> > -----Original Message-----
> > From: [email protected] [mailto:rsyslog-
> > [email protected]] On Behalf Of Philippe Muller
> > Sent: Thursday, April 04, 2013 2:02 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Need help to understand RainerScript behavior
> > (rsyslog
> > 7.2.6)
> >
> > Reading my original post again, I guess it shows to bugs:
> > 1. The "JSON-variable equality issue" => That's now fixed 2. The
> > "Nested if- statement issue"
> >
> > Here is how I test for what I call the "nested if-statement issue" :
> > 1. Run rsyslog with this conf:
> > ---
> > module(load="imuxsock")
> >
>
> Ahhhhh --->
> > if $app-name startswith "FOO-" then {
> > set $!appname_starts_with_FOO = 1;
> <------
> These two lines were missing in the initial sample! (I noticed there was an
> extra curly brace at the end, but didn't care about it...).
>
> OK, I will re-do the lab with them.
Replied too quickly... there are more differences. Will use the snippet from
the current mail inside my lab.
Rainer
>
> Rainer
>
> > if re_match($app-name, '^FOO-[^-]+-([012])$') then {
> > set $!appname_matches_regexp = 1;
> >
> > if field($app-name, 45, 2) == "BAR" then {
> > set $!appname_2nd_field_is_BAR = 1;
> > } else {
> > set $!appname_2nd_field_isnt_BAR = 1;
> > }
> > } else {
> > set $!appname_doesnt_match_regexp = 1;
> > }
> > } else {
> > set $!appname_doesnt_starts_with_FOO = 1; }
> >
> > template(name="cee-debug" type="string" string="msg: \"%msg%\", json:
> > %$!all-json%\n")
> > action(name="cee-debug" type="omfile" file="/tmp/cee-debug"
> > template="cee-debug")
> > ---
> > 2. Send messages with test tags using logger: for TAG in foo FOO-bar
> > FOO- BAR FOO-BAR-0 FOO-NOTBAR-0; do logger -t $TAG $TAG; done 3.
> Here
> > is what I get in /tmp/cee-debug (same result with and without the
> > "JSON variable equality patch" - of course that was expected because
> > that conf snippet doesnt tests json-varaible equality) :
> > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22861" x-
> info="
> > http://www.rsyslog.com";] start", json: { "appname_2nd_field_isnt_BAR":
> > 1,
> > "appname_doesnt_match_regexp": 1,
> > "appname_doesnt_starts_with_FOO": 1 }
> > msg: " foo", json: { "appname_2nd_field_isnt_BAR": 1,
> > "appname_doesnt_match_regexp": 1,
> > "appname_doesnt_starts_with_FOO": 1 }
> > msg: " FOO-bar", json: { "appname_starts_with_FOO": 1,
> > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1
> }
> > msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1,
> > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": 1
> }
> > msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1,
> > "appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 }
> > msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1,
> > "appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 }
> >
> > Here is what I expected :
> > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22878" x-
> info="
> > http://www.rsyslog.com";] start", json: {
> > "appname_doesnt_starts_with_FOO":
> > 1 }
> > msg: " foo", json: { "appname_doesnt_starts_with_FOO": 1 }
> > msg: " FOO-bar", json: { "appname_starts_with_FOO": 1,
> > "appname_doesnt_match_regexp": 1 }
> > msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1,
> > "appname_doesnt_match_regexp": 1 }
> > msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1,
> > "appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 }
> > msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1,
> > "appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 }
> >
> > Does it helps ?
> >
> >
> > Philippe Muller
> >
> >
> > On Thu, Apr 4, 2013 at 1:36 PM, Philippe Muller
> > <[email protected]>wrote:
> >
> > > Hello,
> > >
> > > I did several tests. At first, I could'nt find any behavior
> > > difference with and without the patch. That's because I did the test
> > > with the last configuration snippet I posted. It was intended to
> > > illustrate an issue with nested if-statements.
