module(load="imuxsock" SysSock.Annotate="on" SysSock.ParseTrusted="on")
module(load="imklog")
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp" MaxSessions="1000")
input(type="imtcp" port="514")
module(load="mmjsonparse")
action(type="mmjsonparse")
if $fromhost-ip != "127.0.0.1" then {
#if the log is being received from another machine, add metadata to the log
set $!trusted!origserver = $fromhost-ip;
set $!trusted!edge!time = $timegenerated;
set $!trusted!edge!relay = $$myhostname;
set $!trusted!edge!input = $inputname;
} else {
set $!trusted!local!gid = $$!gid;
unset $!gid;
set $!trusted!local!uid = $$!uid;
unset $!uid;
set $!trusted!local!pid = $$!pid;
unset $!pid;
set $!trusted!local!appname = $$!appname;
unset $!appname;
set $!trusted!local!cmd = $$!cmd;
unset $!cmd;
set $!trusted!local!input = $inputname;
}
set $!trusted!environment = "sending network";
# this should be replaced with a lookup table call when that feature is added.
$template structured_forwarding,"<%pri%>%timereported% %hostname% %syslogtag%
%$!%\n"
/var/log/messages;structured_forwarding
as-is this will show the variables under trusted!local, but with values of null,
comment out the unset lines and the correct info will show up in both places.
David Lang
On Fri, 26 Jul 2013, Andre Lorbach wrote:
Date: Fri, 26 Jul 2013 15:14:13 +0200
From: Andre Lorbach <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] problem copying variables and unsetting the originals
Hi David,
Could you send me a full working sample config?
This would help trying to reproduce the problem.
Best regards,
Andre
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of David Lang
Sent: Wednesday, July 24, 2013 11:47 PM
To: rsyslog-users
Subject: [rsyslog] problem copying variables and unsetting the originals
I'm trying to move variables to a different location in the JSON
structure.
If I do:
set $!trusted!local!gid = $$!gid;
unset $!gid;
set $!trusted!local!uid = $$!uid;
unset $!uid;
set $!trusted!local!pid = $$!pid;
unset $!pid;
set $!trusted!local!appname = $$!appname;
unset $!appname;
set $!trusted!local!cmd = $$!cmd;
unset $!cmd;
the $!trusted!local!* variables are all defined to be null
but if I eliminate the unset statements, both the old and the new
variables
show up with the correct value.
This looks like the new variables gets pointed to the old variables
instead of
to the contents of the old variables.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL:
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites
beyond
our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
