slog.d
> Operating system is raspbian on raspberry 2b.
> Gatekeeper is a fanvill door phone.
>
>
>
> Mårten Persson
> Räften 272
> 24791 södra sandby
>
>
>
> ---- Originalmeddelande
> Från: Rainer Gerhards
> Datum: 2024-05-25 20:41 (GMT+01:00)
> T
Is this a Container?
Sent from phone, thus brief.
Mårten Persson via rsyslog schrieb am Sa., 25.
Mai 2024, 07:35:
> No errors in any log file when I restart rsyslog with the following:
>
> $template gateopener, "/var/log/fanvil.log"
> if $fromhost-ip startswith "192.168.1.10" then -?gateopener
gid=2011 rdev=00:00
> nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
> OUID=\"[redacted\" OGID=\"redacted\"
>
> Thomas J. Raef
> Founder, WeWatchYourWebsite.com
> http://wewatchyourwebsite.com
> tr...@wewatchyourwebsite.com
> Li
I guess the message is malformed and the string you look for is inside
another field.
I would suggest that you use "$rawmsg" instead of "$msg". If that
works, a) we are on the right track and b) you actually solved the
issue, albeit probably not in the best possible way.
HTH
Rainer
El vie, 24
Which error messages do you see?
Rainer
Sent from phone, thus brief.
warron.french via rsyslog schrieb am Mo., 15.
Apr. 2024, 15:52:
> At Mariusz, my apologies for not replying earlier, somehow Google Mail
> crunched your reply in the thread so that I did not see it (*laziness on my
> part I
Sound good to me, as long as everything is backwards-compatible ;-)
Else we need to discuss pro and con (I guess there a lot of pro!)
Rainer
El lun, 15 abr 2024 a las 11:55, Attila Lakatos via rsyslog
() escribió:
>
> Hello,
>
> Currently, log messages written to files can undergo encryption
-based mechanism, it's... random.
> >
> > Additionally, I had a similar thing implemented for load-balancing to
> > different "backends" and for some reason it didn't work uniformly (I
> > think I already wrote about this) - one of four backends was never
> >
Hi Michael,
thanks for the info, but I am unfortunately unable to reproduce this.
As the tests have complex timing interdependencies, may it be the case
that we had just a very busy flaky day? Would it be possible to re-run
them?
Side-note: I also looked at the changes and I cannot see anything
This sounds a bit like you are looking for this:
https://www.rsyslog.com/doc/tutorials/log_sampling.html
HTH
Rainer
El mié, 3 abr 2024 a las 3:25, Prasad Koya via rsyslog
() escribió:
>
> Hi
>
>
> module( load="imuxsock" )
> module( load="imklog" )
>
> if ($syslogfacility-text == 'kern' and
you need to craft a template with a fixed facility you want. That's
the part inside the template. See RFC5424 for how to calculate it
(yes, it should be easier, but it's a pretty uncommon request and this
is right now the only way to do it.).
HTH
Rainer
El dom, 24 mar 2024 a las 13:21, Steven
g server are showing up as binary files.
> >
> > Brian
> >
> > On 3/19/2024 7:24 AM, Rainer Gerhards wrote:
> >> Please contain a plain text part in your mail. The mailing list
> >> processor removes HTML for security reasons.
> >>
> >> Judging from
Please contain a plain text part in your mail. The mailing list
processor removes HTML for security reasons.
Judging from the subject, I guess either the receiver OR the sender
has not successfully enabled TLS. Check for error messages from
rsyslog.
HTH
Rainer
El mar, 19 mar 2024 a las 15:06,
In theory, you can build rsyslog from the sources yourself - except
when something was broken in the meantime.
Side-note: we offered IBM to keep rsyslog AIX compatible if they
provide a buildbot worker for CI checking and some advise on problems.
but they seemed not very interested in that
rt at
supp...@adiscon.com when you intend to configure TLS 1.3.
Unfortunately, openssl 3.0 is not yet integrated, this is planned for
the upcoming major release somewhat later this year.
HTH,
Rainer
El mié, 21 feb 2024 a las 16:15, Rainer Gerhards
() escribió:
>
> I need to ask
I need to ask the folks closer to the agent, but to the best of my
knowledge TLS 1.3 is supported (very sure), and I guess openssl 3.x is
used (not so sure on that).
