Silly question: How do I enable ‘error’ logging. I did figure out how to enable debug….I am using Centos 7.2…
Thomas > On May 31, 2016, at 1:52 AM, Rainer Gerhards <[email protected]> wrote: > > 2016-05-31 4:12 GMT+02:00 Thomas Munn <[email protected]>: >> I have a datafile: which contains: (hello.txt) >> >> hello hello hello >> hello hello hello >> >> When I run my perl script on ‘cli’ I use: >> >> cat hello.txt | /usr/local/bin/hello2goodbye.pl >> >> Output is: >> >> goodbye goodbye goodbye >> goodbye goodbye goodbye > > I think this is where your problem is rooted. You need to tell rsyslog > which properties to modify, and do so be emiting json as output. See > > https://github.com/rsyslog/rsyslog/blob/master/plugins/external/INTERFACE.md > > (scroll towards the end "External Message Modification Modules"). > > So the response should be > > {"msg":"goodbye goodbye goodbye"} > {"msg":"goodbye goodbye goodbye"} > > I would also assume that rsyslog spits out error messages about > invalid json. Do you capture rsyslog error messages? Most distros > unfortunately throw them away by default, what of course is a very bad > idea when trouble-shooting... > > Rainer > >> >> I did run it on the “CLI” with the requrested modification to see if I would >> get output on a file, which I do if I run via cli (same was as above) only >> the output is redirected to the appropriate log file, in unmodified form. >> >> When I run via the rsyslog command: >> >> logger -f hello.txt >> >> I see no output. Perhaps I am testing wrong? Logger works fine until I put >> in the config lines to invoke mmexternal, and then no logs for ANYTHING. I >> did run debug mode, and noticed some stuff happening ,but nothing about >> anything be passed to the skeleton progarm with the modification in it. Is >> LOGGER a terrible way to test? >> >> Thomas >> >>> On May 30, 2016, at 8:00 PM, David Lang <[email protected]> wrote: >>> >>> On Sun, 29 May 2016, symgryph wrote: >>> >>>> I have been trying to get MMexternal to 'modify' incoming syslog messages >>>> (using logger for now) to change a test string "hello" to "goodbye" as a >>>> proof of concept. >>>> >>>> I am using rsyslog version rsyslog-8.18.0-1.el7.x86_64 on CentOS Linux >>>> release 7.2.1511 (Core) >>>> >>>> The perl transformation program works fine when I feed in the file via >>>> standard in, and outputs the expected output via standard out. >>> >>> what is it that you feed into it and what is the "expected output" that you >>> get back? >>> >>> I would suggest modifying your perl program to write it's stdin to a file >>> and make sure that what you get from rsyslog is what you think you are >>> getting. >>> >>> David Lang >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >> >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
