Does $$!... work at all? It should be $/, $!, $., and $$ for system vars like $$now. ..
Sent from phone, thus brief. Am 26.07.2013 13:01 schrieb "David Lang" <[email protected]>: > ugly, I'm trying to write up the rules for how to address and access > variables of all the different types, and I was under the impression that > to access properties like hostname, I should use $hostname and to access > something like $!gid I needed to use $$!gid > > I know that when using templates, it's %hostname% vs %$!gid% > when doing a property based filter is :hostname vs :$!gid > > is there any time in scripting when the need to use $hostname would > require that the equivalent be $$!gid? > > David Lang > > > > On Fri, 26 Jul 2013, Andre Lorbach wrote: > > Seems like that $$! copies only a reference and $! copies the whole >> variable. >> Have you tried to use this instead: >> set $!trusted!local!gid = $!gid; >> set $!trusted!local!uid = $!uid; >> set $!trusted!local!pid = $!pid; >> set $!trusted!local!appname = $!appname; >> set $!trusted!local!cmd = $!cmd; >> >> best regards, >> Andre Lorbach >> >> -----Original Message----- >>> From: David Lang [mailto:[email protected]] >>> Sent: Friday, July 26, 2013 3:19 PM >>> To: [email protected]; rsyslog-users >>> Subject: Re: [rsyslog] problem copying variables and unsetting the >>> originals >>> >>> module(load="imuxsock" SysSock.Annotate="on" >>> SysSock.ParseTrusted="on") >>> module(load="imklog") >>> module(load="imudp") >>> input(type="imudp" port="514") >>> module(load="imtcp" MaxSessions="1000") input(type="imtcp" port="514") >>> module(load="mmjsonparse") >>> action(type="mmjsonparse") >>> if $fromhost-ip != "127.0.0.1" then { >>> #if the log is being received from another machine, add metadata >>> to the log >>> set $!trusted!origserver = $fromhost-ip; >>> set $!trusted!edge!time = $timegenerated; >>> set $!trusted!edge!relay = $$myhostname; >>> set $!trusted!edge!input = $inputname; } else { >>> set $!trusted!local!gid = $$!gid; >>> unset $!gid; >>> set $!trusted!local!uid = $$!uid; >>> unset $!uid; >>> set $!trusted!local!pid = $$!pid; >>> unset $!pid; >>> set $!trusted!local!appname = $$!appname; >>> unset $!appname; >>> set $!trusted!local!cmd = $$!cmd; >>> unset $!cmd; >>> set $!trusted!local!input = $inputname; } set >>> $!trusted!environment = "sending network"; # this should be replaced >>> with a lookup table call when that feature is added. >>> $template structured_forwarding,"<%pri%>**%timereported% %hostname% >>> %syslogtag% %$!%\n" >>> /var/log/messages;structured_**forwarding >>> >>> as-is this will show the variables under trusted!local, but with >>> values of null, comment out the unset lines and the correct info will >>> >> show up in both places. >> >>> >>> David Lang >>> >>> On Fri, 26 Jul 2013, Andre Lorbach wrote: >>> >>> Date: Fri, 26 Jul 2013 15:14:13 +0200 >>>> From: Andre Lorbach <[email protected]> >>>> To: rsyslog-users <[email protected]> >>>> Subject: Re: [rsyslog] problem copying variables and unsetting the >>>> originals >>>> >>>> Hi David, >>>> >>>> Could you send me a full working sample config? >>>> This would help trying to reproduce the problem. >>>> >>>> Best regards, >>>> Andre >>>> >>>> -----Original Message----- >>>>> From: >>>>> [email protected].**com<[email protected]>[mailto: >>>>> rsyslog- >>>>> [email protected]] On Behalf Of David Lang >>>>> Sent: Wednesday, July 24, 2013 11:47 PM >>>>> To: rsyslog-users >>>>> Subject: [rsyslog] problem copying variables and unsetting the >>>>> originals >>>>> >>>>> I'm trying to move variables to a different location in the JSON >>>>> >>>> structure. >>>> >>>>> >>>>> If I do: >>>>> set $!trusted!local!gid = $$!gid; >>>>> unset $!gid; >>>>> set $!trusted!local!uid = $$!uid; >>>>> unset $!uid; >>>>> set $!trusted!local!pid = $$!pid; >>>>> unset $!pid; >>>>> set $!trusted!local!appname = $$!appname; >>>>> unset $!appname; >>>>> set $!trusted!local!cmd = $$!cmd; >>>>> unset $!cmd; >>>>> >>>>> the $!trusted!local!* variables are all defined to be null >>>>> >>>>> but if I eliminate the unset statements, both the old and the new >>>>> >>>> variables >>>> >>>>> show up with the correct value. >>>>> >>>>> This looks like the new variables gets pointed to the old variables >>>>> >>>> instead of >>>> >>>>> to the contents of the old variables. >>>>> >>>>> David Lang >>>>> ______________________________**_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>>>> >>>> WELL: >> >>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>>>> sites >>>>> >>>> beyond >>>> >>>>> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >>>>> >>>> THAT. >>> >>>> ______________________________**_________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites >>>> >>> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >>> >>>> >>>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
