The problem appears to have been using "set" statement outside of a ruleset
definition, not using an intermediary variable as I thought previously.
This did NOT work, where the set statement is not part of the ruleset
definition, the $!csv_msg variable was empty:
set $!csv_msg = replace($msg,"|",",");
template(name="isilon_tmpl" type="string"
string="%TIMESTAMP:::date-rfc3339% %HOSTNAME%
%syslogtag%%$!csv_msg%\n")
ruleset(name="isilon_rset") {
if ($msg contains "/xxxxx" or $msg contains "/xxxx" or $msg contains
"/xxxx") then {
action(type="omfile" FileCreateMode="0644"
File="/var/log/remote/msg/eric-test" template="isilon_tmpl")
}
}
This DID work, where the set statement IS part of the ruleset definition:
template(name="isilon_tmpl" type="string"
string="%TIMESTAMP:::date-rfc3339% %HOSTNAME%
%syslogtag%%$!csv_msg%\n")
ruleset(name="isilon_rset") {
if ($msg contains "/ifs/cda/userdata/ctshared" or $msg contains
"/ifs/cda/userdata/cdm" or $msg contains "/ifs/cda/userdata/DevIS") then {
set $!csv_msg = replace($msg,"|",",");
action(type="omfile" FileCreateMode="0644"
File="/var/log/remote/msg/eric-test" template="isilon_tmpl")
}
}
Is this expected behavior?
Regards,
Eric
-----Original Message-----
From: Rainer Gerhards <[email protected]>
Sent: Sunday, March 17, 2019 8:22 AM
To: rsyslog-users <[email protected]>
Cc: Secrist, Eric <[email protected]>
Subject: Re: [rsyslog] [External] Re: String replacement
El mié., 13 mar. 2019 a las 19:00, Secrist, Eric via rsyslog
(<[email protected]>) escribió:
>
> Understood, $msg cannot be modified directly.
>
> But, why does this work?
> set $!emsg = $msg;
> set $!csv_msg = replace($!emsg,"|",",");
mmhhh....replace($msg, ...) does NOT modify $msg - it just uses it as input. Do
you have a debug log of when it failed?
Rainer
>
> But this doesn't? (at least for me):
> set $!csv_msg = replace($msg,"|",",");
>
> -----Original Message-----
> From: rsyslog <[email protected]> On Behalf Of John
> Chivian
> Sent: Wednesday, March 13, 2019 11:54 AM
> To: [email protected]
> Subject: Re: [rsyslog] [External] Re: String replacement
>
> $msg is created at the initial parsing of the raw event. Although it can be
> modified (separate subject), it is generally not recommended to do so. The
> same is true for $rawmsg. Best to leave them alone and create what you need
> from them.
>
> Regards,
>
>
> On 3/13/19 12:48 PM, Secrist, Eric via rsyslog wrote:
> > Thank you Flo and John for your help. I could not get the replace function
> > to work with $msg, so I created an intermediary variable called $!emsg in
> > the ruleset. I am not sure why the replace function did not work with $msg.
> >
> > Here is the config that finally worked:
> >
> > template(name="isilon_tmpl" type="string"
> > string="%TIMESTAMP:::date-rfc3339% %HOSTNAME%
> > %syslogtag%%$!csv_msg%\n")
> >
> > ruleset(name="isilon_rset") {
> > if ($msg contains "astring" or $msg contains "another_string" or $msg
> > contains "another_string") then {
> > set $!emsg = $msg;
> > set $!csv_msg = replace($!emsg,"|",",");
> > action(type="omfile" FileCreateMode="0644"
> > File="/var/log/remote/msg/eric-test" template="isilon_tmpl")
> > }
> > }
> > input(type="imudp" port="514" ruleset="isilon_rset")
> >
> > The above results in a message formatted like this:
> >
> > 2019-03-13T10:43:54-07:00 xxx-xxx-xxxx-9 audit_protocol[17951]:
> > S-1-22-1-0,0,System,1,10.200.148.101,NFS,CLOSE,SUCCESS,DIR,0:0,0:0,5
> > 52
> > 7332821,/path/to/file
> >
> > Success! Thank you so much!
