On Wed, 23 Nov 2016, [email protected] wrote:
do you have an example of what was sent over the wire and how it was
mishandled? It may be that we need to tweak the default parsers.
https://github.com/rsyslog/rsyslog/issues/1191
Ok, reading that I'm still confused.
I'll ask again on that issue.
no need to convert, just add the ability to use the slower, but more
flexible mmnormalize.
You said it has bugs with rawmsg... :P
pm and mm don't work on the same data.
pm deals with the raw message that arrives on the wire
mm works with all the variables that exist at the time the mm module is
called
mm modules can look at the data as it arrived over the wire, and they can
also look at variables that have been created later.
I would like to see a pmmm module, or at least a pmnormalize module
created, but I wouldn't want to try and replace the existing parsers with
them.
IMHO it doesn't makes sense pm's parsing anything if I'll use mmnorm with
rawmsg, right?
That's why I consider pm==mm regarding message handling.
mmnormalize on rawmsg is very similar to what a pm does (other than the ability
to populate the default properties)
but you are missing all the other ways to sue mmnormalize, and mmnormalize is
the only mm module that I know of that has a flag to work on the rawmsg.
The existing C parsers have a whole lot of hieristics that would be very hard to
put into something like mmnormalize.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
