Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Radu Gheorghe
Hi Luke, Not sure if it helps, but I'm trying to explain why the first one didn't work and now it works: In the first config you had a condition, but no action next to it. So it did nothing. Now you have an action (@10.5.69.56). And in the first config, you were sending all logs (*.*) to the

Re: [rsyslog] Ubuntu 12 (Precise) v7-devel packages

2012-12-13 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Michael Biebl Sent: Monday, December 10, 2012 3:48 PM To: rsyslog-users Subject: Re: [rsyslog] Ubuntu 12 (Precise) v7-devel packages 2012/12/10 Michael Biebl

Re: [rsyslog] imfile and omudpspoof

2012-12-13 Thread Rainer Gerhards
Can you post a (sufficiently large or complete) debug log that exposes the problem? The list will probably reject it, so it is best to put it on something like pastbin. Rainer -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Luke Marrott
I'm currently running rsyslog version 5.8.10. :Luke Marrott On Thu, Dec 13, 2012 at 9:31 AM, Rainer Gerhards rgerha...@hq.adiscon.comwrote: Which version do you use? The answer depends on that. -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog-

Re: [rsyslog] Selective Forwarding

2012-12-13 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Luke Marrott Sent: Thursday, December 13, 2012 5:35 PM To: rsyslog-users Subject: Re: [rsyslog] Selective Forwarding I'm currently running rsyslog version 5.8.10.

Re: [rsyslog] Solaris DST bug, patch

2012-12-13 Thread Rainer Gerhards
I have finally merged this patch, sorry for the delay. As it seems to be rather important, I have merged back to v5-stable. New versions currently available via git, will be included in next releases. Thanks again! Rainer -Original Message- From: rsyslog-boun...@lists.adiscon.com

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Scott Severtson Sent: Monday, December 10, 2012 5:28 PM To: rsyslog-users Subject: [rsyslog] Patch: RFC-3339 timezone parsing fixes Per RFC-3339, these timezones are

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread Rainer Gerhards
-Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Rainer Gerhards Sent: Thursday, December 13, 2012 7:06 PM To: rsyslog-users Subject: Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes -Original

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread Rainer Gerhards
Per RFC-3339, these timezones are legal: Z +06:00 +0600 +06 Mhhh... This is a bit complicated. As far as I read 3339, the last two formats are incorrect. In section 5.6 (inside the normative part of the RFC) it says: time-numoffset = (+ / -) time-hour : time-minute

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread David Lang
On Thu, 13 Dec 2012, Rainer Gerhards wrote: -Original Message- From: rsyslog-boun...@lists.adiscon.com [mailto:rsyslog- boun...@lists.adiscon.com] On Behalf Of Scott Severtson Sent: Monday, December 10, 2012 5:28 PM To: rsyslog-users Subject: [rsyslog] Patch: RFC-3339 timezone parsing

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread Scott Severtson
On 12/13/2012 01:23 PM, Rainer Gerhards wrote: Per RFC-3339, these timezones are legal: Z +06:00 +0600 +06 Mhhh... This is a bit complicated. As far as I read 3339, the last two formats are incorrect. In section 5.6 (inside the normative part of the RFC) it says: time-numoffset = (+ / -)

Re: [rsyslog] Patch: RFC-3339 timezone parsing fixes

2012-12-13 Thread Scott Severtson
We have several log sources which omit the optional : separator in the timezone. We've developed the attached patch to improve Rsyslog's support for valid RFC-3339 timezones. --Scott What are the sources of the problem logs? if they are a common enough vendor, it may be worth the risk of