FYI: can reproduce, and seems to be present in master branch as well.
> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Rainer Gerhards > Sent: Thursday, April 04, 2013 2:18 PM > To: rsyslog-users > Subject: Re: [rsyslog] Need help to understand RainerScript behavior (rsyslog > 7.2.6) > > > > -----Original Message----- > > > From: [email protected] [mailto:rsyslog- > > > [email protected]] On Behalf Of Philippe Muller > > > Sent: Thursday, April 04, 2013 2:02 PM > > > To: rsyslog-users > > > Subject: Re: [rsyslog] Need help to understand RainerScript behavior > > > (rsyslog > > > 7.2.6) > > > > > > Reading my original post again, I guess it shows to bugs: > > > 1. The "JSON-variable equality issue" => That's now fixed 2. The > > > "Nested if- statement issue" > > > > > > Here is how I test for what I call the "nested if-statement issue" : > > > 1. Run rsyslog with this conf: > > > --- > > > module(load="imuxsock") > > > > > > > Ahhhhh ---> > > > if $app-name startswith "FOO-" then { > > > set $!appname_starts_with_FOO = 1; > > <------ > > These two lines were missing in the initial sample! (I noticed there > > was an extra curly brace at the end, but didn't care about it...). > > > > OK, I will re-do the lab with them. > > Replied too quickly... there are more differences. Will use the snippet from > the current mail inside my lab. > > Rainer > > > > Rainer > > > > > if re_match($app-name, '^FOO-[^-]+-([012])$') then { > > > set $!appname_matches_regexp = 1; > > > > > > if field($app-name, 45, 2) == "BAR" then { > > > set $!appname_2nd_field_is_BAR = 1; > > > } else { > > > set $!appname_2nd_field_isnt_BAR = 1; > > > } > > > } else { > > > set $!appname_doesnt_match_regexp = 1; > > > } > > > } else { > > > set $!appname_doesnt_starts_with_FOO = 1; } > > > > > > template(name="cee-debug" type="string" string="msg: \"%msg%\", > json: > > > %$!all-json%\n") > > > action(name="cee-debug" type="omfile" file="/tmp/cee-debug" > > > template="cee-debug") > > > --- > > > 2. Send messages with test tags using logger: for TAG in foo FOO-bar > > > FOO- BAR FOO-BAR-0 FOO-NOTBAR-0; do logger -t $TAG $TAG; done 3. > > Here > > > is what I get in /tmp/cee-debug (same result with and without the > > > "JSON variable equality patch" - of course that was expected because > > > that conf snippet doesnt tests json-varaible equality) : > > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22861" > > > x- > > info=" > > > http://www.rsyslog.com";] start", json: { > "appname_2nd_field_isnt_BAR": > > > 1, > > > "appname_doesnt_match_regexp": 1, > > > "appname_doesnt_starts_with_FOO": 1 } > > > msg: " foo", json: { "appname_2nd_field_isnt_BAR": 1, > > > "appname_doesnt_match_regexp": 1, > > > "appname_doesnt_starts_with_FOO": 1 } > > > msg: " FOO-bar", json: { "appname_starts_with_FOO": 1, > > > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": > 1 > > } > > > msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1, > > > "appname_2nd_field_isnt_BAR": 1, "appname_doesnt_match_regexp": > 1 > > } > > > msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1, > > > "appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 } > > > msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1, > > > "appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 } > > > > > > Here is what I expected : > > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22878" > > > x- > > info=" > > > http://www.rsyslog.com";] start", json: { > > > "appname_doesnt_starts_with_FOO": > > > 1 } > > > msg: " foo", json: { "appname_doesnt_starts_with_FOO": 1 } > > > msg: " FOO-bar", json: { "appname_starts_with_FOO": 1, > > > "appname_doesnt_match_regexp": 1 } > > > msg: " FOO-BAR", json: { "appname_starts_with_FOO": 1, > > > "appname_doesnt_match_regexp": 1 } > > > msg: " FOO-BAR-0", json: { "appname_starts_with_FOO": 