2016-05-31 15:40 GMT+02:00 Thomas Munn <[email protected]>: > Silly question: How do I enable ‘error’ logging. I did figure out how to > enable debug….I am using Centos 7.2…
There are many ways, as usual, but the most simple is adding the following to the top of rsyslog.conf: syslog.* /var/log/rsyslogd HTH Rainer > > Thomas >> On May 31, 2016, at 1:52 AM, Rainer Gerhards <[email protected]> >> wrote: >> >> 2016-05-31 4:12 GMT+02:00 Thomas Munn <[email protected]>: >>> I have a datafile: which contains: (hello.txt) >>> >>> hello hello hello >>> hello hello hello >>> >>> When I run my perl script on ‘cli’ I use: >>> >>> cat hello.txt | /usr/local/bin/hello2goodbye.pl >>> >>> Output is: >>> >>> goodbye goodbye goodbye >>> goodbye goodbye goodbye >> >> I think this is where your problem is rooted. You need to tell rsyslog >> which properties to modify, and do so be emiting json as output. See >> >> https://github.com/rsyslog/rsyslog/blob/master/plugins/external/INTERFACE.md >> >> (scroll towards the end "External Message Modification Modules"). >> >> So the response should be >> >> {"msg":"goodbye goodbye goodbye"} >> {"msg":"goodbye goodbye goodbye"} >> >> I would also assume that rsyslog spits out error messages about >> invalid json. Do you capture rsyslog error messages? Most distros >> unfortunately throw them away by default, what of course is a very bad >> idea when trouble-shooting... >> >> Rainer >> >>> >>> I did run it on the “CLI” with the requrested modification to see if I >>> would get output on a file, which I do if I run via cli (same was as above) >>> only the output is redirected to the appropriate log file, in unmodified >>> form. >>> >>> When I run via the rsyslog command: >>> >>> logger -f hello.txt >>> >>> I see no output. Perhaps I am testing wrong? Logger works fine until I put >>> in the config lines to invoke mmexternal, and then no logs for ANYTHING. I >>> did run debug mode, and noticed some stuff happening ,but nothing about >>> anything be passed to the skeleton progarm with the modification in it. Is >>> LOGGER a terrible way to test? >>> >>> Thomas >>> >>>> On May 30, 2016, at 8:00 PM, David Lang <[email protected]> wrote: >>>> >>>> On Sun, 29 May 2016, symgryph wrote: >>>> >>>>> I have been trying to get MMexternal to 'modify' incoming syslog messages >>>>> (using logger for now) to change a test string "hello" to "goodbye" as a >>>>> proof of concept. >>>>> >>>>> I am using rsyslog version rsyslog-8.18.0-1.el7.x86_64 on CentOS Linux >>>>> release 7.2.1511 (Core) >>>>> >>>>> The perl transformation program works fine when I feed in the file via >>>>> standard in, and outputs the expected output via standard out. >>>> >>>> what is it that you feed into it and what is the "expected output" that >>>> you get back? >>>> >>>> I would suggest modifying your perl program to write it's stdin to a file >>>> and make sure that what you get from rsyslog is what you think you are >>>> getting. >>>> >>>> David Lang >>>> _______________________________________________ >>>> rsyslog mailing list >>>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>>> http://www.rsyslog.com/professional-services/ >>>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >>>> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >>>> DON'T LIKE THAT. >>> >>> _______________________________________________ >>> rsyslog mailing list >>> http://lists.adiscon.net/mailman/listinfo/rsyslog >>> http://www.rsyslog.com/professional-services/ >>> What's up with rsyslog? Follow https://twitter.com/rgerhards >>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >>> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >>> LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of >> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T >> LIKE THAT. > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