HTH
Rainer
El mié, 21 feb 2024 a las 13:34, Ivanov Timea via rsyslog
() escribió:
>
> Hello!I need to send specific Windows event
> You could try pushing all events to a single ruleset with a queue with
> just one worker thread. I suppose then the events dequeued from the main
> queue and enqueued into the ruleset queue would be in order. I'm not
> fully sure about the order of events enqueued into action queues though.
>
I checked, but SuSe unfortunately does not provide the ability to
build for Rocky Linux.
Maybe you can give these ones a try:
https://www.rsyslog.com/rhelcentos-rpms/
I would appreciate it if you could report back your findings, whatever
they may be.
Rainer
El lun, 22 ene 2024 a las 22:04,
Hi all,
I just wrote a bit about how I integrate AI in the doc improvement
process. I thought that might be interesting for some of you:
https://www.rsyslog.com/documentation-improvement-and-ai/
And, as it exits anyhow, a version translated into German is also
available as part of this article:
Hi all,
more news, please have a look here:
https://www.rsyslog.com/additional-improvements-to-rsyslog-doc-and-site/
Rainer
___
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
ll benefit from this in the end
>
> Best regards Johan Ryberg
>
> Den tors 4 jan. 2024 18:01Peter Portante via rsyslog
> skrev:
>>
>> On Thu, Jan 4, 2024 at 11:31 AM Rainer Gerhards via rsyslog
>> wrote:
>> >
>> > Hi all,
>> >
>&
Hi all,
happy new year to everyone!
I think I have some good news. I have initiated a new project to
enhance doc and rsyslog website. Initial announcement is here:
https://www.rsyslog.com/improving-the-rsyslog-documentation/
More details follow in further postings. As you may guess, some
It will not.
Rainer
El dom, 31 dic 2023 a las 1:03, David Lang via rsyslog
() escribió:
>
> a HUP will reconnect, but I don't think that a HUP will reload the
> certificates
> from disk.
>
> David Lang
>
> On Sat, 30 Dec 2023, John Chivian via rsyslog wrote:
>
> > I believe restarting is the
32== To see them, rerun with: --leak-check=full --show-leak-kinds=all
> ==31532==
> ==31532== For lists of detected and suppressed errors, rerun with: -s
> ==31532== ERROR SUMMARY: 15 errors from 15 contexts (suppressed: 0 from 0)
>
> If you need me to run this for longer I can d
0). Also
> note I completely disabled the omkafka action's queue previously as a test,
> but that didn't make a difference. There are no other queues.
>
> Kind Regards
> ---
>
> ------
> *From:* Rainer Gerhards
> *Sent:* 06 December 2023 17:05
&
Look at the queue sizes in impstats. Are they ever-increasing?
Rainer
El mié, 6 dic 2023 a las 14:30, Adriaan de Waal via rsyslog
() escribió:
>
> Good day
>
> I am trying to diagnose and resolve an issue whereby the memory consumed by
> the rsyslog daemon increases linearly over time. This
This smells like a bug. It looks like the discarded messages will
never be deleted.
In this case, I would suggest to open a github issue tracker if that
is possible for you.
Rainer
El jue, 16 nov 2023 a las 16:21, Jeremiah Garmatter via rsyslog
() escribió:
>
> Hello,
>
> I have rsyslog
Well, you say that the equipment does not necessarily follow the RFC.
In that case, rsyslog might not be able to read the hostname from the
message. We try hard to handle "well known malformed formats", but we
cannot let everything slip through. Especially if it really is unclear
where the
I do not personally see a need for that file to reside in
> > the rsyslog repo.
> >
> > Regards,
> >
> >
> >> On Oct 20, 2023, at 10:24, Rainer Gerhards via rsyslog
> >> wrote:
> >>
> >> Hi all,
> >>
> >> the git reposito
Hi all,
the git repository contains rsyslog.service sample files. Actually,
these have not been updated for years and do no longer match distro
policies.
Thankfully, Michael Biebl sent a PR to update the Debian parts. We had
a small discussion about the usefulness of these files at all. Michael
it does, I didn't write it
> >>> though it can handle manual fast F5 triggers in the browser without
> >>> issue and then it 111s when there are 2 requests incoming...
> >>> I thought rsyslog might handle that just well via the queue...
> >>> but then this might eventu
I reviewed the code - it's puzzling. It looks like the config system
for that param got implemented, but that part of the config is never
used. Looks a bit like PR is missing. I need to investigate closer.
