be forwarded to
>>> collectors
>>> > > > set $!rsyslog_forward = 1;
>>> > > >
>>> > > > # When a message with the custom tag is matched,
>>> > > > # extract write and forwarding information.
>>> > > > #
>>> > > > # Tag syntax: FOO-appName-flag
>>> > > > #
>>> > > > # Flag values:
>>> > > > # - 0: drop message
>>> > > > # - 1: don't write message
>>> > > > # - 2: don't forward message
>>> > > > # - 3: write and forward message (default)
>>> > > > #
>>> > > > if re_match($app-name, "^FOO-[^-]+-([0123])") then {
>>> > > > set $!rsyslog_flag = cnum(field($app-name, 45, 3));
>>> > > > if $!rsyslog_flag == 0 then {
>>> > > > unset $!rsyslog_write;
>>> > > > unset $!rsyslog_forward;
>>> > > > } else if $!rsyslog_flag == 1 then {
>>> > > > unset $!rsyslog_write;
>>> > > > } else if $!rsyslog_flag == 2 then {
>>> > > > unset $!rsyslog_forward;
>>> > > > }
>>> > > > }
>>> > > >
>>> > > > # Write all messages for debugging
>>> > > > template(name="cee-debug" type="string" string="msg:
>>> > > \"%msg%\", json:
>>> > > > %$!all-json%\n")
>>> > > > action(name="cee-debug" type="omfile" file="/tmp/cee-
>>> > debug"
>>> > > > template="cee-debug")
>>> > > > ---
>>> > > >
>>> > > > And that's how I tested it :
>>> > > > # logger -t FOO-bar-0 test-0
>>> > > > # logger -t FOO-bar-1 test-1
>>> > > > # logger -t FOO-bar-2 test-2
>>> > > > # logger -t FOO-bar-3 test-3
>>> > > > # cat /tmp/cee-debug
>>> > > > msg: " test-0", json: { "rsyslog_write": 1,
>>> "rsyslog_forward":
>>> > > 1,
>>> > > > "rsyslog_flag": 0 }
>>> > > > msg: " test-1", json: { "rsyslog_write": 1,
>>> "rsyslog_forward":
>>> > > 1,
>>> > > > "rsyslog_flag": 1 }
>>> > > > msg: " test-2", json: { "rsyslog_write": 1,
>>> "rsyslog_forward":
>>> > > 1,
>>> > > > "rsyslog_flag": 2 }
>>> > > > msg: " test-3", json: { "rsyslog_write": 1,
>>> "rsyslog_forward":
>>> > > 1,
>>> > > > "rsyslog_flag": 3 }
>>> > > >
>>> > > >
>>> > > > Messages are matched by re_match(), $!rsyslog_flag is
>>> well
>>> > > extracted from
>>> > > > the tag, but none of the tests on $!rsyslog_flag seem
>>> to be
>>> > > evaluated
>>> > > > successfully.
>>> > > > I tested the same config without cnum() + testing
>>> > $!rsyslog_flag
>>> > > with
>>> > > > strings => same results.
>>> > > >
>>> > > > Is there something I'm missing regarding nested if
>>> > statements ?
>>> > > > If that's the expected behavior, I would be grateful
>>> for
>>> > > clarification. :-)
>>> > > >
>>> > > >
>>> > > > Regards,
>>> > > >
>>> > > > Philippe Muller
>>> > > >
>>> > >
>>> > > _______________________________________________
>>> > > rsyslog mailing list
>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > http://www.rsyslog.com/professional-services/
>>> > > What's up with rsyslog? Follow
>>> https://twitter.com/rgerhards
>>> > > NOTE WELL: This is a PUBLIC mailing list, posts are
>>> ARCHIVED
>>> > by a
>>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>>> > POST
>>> > > if you DON'T LIKE THAT.
>>> > > _______________________________________________
>>> > > rsyslog mailing list
>>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > > http://www.rsyslog.com/professional-services/
>>> > > What's up with rsyslog? Follow
>>> https://twitter.com/rgerhards
>>> > > NOTE WELL: This is a PUBLIC mailing list, posts are
>>> ARCHIVED
>>> > by a
>>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
>>> > POST
>>> > > if you DON'T LIKE THAT.
>>> > >
>>> > >
>>> > >
>>> >
>>> > _______________________________________________
>>> > rsyslog mailing list
>>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> > http://www.rsyslog.com/professional-services/
>>> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
>>> WELL:
>>> > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
>>> beyond
>>> > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>>> _______________________________________________
>>> rsyslog mailing list
>>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>>> http://www.rsyslog.com/professional-services/
>>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
>>> DON'T LIKE THAT.
>>>
>>
>>
>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