1, > > > "appname_matches_regexp": 1, "appname_2nd_field_is_BAR": 1 } > > > msg: " FOO-NOTBAR-0", json: { "appname_starts_with_FOO": 1, > > > "appname_matches_regexp": 1, "appname_2nd_field_isnt_BAR": 1 } > > > > > > Does it helps ? > > > > > > > > > Philippe Muller > > > > > > > > > On Thu, Apr 4, 2013 at 1:36 PM, Philippe Muller > > > <[email protected]>wrote: > > > > > > > Hello, > > > > > > > > I did several tests. At first, I could'nt find any behavior > > > > difference with and without the patch. That's because I did the > > > > test with the last configuration snippet I posted. It was intended > > > > to illustrate an issue with nested if-statements. > > > > > > > > Reading rainerscript.c, I understood you fixed something else, > > > > then I came up with this test configuration : > > > > --- > > > > module(load="imuxsock") > > > > > > > > set $!match = re_match($msg, "test-token"); > > > > > > > > if $!match then set $!match_debug = 1; else set $!match_debug = 0; > > > > > > > > if $!match == 1 then set $!match_eq_debug = 1; else set > > > > $!match_eq_debug = 0; > > > > > > > > > > > > template(name="cee-debug" type="string" string="msg: \"%msg%\", > > json: > > > > %$!all-json%\n") > > > > action(name="cee-debug" type="omfile" file="/tmp/cee-debug" > > > > template="cee-debug") > > > > --- > > > > > > > > Here is what's written to /tmp/cee-debug : > > > > - Vanilla 7.2.6: > > > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22829" > > > > x- > > > info=" > > > > http://www.rsyslog.com";] start", json: { "match": 0, "match_debug": > > > > 0, > > > > "match_eq_debug": 0 } > > > > msg: " test-token", json: { "match": 1, "match_debug": 1, > > > > "match_eq_debug": 0 } > > > > - Patched 7.2.6: > > > > msg: " [origin software="rsyslogd" swVersion="7.2.6" x-pid="22838" > > > > x- > > > info=" > > > > http://www.rsyslog.com";] start", json: { "match": 0, "match_debug": > > > > 0, > > > > "match_eq_debug": 0 } > > > > msg: " test-token", json: { "match": 1, "match_debug": 1, > > > > "match_eq_debug": 1 } > > > > > > > > So I confirm the patch fixes the results of equality tests on > > > > set-able variables (JSON variables ? not sure what's the good word). > > > > That's cool. :-) > > > > > > > > However, this patch doesn't fix the issue discussed earlier. > > > > Of course, I stay available to test other patches. :-) > > > > > > > > Thanks! > > > > > > > > Philippe Muller > > > > > > > > > > > > On Thu, Apr 4, 2013 at 10:40 AM, Philippe Muller < > > > > [email protected]> wrote: > > > > > > > >> That's great. I'll test it ASAP. :-) > > > >> > > > >> Philippe Muller > > > >> > > > >> > > > >> On Thu, Apr 4, 2013 at 10:12 AM, Rainer Gerhards < > > > >> [email protected]> wrote: > > > >> > > > >>> > -----Original Message----- > > > >>> > From: [email protected] [mailto:rsyslog- > > > >>> > [email protected]] On Behalf Of Rainer Gerhards > > > >>> > Sent: Thursday, April 04, 2013 9:48 AM > > > >>> > To: Philippe Muller > > > >>> > Cc: rsyslog-users ([email protected]) > > > >>> > Subject: Re: [rsyslog] Need help to understand RainerScript > > > >>> > behavior > > > >>> (rsyslog > > > >>> > 7.2.6) > > > >>> > > > > >>> > Quick update: I have this in lab now. I can confirm the > > > >>> > problem in > > > >>> 7.2.6, but it > > > >>> > seems to be gone in master branch (7.3.9+). Now need to dig > > > >>> > down what's going on. > > > >>> > > > >>> Yup, I accidently fixed the problem in 7.3 only. Here is the backport: > > > >>> > > > >>> > > > >>> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=cbf0ed9541f > > > >>> ee > > > >>> 2a > > > >>> 480dda3533d1604a9df4ae9bb > > > >>> > > > >>> I'll release this with 7.2.7, hopefully very soon (there is > > > >>> another issue open that I would like to roll into the 7.2.7 > > > >>> release, otherwise I