I'm not seeing anything obviously wrong (and apologies for missing the sample in
your first post)
have you checked for syntax errors in the config ( rsyslogd -N2 )?
David Lang
On Tue, 3 Nov 2015, Radu Gheorghe wrote:
Date: Tue, 3 Nov 2015 18:47:05 +0200
From: Radu Gheorghe <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] mmpstrucdata doesn't seem to work
Hi David,
Here's how the debug template writes with a "server" config like the
one I pasted in the first Email:
Debug line with all properties:
FROMHOST: 'localhost', fromhost-ip: '127.0.0.1', HOSTNAME:
'rgheorghe-ubuntu', PRI: 46,
syslogtag 'rsyslogd', programname: 'rsyslogd', APP-NAME: 'rsyslogd',
PROCID: '-', MSGID: '-',
TIMESTAMP: 'Nov 3 18:38:09', STRUCTURED-DATA: '-',
msg: ' [origin software="rsyslogd" swVersion="8.13.0" x-pid="1623"
x-info="http://www.rsyslog.com";] start'
escaped msg: ' [origin software="rsyslogd" swVersion="8.13.0"
x-pid="1623" x-info="http://www.rsyslog.com";] start'
inputname: imtcp rawmsg: '<46>1 2015-11-03T18:38:09.287115+02:00
rgheorghe-ubuntu rsyslogd - - - [origin software="rsyslogd"
swVersion="8.13.0" x-pid="1623" x-info="http://www.rsyslog.com";]
start'
$!:
$.:
$/:
So it sounds like rsyslog parses the RFC5424 message, but mmpstrucdata
doesn't seem to put anything in that $! variable.
Thanks and best regards,
Radu
--
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/
On Mon, Nov 2, 2015 at 7:45 PM, David Lang <[email protected]> wrote:
can you show us a same of the rawlog that you are receiving?
among other things, it shows up with the template RSYSLOG_DebugFormat
David Lang
On Mon, 2 Nov 2015, Radu Gheorghe wrote:
Date: Mon, 2 Nov 2015 14:13:23 +0200
From: Radu Gheorghe <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: [rsyslog] mmpstrucdata doesn't seem to work
Hello rsysloggers :)
I'm having trouble setting up mmpstrucdata (running on 64-bit Ubuntu
14.04 with rsyslog 8.13 installed from the official packages, if it
matters).
I've followed the docs
(http://www.rsyslog.com/doc/v8-stable/configuration/modules/mmpstrucdata.html)
and I didn't get anything out of the $! or the $!rfc5424-sd variables.
I've changed the jsonRoot path - still no go. Tried with $!all-json -
nothing. And by "nothing", I mean "the contents of these variables are
always empty". Except for $!all-json, which naturally shows an empty
JSON.
I see there is a test there on the testbench so I figured I must be
doing something wrong, then I tried to emulate that. Here's my last
(failed) attempt:
Server config:
---------
module(load="imtcp")
module(load="mmpstrucdata")
input(type="imtcp" port="514")
action(type="mmpstrucdata")
template(name="jsondump" type="string" string="%$!%\n")
action(type="omfile"
file="/var/log/test"
template="jsondump")
---------
Client config:
--------
module(load="imuxsock")
action(type="omfwd"
protocol="tcp"
target="127.0.0.1"
port="514"
template="RSYSLOG_SyslogProtocol23Format")
--------
If I had to bet, I'd still go for me missing something (as I would
expect the test to fail otherwise). Can someone confirm that
mmpstrucdata still works on 8.13 and show an example config? Does
anyone use this module at all? (I wouldn't blame anyone if they don't
use it, I prefer JSON in the message anyway :p)
Thanks and best regards,
Radu
--
Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