> > >
> > > Reading rainerscript.c, I understood you fixed something else, then
> > > I came up with this test configuration :
> > > ---
> > > module(load="imuxsock")
> > >
> > > set $!match = re_match($msg, "test-token");
> > >
> > > if $!match then set $!match_debug = 1; else set $!match_debug = 0;
> > >
> > > if $!match == 1 then set $!match_eq_debug = 1; else set
> > > $!match_eq_debug = 0;
> > >
> > >
> > > template(name="cee-debug" type="string" string="msg: \"%msg%\",
> json:
> > > %$!all-json%\n")
> > > action(name="cee-debug" type="omfile" file="/tmp/cee-debug"
> > > template="cee-debug")
> > > ---
> > >
> > > Here is what's written to /tmp/cee-debug :
> > > - Vanilla 7.2.6:
> > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22829"
> > > x-
> > info="
> > > http://www.rsyslog.com";] start", json: { "match": 0, "match_debug":
> > > 0,
> > > "match_eq_debug": 0 }
> > > msg: " test-token", json: { "match": 1, "match_debug": 1,
> > > "match_eq_debug": 0 }
> > > - Patched 7.2.6:
> > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22838"
> > > x-
> > info="
> > > http://www.rsyslog.com";] start", json: { "match": 0, "match_debug":
> > > 0,
> > > "match_eq_debug": 0 }
> > > msg: " test-token", json: { "match": 1, "match_debug": 1,
> > > "match_eq_debug": 1 }
> > >
> > > So I confirm the patch fixes the results of equality tests on
> > > set-able variables (JSON variables ? not sure what's the good word).
> > > That's cool. :-)
> > >
> > > However, this patch doesn't fix the issue discussed earlier.
> > > Of course, I stay available to test other patches. :-)
> > >
> > > Thanks!
> > >
> > > Philippe Muller
> > >
> > >
> > > On Thu, Apr 4, 2013 at 10:40 AM, Philippe Muller <
> > > [email protected]> wrote:
> > >
> > >> That's great. I'll test it ASAP. :-)
> > >>
> > >> Philippe Muller
> > >>
> > >>
> > >> On Thu, Apr 4, 2013 at 10:12 AM, Rainer Gerhards <
> > >> [email protected]> wrote:
> > >>
> > >>> > -----Original Message-----
> > >>> > From: [email protected] [mailto:rsyslog-
> > >>> > [email protected]] On Behalf Of Rainer Gerhards
> > >>> > Sent: Thursday, April 04, 2013 9:48 AM
> > >>> > To: Philippe Muller
> > >>> > Cc: rsyslog-users ([email protected])
> > >>> > Subject: Re: [rsyslog] Need help to understand RainerScript
> > >>> > behavior
> > >>> (rsyslog
> > >>> > 7.2.6)
> > >>> >
> > >>> > Quick update: I have this in lab now. I can confirm the problem
> > >>> > in
> > >>> 7.2.6, but it
> > >>> > seems to be gone in master branch (7.3.9+). Now need to dig down
> > >>> > what's going on.
> > >>>
> > >>> Yup, I accidently fixed the problem in 7.3 only. Here is the backport:
> > >>>
> > >>>
> > >>> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=cbf0ed9541fee
> > >>> 2a
> > >>> 480dda3533d1604a9df4ae9bb
> > >>>
> > >>> I'll release this with 7.2.7, hopefully very soon (there is
> > >>> another issue open that I would like to roll into the 7.2.7
> > >>> release, otherwise I had released today).
> > >>>
> > >>> Philippe, if you have time to try out the patch, that would be
> > >>> great (but fully understandable if not;)). It worked in my lab with your
> config.