> >
> > -Eric
> >
> > From: Flo Rance <[email protected]>
> > Sent: Wednesday, March 13, 2019 10:19 AM
> > To: rsyslog-users <[email protected]>
> > Cc: Secrist, Eric <[email protected]>
> > Subject: Re: [rsyslog] [External] Re: String replacement
> >
> > You should read the following announcement:
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rsyslog.com
> > _r
> > syslog-2Dversion-2Dnumbering-2Dchange_&d=DwIGaQ&c=Sexio4usKrYWFsrnxg
> > jb
> > cQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS
> > 2J
> > -n1OZGNIpVxKwj2om4EDCM9Y&s=LbUv81YhtBPviX5dQmSZWu0oQgRhf3B4QfTbklLmJ
> > VI
> > &e=<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.rsyslog
> > .c
> > om_rsyslog-2Dversion-2Dnumbering-2Dchange_&d=DwMFaQ&c=Sexio4usKrYWFs
> > rn
> > xgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=gLVZMHXBSJ22h
> > B7
> > eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s=_q6hKGwqpPlGjr6D42tWuYpaDt45L1XVUjDtz
> > 2G
> > Fyn8&e=>
> >
> > For your parsing error, you're mixing different syntax.
> >
> > template(name="isilon_tmpl" type="list") {
> > property(name="$!modmsg")
> > constant(value="\n")
> > }
> >
> > Flo
> >
> > On Wed, Mar 13, 2019 at 4:25 PM Secrist, Eric via rsyslog
> > <[email protected]<mailto:[email protected]>> wrote:
> > Thanks for the response John. I upgraded to version 8.1903.0 from version
> > 8.24. I find it strange that 8.1903 is a more recent version than 8.24.
> > I attempted to use your approach but ran into parsing config file errors.
> >
> > Here are the statements that produced the parsing errors:
> >
> > set $!modmsg = replace($msg,"|",","); template(name="isilon_tmpl"
> > type="list") {
> > string="$!msg\n"
> > property(name="$!modmsg")
> > }
> >
> > I also tried using the property statement as you described, outside of the
> > template definition, but that also produced parsing errors.
> >
> > -----Original Message-----
> > From: rsyslog
> > <[email protected]<mailto:[email protected]
> > co
> > n.com>> On Behalf Of John Chivian
> > Sent: Tuesday, March 12, 2019 12:25 PM
> > To: [email protected]<mailto:[email protected]>
> > Subject: Re: [rsyslog] [External] Re: String replacement
> >
> > This would be one of those issues where it's best to be at a recent
> > version. From experience I can say that both JSON property handling and
> > the reliability of the replace function are greatly improved since 8.24
> > which is still the distro default for many. Here's what I do...
> >
> > set $!modmsg = replace($msg,"{","");
> > property(name="$!modmsg")
> >
> > Regards,
> >
> >
> > On 3/12/19 11:09 AM, Secrist, Eric via rsyslog wrote:
> >> Thank you for the response and great information Flo.
> >>
> >> I tried the following and I am seeing blank lines in the output file. It
> >> looks like the $!msg variable is possibly empty?
> >>
> >> set $!msg = replace($msg, "|",","); template(name="isilon_tmpl"
> >> type="string"
> >> string="%!msg%\n"
> >> )
> >>
> >>
> >> From: Flo Rance <[email protected]<mailto:[email protected]>>
> >> Sent: Tuesday, March 12, 2019 2:20 AM
> >> To: rsyslog-users
> >> <[email protected]<mailto:[email protected]>>
> >> Cc: Secrist, Eric <[email protected]<mailto:[email protected]>>
> >> Subject: [External] Re: [rsyslog] String replacement
> >>
> >>
> >>
> >> On Mon, Mar 11, 2019 at 11:01 PM Secrist, Eric via rsyslog
> >> <[email protected]<mailto:[email protected]><mailto:[email protected]<mailto:[email protected]>>>
> >> wrote:
> >> Hello,
> >> For the following example message:
> >>
> >> 2019-03-11T14:13:10-07:00 xxxx-xxxx-xxxx-3 audit_protocol[9605]:
> >> S-1-22-1-11111|11111|System|1|11.111.111.11|NFS|CLOSE|SUCCESS|FILE|0:
> >> S-1-22-1-11111|11111|System|1|0
> >> |0:0|7528411024|/path/to/file
> >>
> >> Are the pipes field delimiters?
