Here is the output I get from the debug format, I have not been able to
find a way to represent the $! items individually though.
I have tried, %$!SRC%, %$!:SRC%, $!SRC, %$!{SRC}
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME: 'localhost',
PRI: 4,
syslogtag 'kernel:', programname: 'kernel', APP-NAME: 'kernel', PROCID:
'-', MSGID: '-',
TIMESTAMP: 'Oct 25 16:03:11', STRUCTURED-DATA: '-',
msg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354 DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
escaped msg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354 DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
inputname: imklog rawmsg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354 DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
$!:{ "IN": "lo", "OUT": "", "MAC":
"00:00:00:00:00:00:00:00:00:00:00:00:08:00", "SRC": "127.0.0.1", "DST":
"127.0.0.1", "LEN": "60", "TOS": "0x10", "PREC": "0x00", "TTL": "64", "ID":
"42494", "DF": "[*PRESENT*]", "PROTO": "TCP", "SPT": "48354", "DPT":
"44444", "WINDOW": "32792", "RES": "0x00", "SYN": "[*PRESENT*]", "URGP":
"0", "": "[*PRESENT*]", "kerntime": "[41404150.744046]" }
$.:
$/:
On Sat, Oct 25, 2014 at 1:10 PM, David Lang <[email protected]> wrote:
> RSYSLOG_DebugFormat
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