> > >>>
> > >>> Rainer
> > >>> >
> > >>> > Rainer
> > >>> >
> > >>> > > -----Original Message-----
> > >>> > > From: Philippe Muller [mailto:[email protected]]
> > >>> > > Sent: Friday, March 29, 2013 11:40 AM
> > >>> > > To: Rainer Gerhards; rsyslog-users
> > >>> > > Subject: Re: [rsyslog] Need help to understand RainerScript
> > >>> > > behavior (rsyslog
> > >>> > > 7.2.6)
> > >>> > >
> > >>> > > Not sure is it is related :
> > >>> > >
> > >>> > >
> > >>> > > I tried this configuration :
> > >>> > > ---
> > >>> > > if $app-name startswith "FOO-" then {
> > >>> > > set $!appname_starts_with_FOO = 1;
> > >>> > >
> > >>> > > if re_match($app-name, '^FOO-[^-]+-([012])$') then {
> > >>> > > set $!appname_matches_regexp = 1;
> > >>> > >
> > >>> > > if field($app-name, 45, 2) == "BAR" then {
> > >>> > > set $!appname_2nd_field_is_BAR = 1;
> > >>> > > } else {
> > >>> > > set $!appname_2nd_field_isnt_BAR = 1;
> > >>> > > }
> > >>> > > } else {
> > >>> > > set $!appname_doesnt_match_regexp = 1;
> > >>> > > }
> > >>> > > } else {
> > >>> > > set $!appname_doesnt_starts_with_FOO = 1; }
> > >>> > > ---
> > >>> > >
> > >>> > >
> > >>> > > Here is the rsyslog startup message :
> > >>> > > app-name: "rsyslogd", msg: " [origin software="rsyslogd"
> > >>> > swVersion="7.2.6"
> > >>> > > x-pid="28469" x-info="http://www.rsyslog.com";] start", json: {
> > >>> > > "appname_2nd_field_isnt_BAR": 1,
> > "appname_doesnt_match_regexp":
> > >>> > > 1,
> > >>> > > "appname_doesnt_starts_with_FOO": 1 }
> > >>> > >
> > >>> > > => This message should only have
> > >>> > > "appname_doesnt_starts_with_FOO" ; why are tests inside "if
> > >>> > > $app-
> > name startswith ..." evaluated ?
> > >>> > >
> > >>> > > Message : logger -t foo test foo
> > >>> > >
> > >>> > > Result : app-name: "foo", msg: " test foo", json: {
> > >>> > > "appname_2nd_field_isnt_BAR": 1,
> > "appname_doesnt_match_regexp":
> > >>> > > 1,
> > >>> > > "appname_doesnt_starts_with_FOO": 1 } => This message should
> > >>> > > only
> > >>> > have
> > >>> > > "appname_doesnt_starts_with_FOO"
> > >>> > >
> > >>> > >
> > >>> > > Message : logger -t FOO-bar test foo
> > >>> > >
> > >>> > > Result : app-name: "FOO-bar", msg: " test foo", json: {
> > >>> > > "appname_starts_with_FOO": 1, "appname_2nd_field_isnt_BAR":
> 1,
> > >>> > > "appname_doesnt_match_regexp": 1 }
> > >>> > >
> > >>> > > => Should only have "appname_starts_with_FOO" and
> > >>> > > "appname_doesnt_match_regexp"
> > >>> > >
> > >>> > >
> > >>> > > Message : logger -t FOO-BAR test foo
> > >>> > >
> > >>> > > Result : app-name: "FOO-BAR", msg: " test foo", json: {
> > >>> > > "appname_starts_with_FOO": 1, "appname_2nd_field_isnt_BAR":
> 1,
> > >>> > > "appname_doesnt_match_regexp": 1 }
> > >>> > >
> > >>> > > => Should only have "appname_starts_with_FOO" and
> > >>> > > "appname_doesnt_match_regexp"
> > >>> > >
> > >>> > >
> > >>> > > Message : logger -t FOO-BAR-0 test foo
> > >>> > >
> > >>> > > Result : app-name: "FOO-BAR-0", msg: " test foo", json: {
> > >>> > > "appname_starts_with_FOO": 1, "appname_matches_regexp": 1,
> > >>> > > "appname_2nd_field_is_BAR": 1 }
> > >>> > >
> > >>> > > => Works as expected
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > > Philippe Muller
> > >>> > >
> > >>> > >
> > >>> > > On Thu, Mar 28, 2013 at 11:12 PM, Philippe Muller
> > >>> > > <[email protected]> wrote:
> > >>> > >
> > >>> > >
> > >>> > > Here is the full debug log : http://pastebin.com/SMtnZNuL
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > > Philippe Muller
> > >>> > >
> > >>> > >
> > >>> > > On Thu, Mar 28, 2013 at 10:57 PM, Rainer Gerhards
> > >>> > > <[email protected]> wrote:
> > >>> > >
> > >>> > >
> > >>> > > No, should work. Debug log?