> >>
> >> Yes, the pipes are field delimiters.
> >>
> >> How can I replace the pipes (|s) with commas?
> >>
> >> I have tried the following template and many others, but haven't been able
> >> to get the pipe replacement to work yet.
> >>
> >> template(name="isilon_tmpl" type="list") {
> >> replace("$msg", "|", ",")
> >>
> >> Two problems here. You try to replace in "$msg" string and not $msg
> >> property. Anyway, you can't directly modify $msg property, so you may try:
> >>
> >> set $!msg = replace($msg, "|", ",");
> >>
> >> and define your template to use $!msg.
> >>
> >> }
> >>
> >> ruleset(name="isilon_rset") {
> >> if ($msg contains "/ifs/cda/userdata/ctshared") then {
> >> action(type="omfile" FileCreateMode="0644"
> >> File="/var/log/remote/msg/eric-test" template="isilon_tmpl")
> >> }
> >> }
> >>
> >>
> >> Thanks,
> >> Eric Secrist
> >> _______________________________________________
> >> rsyslog mailing list
> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.n
> >> et
> >> _
> >> mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5T
> >> kc
> >> D
> >> oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPD
> >> mJ
> >> B
> >> ZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=<https:/
> >> /urldefense.proofpoint.com/v2/url?u=https-3A__u&d=DwIFaQ&c=Sexio4us
> >> KrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8
> >> u25TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=kjMETT7fM8QOGli8eDXtLnLlF
> >> ZCVLTs5CqSW6pCrmzs&e=
> >> rldefense.proofpoint.com/v2/url?u=https-3A__ur&d=DwIGaQ&c=Sexio4usK
> >> rY
> >> WFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK
> >> _q
> >> N-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=XzUr-LtWdSFxgOJwQzPKkuAnzllgSw
> >> 7d
> >> tsfKyT0P-Mc&e=<https://urldefense.proofpoint.com/v2/url?u=https-3A_
> >> _u
> >> r&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z
> >> 7c
> >> s9GV6oLVBaAA&m=gLVZMHXBSJ22hB7eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s=Ay6D7U
> >> je RZYh5WBTD-2TFFtrRNNb3qk2Y9Mt66G6fqc&e=>
> >> ldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman
> >> _l
> >> i<http://ldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.ne
> >> t_
> >> mailman_li>
> >> stinfo_rsyslog&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMp
> >> ln
> >> P
> >> ebu6G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKinq5Dra9Hb3WyTeig-8bImP74XvX3Sh1
> >> Uz
> >> 8 &s=9yIW5Zv2RpKp0qdNbo8FLDccxkb-mAEKQuz9Vao3mrw&e=>
> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com
> >> _p
> >> r
> >> ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5Tkc
> >> Do
> >> U
> >> XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJ
> >> BZ
> >> l
> >> QpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=<https://u
> >> rldefense.proofpoint.com/v2/url?u=https-3A__url&d=DwIFaQ&c=Sexio4us
> >> KrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8
> >> u25TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=jxE98UZWyq2UbudFNLDrKrrnx
> >> mNmWNmPaa6S6Yh-bEY&e=
> >> defense.proofpoint.com/v2/url?u=https-3A__urld&d=DwIGaQ&c=Sexio4usK
> >> rY
> >> WFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK
> >> _q
> >> N-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=dgzimVyJS2WWCWLdReDhcDZl8Osf7p
> >> Ks
> >> w1VSYlEnSgY&e=<https://urldefense.proofpoint.com/v2/url?u=https-3A_
> >> _u
> >> rld&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_
> >> 9z
> >> 7cs9GV6oLVBaAA&m=gLVZMHXBSJ22hB7eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s=J4g4
> >> LG 0sGj1CsZIKb9z5HEU8B78UhLx-U6JbJ1EP2qs&e=>
> >> efense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professiona
> >> l-
> >> 2<http://efense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_pr
> >> of
> >> essional-2>
> >> Dservices_&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPe
> >> bu
> >> 6
> >> G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKinq5Dra9Hb3WyTeig-8bImP74XvX3Sh1Uz8&
> >> s= i NjUhhXBm4JxgffTRp0GZbx0W-TX3YL46Zgpbm4Xnbo&e=>
> >> What's up with rsyslog? Follow
> >> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rg
> >> er
> >> h
> >> ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M
> >> _9
> >> z
> >> 7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYF
> >> a4
> >> Y
> >> PhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=<https://urldefense.proofpoint.com/v2/url?u=https-3A__urldefense.proofpoint&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=wZirbn-weXmeupgNf0mAu0F3f4qu02Fbr7AfUCJ3K_c&e=<https://urldefense.proofpoint.com/v2/url?u=https-3A__urldefense.proofpoint&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=gLVZMHXBSJ22hB7eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s=2YgcXP_EQtvP8HQzQNzFcWsv4lZOoh2Y9x7F1KyU484&e=>.
