This is the summary of the debug errors: Next token is token SET () Shifting token SET () Entering state 8 Reading a token: 8429.876768087:7fef2d19b740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '$' in expression - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '$' in expression - is there an invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] 8429.876785129:7fef2d19b740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '.' in expression - is there an invalid escape sequence somewhere? rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: invalid character '.' in expression - is there an invalid escape sequence somewhere? [try http://www.rsyslog.com/e/2207 ] Next token is token FUNC () 8429.876814393:7fef2d19b740: Called LogError, msg: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax error on token 'errorlevel' rsyslogd: error during parsing file /etc/rsyslog.d/rsyslog-port21516.conf, on or before line 36: syntax error on token 'errorlevel' [try http://www.rsyslog.com/e/2207 ] Error: popping token SET () Stack now 0 1 Error: popping nterm conf () Stack now 0 Cleanup: discarding lookahead token FUNC () Stack now 0 8429.876861653:7fef2d19b740: Called LogError, msg: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. rsyslogd: CONFIG ERROR: could not interpret master config file '/etc/rsyslog.d/rsyslog-port21516.conf'. [try http://www.rsyslog.com/e/2207 ] 8429.876876815:7fef2d19b740: GenerateLocalHostName uses 'wmlogserv01s' rsyslogd: run failed with error -2207 (see rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that number means)
It looks like it is dying on the $. In the variable name. - James -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of David Lang Sent: Wednesday, September 18, 2013 1:19 PM To: rsyslog-users Subject: Re: [rsyslog] Local Variables Usage Question are there any other error messages? If you start in debug mode (-dn flags) you should be able to see where it dies David Lang On Wed, 18 Sep 2013, Boylan, James wrote: > I'm attempting to use local variables as a means to reduce the overall impact > of the regex per message. However I seem to be running into a hurdle that I > can find any documentation on. > > Specifically I'm attempting to use: > set $.errorlevel = > %msg:R,ERE,4,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|(.*)--end%; > set $.session = > %msg:R,ERE,8,BLANK:^(.*)([\^])([0-9.-]+)\|([A-Z]+)\|([a-zA-Z0-9.-]+)\| > ([a-zA-Z0-9._-]+)\|([a-zA-Z0-9]*)\|([a-zA-Z0-9._-]*)[~]*([a-zA-Z0-9._- > ]*)\|(.*)--end%; set $.appname = > %msg:R,ERE,1,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $.appversion = > %msg:R,ERE,2,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $.appinstance = > %msg:R,ERE,3,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9._ > ]+)[-_]*([A-Za-z0-9_-]*)([\^])--end%; > set $,logtype = > %msg:R,ERE,4,DFLT:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9.] > +)[-_]*([A-Za-z0-9_]*)[_-]*[a-zA-Z0-9_-]*([\^])--end%; > set $.cleanmessage = > %msg:R,ERE,5,FIELD:^([A-Za-z0-9._-]+)\|([A-Za-z0-9._-]+)\|([A-Za-z0-9. > _]+)[-_]*([A-Za-z0-9_-]*)[\^](.*)--end%; > > Which results in: > Starting system logger: rsyslogd: run failed with error -2207 (see > rsyslog.h or try http://www.rsyslog.com/e/2207 to learn what that > number means) > > I know it must be something in how I'm trying to define these. However I > haven't been able to find a definitive document on using them to truly > clarify it. > > Does anyone have any suggestions? > > Thanks! > > --James > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE > WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites > beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