> > >>> > >
> > >>> > >
> > >>> > > Sent from phone, thus brief.
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > > -------- Ursprüngliche Nachricht --------
> > >>> > > Von: Philippe Muller <[email protected]>
> > >>> > > Datum: 28.03.2013 22:53 (GMT+01:00)
> > >>> > > An: rsyslog-users <[email protected]>
> > >>> > > Betreff: Re: [rsyslog] Need help to understand
> > >>> RainerScript
> > >>> > behavior
> > >>> > > (rsyslog 7.2.6)
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> > > I guess using set-able variables in if-statement
> > >>> > > is not
> > >>> > supported.
> > >>> > > Rainer : can you confirm that ?
> > >>> > >
> > >>> > > Philippe Muller
> > >>> > >
> > >>> > >
> > >>> > > On Thu, Mar 28, 2013 at 7:18 PM, Philippe Muller
> > >>> > > <[email protected]>wrote:
> > >>> > >
> > >>> > > > Hi rsyslog users,
> > >>> > > >
> > >>> > > > I try to define a scheme which gives users a way
> > >>> > > to
> > >>> chose if
> > >>> > > messages
> > >>> > > > should be written on their server filesystem and
> > >>> > > if
> > >>> they
> > >>> > should be
> > >>> > > > forwarded to syslog collectors.
> > >>> > > >
> > >>> > > > Here is my test configuration :
> > >>> > > > ---
> > >>> > > > module(load="imuxsock")
> > >>> > > >
> > >>> > > > # Default: All messages should be written locally
> > >>> > > > set $!rsyslog_write = 1;
> > >>> > > > # Default: All messages should be forwarded to
> > >>> collectors
> > >>> > > > set $!rsyslog_forward = 1;
> > >>> > > >
> > >>> > > > # When a message with the custom tag is matched,
> > >>> > > > # extract write and forwarding information.
> > >>> > > > #
> > >>> > > > # Tag syntax: FOO-appName-flag
> > >>> > > > #
> > >>> > > > # Flag values:
> > >>> > > > # - 0: drop message
> > >>> > > > # - 1: don't write message
> > >>> > > > # - 2: don't forward message
> > >>> > > > # - 3: write and forward message (default)
> > >>> > > > #
> > >>> > > > if re_match($app-name, "^FOO-[^-]+-([0123])") then {
> > >>> > > > set $!rsyslog_flag = cnum(field($app-name, 45,
> > >>> > > 3));
> > >>> > > > if $!rsyslog_flag == 0 then {
> > >>> > > > unset $!rsyslog_write;
> > >>> > > > unset $!rsyslog_forward;
> > >>> > > > } else if $!rsyslog_flag == 1 then {
> > >>> > > > unset $!rsyslog_write;
> > >>> > > > } else if $!rsyslog_flag == 2 then {
> > >>> > > > unset $!rsyslog_forward;
> > >>> > > > }
> > >>> > > > }
> > >>> > > >
> > >>> > > > # Write all messages for debugging
> > >>> > > > template(name="cee-debug" type="string" string="msg:
> > >>> > > \"%msg%\", json:
> > >>> > > > %$!all-json%\n")
> > >>> > > > action(name="cee-debug" type="omfile"
> > >>> > > file="/tmp/cee-
> > >>> > debug"
> > >>> > > > template="cee-debug")
> > >>> > > > ---
> > >>> > > >
> > >>> > > > And that's how I tested it :
> > >>> > > > # logger -t FOO-bar-0 test-0
> > >>> > > > # logger -t FOO-bar-1 test-1
> > >>> > > > # logger -t FOO-bar-2 test-2
> > >>> > > > # logger -t FOO-bar-3 test-3
> > >>> > > > # cat /tmp/cee-debug
> > >>> > > > msg: " test-0", json: { "rsyslog_write": 1,
> > >>> "rsyslog_forward":
> > >>> > > 1,
> > >>> > > > "rsyslog_flag": 0 }
> > >>> > > > msg: " test-1", json: { "rsyslog_write": 1,
> > >>> "rsyslog_forward":
> > >>> > > 1,
> > >>> > > > "rsyslog_flag": 1 }
> > >>> > > > msg: " test-2", json: { "rsyslog_write": 1,
> > >>> "rsyslog_forward":
> > >>> > > 1,