> >> com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=Sexio4usKrY
> >> WF
> >> s
> >> rnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=8XhT8ajKin
> >> q5
> >> D
> >> ra9Hb3WyTeig-8bImP74XvX3Sh1Uz8&s=syIr7Hk0NNCKG1X2NPXWvdxxOTa1Vv1cYb
> >> 7A F JDhowY&e=> NOTE WELL: This is a PUBLIC mailing list, posts are
> >> ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and
> >> DO NOT POST if you DON'T LIKE THAT.
> >> _______________________________________________
> >> rsyslog mailing list
> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.n
> >> et
> >> _
> >> mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5T
> >> kc
> >> D
> >> oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPD
> >> mJ B ZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=
> >> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com
> >> _p
> >> r
> >> ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5Tkc
> >> Do
> >> U
> >> XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJ
> >> BZ l QpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=
> >> What's up with rsyslog? Follow
> >> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rg
> >> er
> >> h
> >> ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M
> >> _9
> >> z
> >> 7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYF
> >> a4 Y PhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=
> >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
> >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you
> >> DON'T LIKE THAT.
> >
> > _______________________________________________
> > rsyslog mailing list
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.ne
> > t_
> > mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5Tk
> > cD
> > oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDm
> > JB ZlQpU9IHwc&s=BQVy0qzeHSmZI9Qi83MMJLwdqKJnw2thoHpFd4-1dak&e=
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_
> > pr
> > ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> > oU
> > XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJB
> > Zl QpU9IHwc&s=TWxPkaMA6uW2o3aKK5CuPyOvaTXHC-AW0AadBmEuT0c&e=
> > What's up with rsyslog? Follow
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rge
> > rh
> > ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_
> > 9z
> > 7cs9GV6oLVBaAA&m=h8SoL-AhMrYoNoDIsBXbdL5wPpDcPDmJBZlQpU9IHwc&s=-jYFa
> > 4Y PhJAkVumTBDXMArLcuFpPtHfDnfqBVQEjts8&e=
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.ne
> > t_
> > mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5Tk
> > cD
> > oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxK
> > wj
> > 2om4EDCM9Y&s=IIXuhiERk7kr4anL3XZlSyy78aYMdecNfkSa6lClBeo&e=<https://
> > urldefense.proofpoint.com/v2/url?u=https-3A__ur&d=DwIFaQ&c=Sexio4usK
> > rYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8u2
> > 5TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=35bw5mE0MUU39PgUG8ozM4ubwwSt
> > 0pYjthEK0Izg53o&e=
> > ldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_mailman_
> > li
> > stinfo_rsyslog&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMpl
> > nP
> > ebu6G3M_9z7cs9GV6oLVBaAA&m=gLVZMHXBSJ22hB7eB1EKjkG7-SXv77IAPJ2r5M0QU
> > 1Q &s=A2jFw_bHWaQ8dNFkp64Wy6qct9H91MhbWmY7l9AN9-w&e=>
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_
> > pr
> > ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> > oU
> > XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj
> > 2o
> > m4EDCM9Y&s=ZlB2GMDcE-u3XDYRi5QfqTK_CeoeZNspPyDPU6rkJFM&e=<https://ur
> > ldefense.proofpoint.com/v2/url?u=https-3A__urld&d=DwIFaQ&c=Sexio4usK
> > rYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8u2
> > 5TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=bRvuleOjOaDg_Qi3Qk4_xYEWs4Ge
> > cGlzNAGBH-ERybU&e=
> > efense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_professional
> > -2
> > Dservices_&d=DwMFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPeb
> > u6
> > G3M_9z7cs9GV6oLVBaAA&m=gLVZMHXBSJ22hB7eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s
> > =P Q7WfDAc21hEdVFJYY4W7llomWDlmT8si7DJgB3qego&e=>
> > What's up with rsyslog? Follow
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rge
> > rh
> > ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_
> > 9z
> > 7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=hU2xs
> > Nj
> > 20Mb5AH7ka-3lu6KSrPP2trr8iR9l1fTmJWk&e=<https://urldefense.proofpoint.com/v2/url?u=https-3A__urldefense.proofpoint&d=DwIFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8u25TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=lE4zZ8H_p9hNCX6Lm9J39JA5Qaira0My0YlKu72rpb4&e=.
