Guess I am too much in vacation mode ; ) Sent from phone, thus brief. Am 27.07.2013 17:18 schrieb "David Lang" <[email protected]>:
> $$! works for set, as long as you don't unset the original. > > David Lang > > On Sat, 27 Jul 2013, Rainer Gerhards wrote: > > Date: Sat, 27 Jul 2013 22:53:53 +0200 >> From: Rainer Gerhards <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> Subject: Re: [rsyslog] problem copying variables and unsetting the >> originals >> >> Does $$!... work at all? It should be $/, $!, $., and $$ for system vars >> like $$now. .. >> >> Sent from phone, thus brief. >> Am 26.07.2013 13:01 schrieb "David Lang" <[email protected]>: >> >> ugly, I'm trying to write up the rules for how to address and access >>> variables of all the different types, and I was under the impression that >>> to access properties like hostname, I should use $hostname and to access >>> something like $!gid I needed to use $$!gid >>> >>> I know that when using templates, it's %hostname% vs %$!gid% >>> when doing a property based filter is :hostname vs :$!gid >>> >>> is there any time in scripting when the need to use $hostname would >>> require that the equivalent be $$!gid? >>> >>> David Lang >>> >>> >>> >>> On Fri, 26 Jul 2013, Andre Lorbach wrote: >>> >>> Seems like that $$! copies only a reference and $! copies the whole >>> >>>> variable. >>>> Have you tried to use this instead: >>>> set $!trusted!local!gid = $!gid; >>>> set $!trusted!local!uid = $!uid; >>>> set $!trusted!local!pid = $!pid; >>>> set $!trusted!local!appname = $!appname; >>>> set $!trusted!local!cmd = $!cmd; >>>> >>>> best regards, >>>> Andre Lorbach >>>> >>>> -----Original Message----- >>>> >>>>> From: David Lang [mailto:[email protected]] >>>>> Sent: Friday, July 26, 2013 3:19 PM >>>>> To: [email protected]; rsyslog-users >>>>> Subject: Re: [rsyslog] problem copying variables and unsetting the >>>>> originals >>>>> >>>>> module(load="imuxsock" SysSock.Annotate="on" >>>>> SysSock.ParseTrusted="on") >>>>> module(load="imklog") >>>>> module(load="imudp") >>>>> input(type="imudp" port="514") >>>>> module(load="imtcp" MaxSessions="1000") input(type="imtcp" port="514") >>>>> module(load="mmjsonparse") >>>>> action(type="mmjsonparse") >>>>> if $fromhost-ip != "127.0.0.1" then { >>>>> #if the log is being received from another machine, add metadata >>>>> to the log >>>>> set $!trusted!origserver = $fromhost-ip; >>>>> set $!trusted!edge!time = $timegenerated; >>>>> set $!trusted!edge!relay = $$myhostname; >>>>> set $!trusted!edge!input = $inputname; } else { >>>>> set $!trusted!local!gid = $$!gid; >>>>> unset $!gid; >>>>> set $!trusted!local!uid = $$!uid; >>>>> unset $!uid; >>>>> set $!trusted!local!pid = $$!pid; >>>>> unset $!pid; >>>>> set $!trusted!local!appname = $$!appname; >>>>> unset $!appname; >>>>> set $!trusted!local!cmd = $$!cmd; >>>>> unset $!cmd; >>>>> set $!trusted!local!input = $inputname; } set >>>>> $!trusted!environment = "sending network"; # this should be replaced >>>>> with a lookup table call when that feature is added. >>>>> $template structured_forwarding,"<%pri%>****%timereported% %hostname% >>>>> %syslogtag% %$!%\n" >>>>> /var/log/messages;structured_****forwarding >>>>> >>>>> as-is this will show the variables under trusted!local, but with >>>>> values of null, comment out the unset lines and the correct info will >>>>> >>>>> show up in both places. >>>> >>>> >>>>> David Lang >>>>> >>>>> On Fri, 26 Jul 2013, Andre Lorbach wrote: >>>>> >>>>> Date: Fri, 26 Jul 2013 15:14:13 +0200 >>>>> >>>>>> From: Andre Lorbach <[email protected]> >>>>>> To: rsyslog-users <[email protected]> >>>>>> Subject: Re: [rsyslog] problem copying variables and unsetting the >>>>>> originals >>>>>> >>>>>> Hi David, >>>>>> >>>>>> Could you send me a full working sample config? >>>>>> This would help trying to reproduce the problem. >>>>>> >>>>>> Best regards, >>>>>> Andre >>>>>> >>>>>> -----Original Message----- >>>>>> >>>>>>> From: [email protected].****com<rsyslog-bounces@lists.** >>>>>>> adiscon.com <[email protected]>>[mailto: >>>>>>> rsyslog- >>>>>>> [email protected]] On Behalf Of David Lang >>>>>>> Sent: Wednesday, July 24, 2013 11:47 PM >>>>>>> To: rsyslog-users >>>>>>> Subject: [rsyslog] problem copying variables and unsetting the >>>>>>> originals >>>>>>> >>>>>>> I'm trying to move variables to a different location in the JSON >>>>>>> >>>>>>> structure. >>>>>> >>>>>> >>>>>>> If I do: >>>>>>> set $!trusted!local!gid = $$!gid; >>>>>>> unset $!gid; >>>>>>> set $!trusted!local!uid = $$!uid; >>>>>>> unset $!uid; >>>>>>> set $!trusted!local!pid = $$!pid; >>>>>>> unset $!pid; >>>>>>> set $!trusted!local!appname = $$!appname; >>>>>>> unset $!appname; >>>>>>> set $!trusted!local!cmd = $$!cmd; >>>>>>> unset $!cmd; >>>>>>> >>>>>>> the $!trusted!local!* variables are all defined to be null >>>>>>> >>>>>>> but if I eliminate the unset statements, both the old and the new >>>>>>> >>>>>>> variables >>>>>> >>>>>> show up with the correct value. >>>>>>> >>>>>>> This looks like the new variables gets pointed to the old variables >>>>>>> >>>>>>> instead of >>>>>> >>>>>> to the contents of the old variables. >>>>>>> >>>>>>> David Lang >>>>>>> ______________________________****_________________ >>>>>>> rsyslog mailing list >>>>>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>>>>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>>> > >>>>>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>>>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>>>>>> > >>>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>>>>>> >>>>>>> WELL: >>>>>> >>>>> >>>> This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>>>> >>>>>> sites >>>>>>> >>>>>>> beyond >>>>>> >>>>>> our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE >>>>>>> >>>>>>> THAT. >>>>>> >>>>> >>>>> ______________________________****_________________ >>>>>> rsyslog mailing list >>>>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>>>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>>> > >>>>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>>>>> > >>>>>> What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE >>>>>> WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>>>> of sites >>>>>> >>>>>> beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>>>> LIKE THAT. >>>>> >>>>> >>>>>> ______________________________****_________________ >>>>>> >>>>> rsyslog mailing list >>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>> > >>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>>> > >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>>> >>>> ______________________________****_________________ >>>> >>> rsyslog mailing list >>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>> > >>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>> > >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>> DON'T LIKE THAT. >>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