had released today). > > > >>> > > > >>> Philippe, if you have time to try out the patch, that would be > > > >>> great (but fully understandable if not;)). It worked in my lab > > > >>> with your > > config. > > > >>> > > > >>> Rainer > > > >>> > > > > >>> > Rainer > > > >>> > > > > >>> > > -----Original Message----- > > > >>> > > From: Philippe Muller [mailto:[email protected]] > > > >>> > > Sent: Friday, March 29, 2013 11:40 AM > > > >>> > > To: Rainer Gerhards; rsyslog-users > > > >>> > > Subject: Re: [rsyslog] Need help to understand RainerScript > > > >>> > > behavior (rsyslog > > > >>> > > 7.2.6) > > > >>> > > > > > >>> > > Not sure is it is related : > > > >>> > > > > > >>> > > > > > >>> > > I tried this configuration : > > > >>> > > --- > > > >>> > > if $app-name startswith "FOO-" then { > > > >>> > > set $!appname_starts_with_FOO = 1; > > > >>> > > > > > >>> > > if re_match($app-name, '^FOO-[^-]+-([012])$') then { > > > >>> > > set $!appname_matches_regexp = 1; > > > >>> > > > > > >>> > > if field($app-name, 45, 2) == "BAR" then { > > > >>> > > set $!appname_2nd_field_is_BAR = 1; > > > >>> > > } else { > > > >>> > > set $!appname_2nd_field_isnt_BAR = 1; > > > >>> > > } > > > >>> > > } else { > > > >>> > > set $!appname_doesnt_match_regexp = 1; > > > >>> > > } > > > >>> > > } else { > > > >>> > > set $!appname_doesnt_starts_with_FOO = 1; } > > > >>> > > --- > > > >>> > > > > > >>> > > > > > >>> > > Here is the rsyslog startup message : > > > >>> > > app-name: "rsyslogd", msg: " [origin software="rsyslogd" > > > >>> > swVersion="7.2.6" > > > >>> > > x-pid="28469" x-info="http://www.rsyslog.com";] start", json: > > > >>> > > { > > > >>> > > "appname_2nd_field_isnt_BAR": 1, > > > "appname_doesnt_match_regexp": > > > >>> > > 1, > > > >>> > > "appname_doesnt_starts_with_FOO": 1 } > > > >>> > > > > > >>> > > => This message should only have > > > >>> > > "appname_doesnt_starts_with_FOO" ; why are tests inside "if > > > >>> > > $app- > > > name startswith ..." evaluated ? > > > >>> > > > > > >>> > > Message : logger -t foo test foo > > > >>> > > > > > >>> > > Result : app-name: "foo", msg: " test foo", json: { > > > >>> > > "appname_2nd_field_isnt_BAR": 1, > > > "appname_doesnt_match_regexp": > > > >>> > > 1, > > > >>> > > "appname_doesnt_starts_with_FOO": 1 } => This message > should > > > >>> > > only > > > >>> > have > > > >>> > > "appname_doesnt_starts_with_FOO" > > > >>> > > > > > >>> > > > > > >>> > > Message : logger -t FOO-bar test foo > > > >>> > > > > > >>> > > Result : app-name: "FOO-bar", msg: " test foo", json: { > > > >>> > > "appname_starts_with_FOO": 1, > "appname_2nd_field_isnt_BAR": > > 1, > > > >>> > > "appname_doesnt_match_regexp": 1 } > > > >>> > > > > > >>> > > => Should only have "appname_starts_with_FOO" and > > > >>> > > "appname_doesnt_match_regexp" > > > >>> > > > > > >>> > > > > > >>> > > Message : logger -t FOO-BAR test foo > > > >>> > > > > > >>> > > Result : app-name: "FOO-BAR", msg: " test foo", json: { > > > >>> > > "appname_starts_with_FOO": 1, > "appname_2nd_field_isnt_BAR": > > 1, > > > >>> > > "appname_doesnt_match_regexp": 1 } > > > >>> > > > > > >>> > > => Should only have "appname_starts_with_FOO" and > > > >>> > > "appname_doesnt_match_regexp" > > > >>> > > > > > >>> > > > > > >>> > > Message : logger -t FOO-BAR-0 test foo > > > >>> > > > > > >>> > > Result : app-name: "FOO-BAR-0", msg: " test foo", json: { > > > >>> > > "appname_starts_with_FOO": 1, "appname_matches_regexp": > 1, > > > >>> > > "appname_2nd_field_is_BAR": 1 } > > > >>> > > > > > >>> > > => Works as expected > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > Philippe Muller > > > >>> > > > > > >>> > > > > > >>> > > On Thu, Mar 28, 2013 at 11:12 PM, Philippe Muller > > > >>> > > <[email protected]> wrote: > > > >>> > > > > > >>> > > > > > >>> > > Here