> > >>> > > > "rsyslog_flag": 2 }
> > >>> > > > msg: " test-3", json: { "rsyslog_write": 1,
> > >>> "rsyslog_forward":
> > >>> > > 1,
> > >>> > > > "rsyslog_flag": 3 }
> > >>> > > >
> > >>> > > >
> > >>> > > > Messages are matched by re_match(),
> > >>> > > $!rsyslog_flag is
> > >>> well
> > >>> > > extracted from
> > >>> > > > the tag, but none of the tests on $!rsyslog_flag
> > >>> > > seem
> > >>> to be
> > >>> > > evaluated
> > >>> > > > successfully.
> > >>> > > > I tested the same config without cnum() +
> > >>> > > testing
> > >>> > $!rsyslog_flag
> > >>> > > with
> > >>> > > > strings => same results.
> > >>> > > >
> > >>> > > > Is there something I'm missing regarding nested
> > >>> > > if
> > >>> > statements ?
> > >>> > > > If that's the expected behavior, I would be
> > >>> > > grateful
> > >>> for
> > >>> > > clarification. :-)
> > >>> > > >
> > >>> > > >
> > >>> > > > Regards,
> > >>> > > >
> > >>> > > > Philippe Muller
> > >>> > > >
> > >>> > >
> > >>> > >
> _______________________________________________
> > >>> > > rsyslog mailing list
> > >>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >>> > > http://www.rsyslog.com/professional-services/
> > >>> > > What's up with rsyslog? Follow
> > >>> https://twitter.com/rgerhards
> > >>> > > NOTE WELL: This is a PUBLIC mailing list, posts
> > >>> > > are
> > >>> ARCHIVED
> > >>> > by a
> > >>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > >>> > > NOT
> > >>> > POST
> > >>> > > if you DON'T LIKE THAT.
> > >>> > >
> _______________________________________________
> > >>> > > rsyslog mailing list
> > >>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >>> > > http://www.rsyslog.com/professional-services/
> > >>> > > What's up with rsyslog? Follow
> > >>> https://twitter.com/rgerhards
> > >>> > > NOTE WELL: This is a PUBLIC mailing list, posts
> > >>> > > are
> > >>> ARCHIVED
> > >>> > by a
> > >>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > >>> > > NOT
> > >>> > POST
> > >>> > > if you DON'T LIKE THAT.
> > >>> > >
> > >>> > >
> > >>> > >
> > >>> >
> > >>> > _______________________________________________
> > >>> > rsyslog mailing list
> > >>> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >>> > http://www.rsyslog.com/professional-services/
> > >>> > What's up with rsyslog? Follow https://twitter.com/rgerhards
> > >>> > NOTE
> > >>> WELL:
> > >>> > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > >>> > sites
> > >>> beyond
> > >>> > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > >>> > LIKE
> > THAT.
> > >>> _______________________________________________
> > >>> rsyslog mailing list
> > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog
> > >>> http://www.rsyslog.com/professional-services/
> > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
> > >>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> > >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT
> > >>> POST if you DON'T LIKE THAT.
> > >>>
> > >>
> > >>
> > >
> > _______________________________________________
> > rsyslog mailing list
> > http://lists.adiscon.net/mailman/listinfo/rsyslog
> > http://www.rsyslog.com/professional-services/
> > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
> > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
> > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond
> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