> > com/v2/url?u=https-3A__twitter.com_rgerhards&d=DwMFaQ&c=Sexio4usKrYW
> > Fs
> > rnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=gLVZMHXBSJ2
> > 2h
> > B7eB1EKjkG7-SXv77IAPJ2r5M0QU1Q&s=GCfM-ABs4CH2EtOGRleSsCgksTywyQTyAqH
> > WR SwglGc&e=> NOTE WELL: This is a PUBLIC mailing list, posts are
> > ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO
> > NOT POST if you DON'T LIKE THAT.
> > _______________________________________________
> > rsyslog mailing list
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.ne
> > t_
> > mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5Tk
> > cD
> > oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxK
> > wj 2om4EDCM9Y&s=IIXuhiERk7kr4anL3XZlSyy78aYMdecNfkSa6lClBeo&e=
> > https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_
> > pr
> > ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> > oU
> > XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj
> > 2o m4EDCM9Y&s=ZlB2GMDcE-u3XDYRi5QfqTK_CeoeZNspPyDPU6rkJFM&e=
> > What's up with rsyslog? Follow
> > https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rge
> > rh
> > ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_
> > 9z
> > 7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=hU2xs
> > Nj 20Mb5AH7ka-3lu6KSrPP2trr8iR9l1fTmJWk&e=
> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> > LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_
> mailman_listinfo_rsyslog&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj
> 2om4EDCM9Y&s=IIXuhiERk7kr4anL3XZlSyy78aYMdecNfkSa6lClBeo&e=
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_pr
> ofessional-2Dservices_&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoU
> XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj2o
> m4EDCM9Y&s=ZlB2GMDcE-u3XDYRi5QfqTK_CeoeZNspPyDPU6rkJFM&e=
> What's up with rsyslog? Follow
> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerh
> ards&d=DwIGaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z
> 7cs9GV6oLVBaAA&m=4vNdVVK_qN-SoaBiS2J-n1OZGNIpVxKwj2om4EDCM9Y&s=hU2xsNj
> 20Mb5AH7ka-3lu6KSrPP2trr8iR9l1fTmJWk&e=
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.adiscon.net_
> mailman_listinfo_rsyslog&d=DwIFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcD
> oUXyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8u25TAfCt2tta8Fnhmc6iu5JVzqa5M
> Hv9jgqBTBc&s=rvKiSDIA7BnrggXHdoVcIdxB8diJUEB49GdAH7210H8&e=
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rsyslog.com_pr
> ofessional-2Dservices_&d=DwIFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoU
> XyfMplnPebu6G3M_9z7cs9GV6oLVBaAA&m=uIi8u25TAfCt2tta8Fnhmc6iu5JVzqa5MHv
> 9jgqBTBc&s=QRCYMh8GiGVctkbINW6jqGB8Dg2OmXjTWXYYcthauEA&e=
> What's up with rsyslog? Follow
> https://urldefense.proofpoint.com/v2/url?u=https-3A__twitter.com_rgerh
> ards&d=DwIFaQ&c=Sexio4usKrYWFsrnxgjbcQ&r=pqAh5TkcDoUXyfMplnPebu6G3M_9z
> 7cs9GV6oLVBaAA&m=uIi8u25TAfCt2tta8Fnhmc6iu5JVzqa5MHv9jgqBTBc&s=XZOV1Wp
> 9d31TYBI9hHENOB8v8hZBoNb5jmgbs4_yhJk&e=
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
