2018-03-06 9:04 GMT+01:00 deoren
<rsyslog-users-lists.adiscon....@whyaskwhy.org>:
> On 3/6/2018 1:43 AM, Rainer Gerhards wrote:
>>
>> 2018-03-05 19:17 GMT+01:00 deoren
>> <rsyslog-users-lists.adiscon....@whyaskwhy.org>:
>>>
>>> Hi,
>>>
>>> When refactoring an older configuration I figured I would give global
>>> variables a try.
>>>
>>> I'm attempting to create a generic email notification ruleset that can be
>>> called after setting values in a subtree of the $.email-notification
>>> local
>>> variable.
>>>
>>> Example (email templates and associated ruleset not included here):
>>>
>>> set $/default-email-notification!sender = 'rsyslog-ale...@example.com';
>>> set $/default-email-notification!recipient = 'rsyslog-ad...@example.com';
>>> set $/default-email-notification!subject-template =
>>> 'email-notification-standard-subject';
>>> set $/default-email-notification!body-template =
>>> 'email-notification-standard-body';
>>> set $/default-email-notification!server-ip = '127.0.0.1';
>>> set $/default-email-notification!server-port = '25';
>>>
>>> action(
>>> name="email-alert-action"
>>> type="ommail"
>>> server="$.email-notification!server-ip"
>>> port="$.email-notification!server-port"
>>> mailfrom="$.email-notification!sender"
>>> mailto="$.email-notification!recipient"
>>> subject.template="$.email-notification!subject-template"
>>> template="$.email-notification!body-template"
>>> body.enable="on"
>>>
>>> # The parameter is included for every client request, so if we do
>>> # not apply some sort of rate limiting we will be flooded in a
>>> # very short amount of time.
>>> # Note: The interval is configured in number of seconds.
>>> action.execonlyonceeveryinterval=$.email-notification!interval
>>> )
>>
>>
>> But I think the above will not work, as the parameters must be constant
>> strings.
>>
>> Rainer
>
>
> I ended up learning that the hard way. It's too bad really, as that felt
> like a really good place to have support for variables.
For ommail, I would in theory not be such a big problem to support
these things, but in general this would be immensely
performance-hungry. In the concrete case, however, there is no
plumbing at all in the module interface/rsyslog core for this, so it
would probably require weeks of refactoring to make it happen. And for
almost all other cases you really don't want to have that capability,
as it slows down things very, very considerably.
Rainer
>
> The workaround (for me) was to create a common email body template and a
> common email subject template. I then set common values for the majority of
> each template and then added a variable reference at the end of each
> template.
>
> Then from applicable rulesets I used string concatenation (tie together
> constant strings with local variables and message properties) to build what
> I wanted the latter parts of the templates to contain and assigned the
> result to that last variable in the templates.
>
> It feels like an odd way to go about it, so I'm sure I'm doing something
> wrong. It works though and gives me something flexible I can use now until I
> learn a better way to go about it.
>
> Example:
>
> template(name="email-notification-standard-subject" type="list") {
>
> constant(value="RSYSLOG Alert from ")
> property(name="$myhostname")
> constant(value=" for ")
> # Set by a lookup table in a ruleset tied to an
> # input on the receiver
> property(name="$.hostname")
> constant(value=": ")
> property(name="$.email-notification!subject!topic")
>
> }
>
> In the rulesets, I use an approach similar to this (the simplest example):
>
> if ($programname == 'rsyslogd') then {
> if ($msg contains "Permission denied") then {
> set $.email-notification!subject!topic = $msg;
> call email-prod-notification
>
> }
> }
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