is the full debug log : > > > >>> > > http://pastebin.com/SMtnZNuL > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > Philippe Muller > > > >>> > > > > > >>> > > > > > >>> > > On Thu, Mar 28, 2013 at 10:57 PM, Rainer Gerhards > > > >>> > > <[email protected]> wrote: > > > >>> > > > > > >>> > > > > > >>> > > No, should work. Debug log? > > > >>> > > > > > >>> > > > > > >>> > > Sent from phone, thus brief. > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > -------- Ursprüngliche Nachricht -------- > > > >>> > > Von: Philippe Muller <[email protected]> > > > >>> > > Datum: 28.03.2013 22:53 (GMT+01:00) > > > >>> > > An: rsyslog-users <[email protected]> > > > >>> > > Betreff: Re: [rsyslog] Need help to understand > > > >>> RainerScript > > > >>> > behavior > > > >>> > > (rsyslog 7.2.6) > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > I guess using set-able variables in if-statement > > > >>> > > is not > > > >>> > supported. > > > >>> > > Rainer : can you confirm that ? > > > >>> > > > > > >>> > > Philippe Muller > > > >>> > > > > > >>> > > > > > >>> > > On Thu, Mar 28, 2013 at 7:18 PM, Philippe Muller > > > >>> > > <[email protected]>wrote: > > > >>> > > > > > >>> > > > Hi rsyslog users, > > > >>> > > > > > > >>> > > > I try to define a scheme which gives users a > > > >>> > > way to > > > >>> chose if > > > >>> > > messages > > > >>> > > > should be written on their server filesystem > > > >>> > > and if > > > >>> they > > > >>> > should be > > > >>> > > > forwarded to syslog collectors. > > > >>> > > > > > > >>> > > > Here is my test configuration : > > > >>> > > > --- > > > >>> > > > module(load="imuxsock") > > > >>> > > > > > > >>> > > > # Default: All messages should be written locally > > > >>> > > > set $!rsyslog_write = 1; > > > >>> > > > # Default: All messages should be forwarded to > > > >>> collectors > > > >>> > > > set $!rsyslog_forward = 1; > > > >>> > > > > > > >>> > > > # When a message with the custom tag is matched, > > > >>> > > > # extract write and forwarding information. > > > >>> > > > # > > > >>> > > > # Tag syntax: FOO-appName-flag > > > >>> > > > # > > > >>> > > > # Flag values: > > > >>> > > > # - 0: drop message > > > >>> > > > # - 1: don't write message > > > >>> > > > # - 2: don't forward message > > > >>> > > > # - 3: write and forward message (default) > > > >>> > > > # > > > >>> > > > if re_match($app-name, "^FOO-[^-]+-([0123])") then { > > > >>> > > > set $!rsyslog_flag = cnum(field($app-name, 45, > > > >>> > > 3)); > > > >>> > > > if $!rsyslog_flag == 0 then { > > > >>> > > > unset $!rsyslog_write; > > > >>> > > > unset $!rsyslog_forward; > > > >>> > > > } else if $!rsyslog_flag == 1 then { > > > >>> > > > unset $!rsyslog_write; > > > >>> > > > } else if $!rsyslog_flag == 2 then { > > > >>> > > > unset $!rsyslog_forward; > > > >>> > > > } > > > >>> > > > } > > > >>> > > > > > > >>> > > > # Write all messages for debugging > > > >>> > > > template(name="cee-debug" type="string" string="msg: > > > >>> > > \"%msg%\", json: > > > >>> > > > %$!all-json%\n") > > > >>> > > > action(name="cee-debug" type="omfile" > > > >>> > > file="/tmp/cee- > > > >>> > debug" > > > >>> > > > template="cee-debug") > > > >>> > > > --- > > > >>> > > > > > > >>> > > > And that's how I tested it : > > > >>> > > > # logger -t FOO-bar-0 test-0 > > > >>> > > > # logger -t FOO-bar-1 test-1 > > > >>> > > > # logger -t FOO-bar-2 test-2 > > > >>> > > > # logger -t FOO-bar-3 test-3 > > > >>> > > > # cat /tmp/cee-debug > > > >>> > > > msg: " test-0", json: { "rsyslog_write": 1, > > > >>> "rsyslog_forward": > > > >>> > > 1, > > > >>> > > > "rsyslog_flag": 0 } > > > >>> > > > msg: " test-1", json: { "rsyslog_write": 1, > > > >>> "rsyslog_forward": > > > >>> > > 1, > > > >>> > > > "rsyslog_flag": 1 } > > > >>> > > > msg: " test-2", json: { "rsyslog_write": 