ugly, I'm trying to write up the rules for how to address and access variables
of all the different types, and I was under the impression that to access
properties like hostname, I should use $hostname and to access something like
$!gid I needed to use $$!gid
I know that when using templates, it's %hostname% vs %$!gid%
when doing a property based filter is :hostname vs :$!gid
is there any time in scripting when the need to use $hostname would require that
the equivalent be $$!gid?
David Lang
On Fri, 26 Jul 2013, Andre Lorbach wrote:
Seems like that $$! copies only a reference and $! copies the whole
variable.
Have you tried to use this instead:
set $!trusted!local!gid = $!gid;
set $!trusted!local!uid = $!uid;
set $!trusted!local!pid = $!pid;
set $!trusted!local!appname = $!appname;
set $!trusted!local!cmd = $!cmd;
best regards,
Andre Lorbach
-----Original Message-----
From: David Lang [mailto:[email protected]]
Sent: Friday, July 26, 2013 3:19 PM
To: [email protected]; rsyslog-users
Subject: Re: [rsyslog] problem copying variables and unsetting the
originals
module(load="imuxsock" SysSock.Annotate="on"
SysSock.ParseTrusted="on")
module(load="imklog")
module(load="imudp")
input(type="imudp" port="514")
module(load="imtcp" MaxSessions="1000") input(type="imtcp" port="514")
module(load="mmjsonparse")
action(type="mmjsonparse")
if $fromhost-ip != "127.0.0.1" then {
#if the log is being received from another machine, add metadata
to the log
set $!trusted!origserver = $fromhost-ip;
set $!trusted!edge!time = $timegenerated;
set $!trusted!edge!relay = $$myhostname;
set $!trusted!edge!input = $inputname; } else {
set $!trusted!local!gid = $$!gid;
unset $!gid;
set $!trusted!local!uid = $$!uid;
unset $!uid;
set $!trusted!local!pid = $$!pid;
unset $!pid;
set $!trusted!local!appname = $$!appname;
unset $!appname;
set $!trusted!local!cmd = $$!cmd;
unset $!cmd;
set $!trusted!local!input = $inputname; } set
$!trusted!environment = "sending network"; # this should be replaced
with a lookup table call when that feature is added.
$template structured_forwarding,"<%pri%>%timereported% %hostname%
%syslogtag% %$!%\n"
/var/log/messages;structured_forwarding
as-is this will show the variables under trusted!local, but with
values of null, comment out the unset lines and the correct info will
show up in both places.
David Lang
On Fri, 26 Jul 2013, Andre Lorbach wrote:
Date: Fri, 26 Jul 2013 15:14:13 +0200
From: Andre Lorbach <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] problem copying variables and unsetting the
originals
Hi David,
Could you send me a full working sample config?
This would help trying to reproduce the problem.
Best regards,
Andre
-----Original Message-----
From: [email protected] [mailto:rsyslog-
[email protected]] On Behalf Of David Lang
Sent: Wednesday, July 24, 2013 11:47 PM
To: rsyslog-users
Subject: [rsyslog] problem copying variables and unsetting the
originals
I'm trying to move variables to a different location in the JSON
structure.
If I do:
set $!trusted!local!gid = $$!gid;
unset $!gid;
set $!trusted!local!uid = $$!uid;
unset $!uid;
set $!trusted!local!pid = $$!pid;
unset $!pid;
set $!trusted!local!appname = $$!appname;
unset $!appname;
set $!trusted!local!cmd = $$!cmd;
unset $!cmd;
the $!trusted!local!* variables are all defined to be null
but if I eliminate the unset statements, both the old and the new
variables
show up with the correct value.
This looks like the new variables gets pointed to the old variables
instead of
to the contents of the old variables.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL:
This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites
beyond
our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE
WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites
beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
