do you have an example of what was sent over the wire and how it was
mishandled? It may be that we need to tweak the default parsers.
https://github.com/rsyslog/rsyslog/issues/1191
no need to convert, just add the ability to use the slower, but more
flexible mmnormalize.
You said it has bugs with rawmsg... :P
pm and mm don't work on the same data.
pm deals with the raw message that arrives on the wire
mm works with all the variables that exist at the time the mm module
is called
mm modules can look at the data as it arrived over the wire, and they
can also look at variables that have been created later.
I would like to see a pmmm module, or at least a pmnormalize module
created, but I wouldn't want to try and replace the existing parsers
with them.
IMHO it doesn't makes sense pm's parsing anything if I'll use mmnorm
with rawmsg, right?
That's why I consider pm==mm regarding message handling.
90% of it is just getting good documentation of the over-the-wire
protocol
the rest of it comes into play with things like the current omkafka
problem where the module is telling rsyslog that the message delivery
succeeded when it has really failed. That's where the deeper knowledge
of the other system is needed.
where was the devil...? :P
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