1, > > > >>> "rsyslog_forward": > > > >>> > > 1, > > > >>> > > > "rsyslog_flag": 2 } > > > >>> > > > msg: " test-3", json: { "rsyslog_write": 1, > > > >>> "rsyslog_forward": > > > >>> > > 1, > > > >>> > > > "rsyslog_flag": 3 } > > > >>> > > > > > > >>> > > > > > > >>> > > > Messages are matched by re_match(), > > > >>> > > $!rsyslog_flag is > > > >>> well > > > >>> > > extracted from > > > >>> > > > the tag, but none of the tests on > > > >>> > > $!rsyslog_flag seem > > > >>> to be > > > >>> > > evaluated > > > >>> > > > successfully. > > > >>> > > > I tested the same config without cnum() + > > > >>> > > testing > > > >>> > $!rsyslog_flag > > > >>> > > with > > > >>> > > > strings => same results. > > > >>> > > > > > > >>> > > > Is there something I'm missing regarding > > > >>> > > nested if > > > >>> > statements ? > > > >>> > > > If that's the expected behavior, I would be > > > >>> > > grateful > > > >>> for > > > >>> > > clarification. :-) > > > >>> > > > > > > >>> > > > > > > >>> > > > Regards, > > > >>> > > > > > > >>> > > > Philippe Muller > > > >>> > > > > > > >>> > > > > > >>> > > > > _______________________________________________ > > > >>> > > rsyslog mailing list > > > >>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > >>> > > http://www.rsyslog.com/professional-services/ > > > >>> > > What's up with rsyslog? Follow > > > >>> https://twitter.com/rgerhards > > > >>> > > NOTE WELL: This is a PUBLIC mailing list, posts > > > >>> > > are > > > >>> ARCHIVED > > > >>> > by a > > > >>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and > > > >>> > > DO NOT > > > >>> > POST > > > >>> > > if you DON'T LIKE THAT. > > > >>> > > > > _______________________________________________ > > > >>> > > rsyslog mailing list > > > >>> > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > >>> > > http://www.rsyslog.com/professional-services/ > > > >>> > > What's up with rsyslog? Follow > > > >>> https://twitter.com/rgerhards > > > >>> > > NOTE WELL: This is a PUBLIC mailing list, posts > > > >>> > > are > > > >>> ARCHIVED > > > >>> > by a > > > >>> > > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and > > > >>> > > DO NOT > > > >>> > POST > > > >>> > > if you DON'T LIKE THAT. > > > >>> > > > > > >>> > > > > > >>> > > > > > >>> > > > > >>> > _______________________________________________ > > > >>> > rsyslog mailing list > > > >>> > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > >>> > http://www.rsyslog.com/professional-services/ > > > >>> > What's up with rsyslog? Follow https://twitter.com/rgerhards > > > >>> > NOTE > > > >>> WELL: > > > >>> > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > > >>> > of sites > > > >>> beyond > > > >>> > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > > > >>> > LIKE > > > THAT. > > > >>> _______________________________________________ > > > >>> rsyslog mailing list > > > >>> http://lists.adiscon.net/mailman/listinfo/rsyslog > > > >>> http://www.rsyslog.com/professional-services/ > > > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards > > > >>> NOTE > > > >>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > > > >>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO > > > >>> NOT POST if you DON'T LIKE THAT. > > > >>> > > > >> > > > >> > > > > > > > _______________________________________________ > > > rsyslog mailing list > > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > > http://www.rsyslog.com/professional-services/ > > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: > > > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > > > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > > DON'T > > LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: > This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond > our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
