I have been trying to get MMexternal to 'modify' incoming syslog messages (using logger for now) to change a test string "hello" to "goodbye" as a proof of concept.
I am using rsyslog version rsyslog-8.18.0-1.el7.x86_64 on CentOS Linux release 7.2.1511 (Core) The perl transformation program works fine when I feed in the file via standard in, and outputs the expected output via standard out. The name of the perl binary is /usr/local/bin/hello2goodbye.pl its executable, and works.... I use the following "logger" command for a local test: logger -f /tmp/hello.txt hello.txt has lots of hello words in it, which do correctly get logged to /var/log/messages until I activate the config below: #Allow us to Transform input coming in to RSYSLOG module(load="mmexternal") action(type="mmexternal" binary="/usr/local/bin/hello2goodbye.pl" interface.input="msg" ) I no longer see ANY logs being sent to /var/log/messages. I am including the 'stub' program I am calling to help: BEGIN PROGRAM #! /usr/bin/perl # A skeleton for a perl rsyslog output plugin # Copyright (C) 2014 by Adiscon GmbH # # This file is part of rsyslog. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # -or- # see COPYING.ASL20 in the source distribution # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. #use strict; #use warnings; use IO::Handle; use IO::Select; # skeleton config parameters my $maxAtOnce = 1024; # max nbr of messages that are processed within one batch sub onInit { # Do everything that is needed to initialize processing (e.g. # open files, create handles, connect to systems...) } sub onReceive { # This is the entry point where actual work needs to be done. It receives # a list with all messages pulled from rsyslog. The list is of variable # length, but contains all messages that are currently available. It is # suggest NOT to use any further buffering, as we do not know when the # next message will arrive. It may be in a nanosecond from now, but it # may also be in three hours... foreach(@_) { s/hello/goodbye/g; print $_; } } sub onExit { # Do everything that is needed to finish processing (e.g. # close files, handles, disconnect from systems...). This is # being called immediately before exiting. } #------------------------------------------------------- #This is plumbing that DOES NOT need to be CHANGED #------------------------------------------------------- onInit(); # Read from STDIN $STDIN = IO::Select->new(); $STDIN->add(\*STDIN); # Enter main Loop my $keepRunning = 1; while ($keepRunning) { my @msgs; my $stdInLine; my $msgsInBatch = 0; while ($keepRunning) { #sleep(1); # We seem to have not timeout for select - or do we? if ($STDIN->can_read($pollPeriod)) { $stdInLine = <STDIN>; # Catch EOF, run onRecieve one last time and exit if (eof()){ $keepRunning = 0; last; } if (length($stdInLine) > 0) { push (@msgs, $stdInLine); $msgsInBatch++; if ($msgsInBatch >= $maxAtOnce) { last; } } } } onReceive(@msgs); } onExit(); -- View this message in context: http://rsyslog-users.1305293.n2.nabble.com/Having-difficult-getting-MMEXternal-work-with-rsyslog-and-an-external-perl-program-tp7590890.html Sent from the rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
