you can't turn on debugging just around a particular set of statements, but
since this problem is so predictable, if you start with debugging on and
generate one iptables log message (which you can do from logger), then shut it
down and send the debug log, that should give us the info we need.
David Lang
On Tue, 28 Oct 2014, Todd Mortensen wrote:
Is there a way I can turn on more debug around the mmnormalize functions?
Although I think the mmnormalize parsing of iptables is working correctly
because I do see the values I want in the Rsyslog_debug format output for
$!, I just can use them in a template with any of my current attempts.
On Sun, Oct 26, 2014 at 4:10 PM, Todd Mortensen <[email protected]>
wrote:
In the debug output I do not see any of the mmnormalize parsed values,
only references to SRC are from my templates.
On Sun, Oct 26, 2014 at 9:06 AM, Rainer Gerhards <[email protected]
wrote:
Yeah that is waht i was looking for. On the phone though i do not see
access to SRC...
Sent from phone, thus brief.
Am 26.10.2014 16:51 schrieb "Todd Mortensen" <[email protected]>:
Sure, the lines I have been posting so far are from the
RSYSLOG_DebugFormat output. Are you looking for the output from these
options ?
$DebugFile /var/log/rsyslog.debug.log
$DebugLevel 2
I have attached a full run from start to stop with a telnet test to
generate the iptables line. I telnet to port 45678 so that is what I
search for.
On 10/26/2014 08:32 AM, Rainer Gerhards wrote:
Can you create a debug log?
Sent from phone, thus brief.
Am 26.10.2014 16:27 schrieb "Todd Mortensen" <[email protected]>:
Switching to path=$!norm does move the values to what one would think
is
the proper place, yet I still can not use any permutation in a
template.
Here is the full debug output showing the !norm is correct now.
$!:{ "norm": { "IN": "lo", "OUT": "", "MAC":
"00:00:00:00:00:00:00:00:00:00:00:00:08:00", "SRC": "127.0.0.1",
"DST":
"127.0.0.1", "LEN": "60", "TOS": "0x10", "PREC": "0x00", "TTL": "64",
"ID":
"62894", "DF": "[*PRESENT*]", "PROTO": "TCP", "SPT": "34951", "DPT":
"45678", "WINDOW": "32792", "RES": "0x00", "SYN": "[*PRESENT*]",
"URGP":
"0", "": "[*PRESENT*]", "kerntime": "[41463095.356057]" }, "testzzz":
"testvalueyyy" }
On Sat, Oct 25, 2014 at 9:36 PM, David Lang <[email protected]> wrote:
silly thought, try $!src in case there is a capitalization oddity
going
on
here.
the path should hvae been $!norm not !norm, but I don't think that's
your
problem.
The fact that setting testzzz put the variable where it does in the
debug
output also says that it should just be $!SRC
David Lang
On Sat, 25 Oct 2014, Todd Mortensen wrote:
Date: Sat, 25 Oct 2014 20:08:07 -0700
From: Todd Mortensen <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] mmnormalize and iptables, help using the
parsed
values
I have tested and can set and print a test variable. I tried
%$!!SRC%
no
luck.
I added a path to the mmnormalize call, it added an empty norm {}
to $!
but
the mmnormalized items are not in it.
*.* {action(type="mmnormalize" UseRawMsg="on" path="!norm"
ruleBase="/etc/rsyslog.d/normalize.rb")}
template(name="testFormat" type="string" string="src is %$!norm!SRC%
and
test is %$!testzzz% \n")
if $parsesuccess == "OK" then{
action(type="omfile" file="/var/log/parsed.log"
template="testFormat")
action(type="omfile" file="/var/log/parsed.debug.log"
template="RSYSLOG_DebugFormat")
}
parsed.log output
src is and test is testvalueyyy
parsed.debug.log outout
Debug line with all properties:
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME:
'localhost',
PRI: 4,
syslogtag 'kernel:', programname: 'kernel', APP-NAME: 'kernel',
PROCID:
'-', MSGID: '-',
TIMESTAMP: 'Oct 25 20:01:31', STRUCTURED-DATA: '-',
msg: '[41418450.088091] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=18808 DF PROTO=TCP SPT=34607
DPT=45678
WINDOW=32792 RES=0x00 SYN URGP=0 '
escaped msg: '[41418450.088091] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=18808 DF PROTO=TCP SPT=34607
DPT=45678
WINDOW=32792 RES=0x00 SYN URGP=0 '
inputname: imklog rawmsg: '[41418450.088091] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=18808 DF PROTO=TCP SPT=34607
DPT=45678
WINDOW=32792 RES=0x00 SYN URGP=0 '
$!:{ "IN": "lo", "OUT": "", "MAC":
"00:00:00:00:00:00:00:00:00:00:00:00:08:00", "SRC": "127.0.0.1",
"DST":
"127.0.0.1", "LEN": "60", "TOS": "0x10", "PREC": "0x00", "TTL":
"64",
"ID":
"18808", "DF": "[*PRESENT*]", "PROTO": "TCP", "SPT": "34607", "DPT":
"45678", "WINDOW": "32792", "RES": "0x00", "SYN": "[*PRESENT*]",
"URGP":
"0", "": "[*PRESENT*]", "kerntime": "[41418450.088091]", "testzzz":
"testvalueyyy", "norm": { } }
$.:
$/:
On Sat, Oct 25, 2014 at 7:24 PM, David Lang <[email protected]> wrote:
define a variable roursel and see what it looks like relative to
the
others
set $!test = 'value';
the % are only used in format statements, not in amy tests
I would expect that $!SRC would be right in a test and %$!SRC% in a
format
statement.
try $!!SRC on the thought that there is a top level name being lost
here.
Or try specifying a path in the action to explicitly put them under
something (say $!normalized which should result in
$!normalized!SRC as
the
variable name)
David Lang
On Sat, 25 Oct 2014, Todd Mortensen wrote:
Here is the output I get from the debug format, I have not been
able
to
find a way to represent the $! items individually though.
I have tried, %$!SRC%, %$!:SRC%, $!SRC, %$!{SRC}
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME:
'localhost',
PRI: 4,
syslogtag 'kernel:', programname: 'kernel', APP-NAME: 'kernel',
PROCID:
'-', MSGID: '-',
TIMESTAMP: 'Oct 25 16:03:11', STRUCTURED-DATA: '-',
msg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354
DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
escaped msg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354
DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
inputname: imklog rawmsg: '[41404150.744046] Denied: IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1
LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=42494 DF PROTO=TCP SPT=48354
DPT=44444
WINDOW=32792 RES=0x00 SYN URGP=0 '
$!:{ "IN": "lo", "OUT": "", "MAC":
"00:00:00:00:00:00:00:00:00:00:00:00:08:00", "SRC": "127.0.0.1",
"DST":
"127.0.0.1", "LEN": "60", "TOS": "0x10", "PREC": "0x00", "TTL": "64",
"ID":
"42494", "DF": "[*PRESENT*]", "PROTO": "TCP", "SPT": "48354",
"DPT":
"44444", "WINDOW": "32792", "RES": "0x00", "SYN": "[*PRESENT*]",
"URGP":
"0", "": "[*PRESENT*]", "kerntime": "[41404150.744046]" }
$.:
$/:
On Sat, Oct 25, 2014 at 1:10 PM, David Lang <[email protected]>
wrote:
RSYSLOG_DebugFormat
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if
you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