I'd appreciate the creation of a github issue.
Rainer
El lun, 18 sept 2023 a las 21:15,
\“msg\” :
> {\“messageGroup\”:[{\“field1\”:1,\”field2\”:2},{\“field1\”:3,\”field2\”:4}]}}”
>
>
>
>
>
> From: Rainer Gerhards
> Sent: 18 September 2023 15:47
> To: Lennon, Sean (UK)
> Cc: rsyslog-users
> Subject: Re: [rsyslog] rsyslog mmextenal logstash js
sonf="on") {
> property(outname="@timestamp" name="timereported"
> dataformat="rfc3339" format="jsonf")
> property(outname="message" name="msg" format="jsonf")
> }
>
> -Original Mes
Does this example from the rsyslog testbench help?
https://github.com/rsyslog/rsyslog/blob/761cb2bc51e3046b242b45994cff11ff8be3990e/tests/json-nonstring.sh#L4
Rainer
El lun, 18 sept 2023 a las 15:10, Lennon, Sean (UK) via rsyslog
() escribió:
>
>
>
>
>
> This email may contain proprietary
> so far not a single 111 today, I let this run the until late evening,
> and if there is stil no 111 I will put back the python script in order
> because right now there are 2 possibilities, I moved the socket as said,
> and I skipped the script and just appended the message to a file
> if either
nalytics log
> I cannot see any pattern...
>
>
> On 18/09/2023 08:53, Rainer Gerhards wrote:
>
> Is this from a nginx text log? Any errors infos from rsyslog itself?
>
> Rainer
> PS: I do not see how this can be related to rsyslog, but you never
> know. I do not yet und
Is this from a nginx text log? Any errors infos from rsyslog itself?
Rainer
PS: I do not see how this can be related to rsyslog, but you never
know. I do not yet understand the fault scenario TBH.
El dom, 17 sept 2023 a las 18:39, TG Servers via rsyslog
() escribió:
>
> Hi,
>
> ever since I
you can load modules only once. If you need a new input, just use the
"input" object.
I cannot read your config snippet correctly (it's garbled by your mail
client, maybe due to html mail). But it looks like it is invalid.
Rainer
El jue, 7 sept 2023 a las 17:44, Pedro Caetano via rsyslog
()
Ole,
it probably is a good idea to file this as a github issue and tag
@cropi while doing so.
The last fix to that patch was this here:
https://github.com/rsyslog/rsyslog/pull/5166
Rainer
El mié, 30 ago 2023 a las 14:30, Rainer Gerhards
() escribió:
>
> There is a patch by Red Hat that
There is a patch by Red Hat that limits rsyslog capabilities. One
capability is CAP_DAC_OVERRIDE, which permits to bypass permission
checks. IMHO it should not be dropped even with the patch present, but
it sounds like it is. Please also note that there are different
versions of that patch
It might be worth contacting Red Hat if there is a patch inside their
version that causes the issue.
Alternatively, you can try rsyslog from the project itself.
And maybe there are some other OS settings that cause this issue.
My 2cts,
Rainer
El mié, 30 ago 2023 a las 10:07, Ole Froslie via
r/log/syslog.
>
> On Fri, Aug 18, 2023 at 3:18 AM Rainer Gerhards
> wrote:
>
>> Move the forwarding rule to the top, that should solve your issue.
>>
>> Rainer
>>
>> Sent from phone, thus brief.
>>
>> David Lang via rsyslog schrieb am Do., 17.
&
Move the forwarding rule to the top, that should solve your issue.
Rainer
Sent from phone, thus brief.
David Lang via rsyslog schrieb am Do., 17. Aug.
2023, 19:16:
> all of those lines are telling rsyslog that if it matches the filter
> and
> writes it to the file that it should stop
re only updated after release:
> # for CentOS 7,8,9
> http://rpms.adiscon.com/v8-stable/rsyslog.repo
> # for RHEL 7,8,9
> http://rpms.adiscon.com/v8-stable/rsyslog-rhel.repo
>
> Best regards,
> Andre Lorbach
> --
> Adiscon GmbH
> Mozartstr. 21
> 97950 Großrinde
actually, there is DTLS, which is "datagram tls" and there also is a RFC.
So far, we had no real demand to implement it. My impression is that
DTLS syslog is largely unused.
Rainer
El jue, 3 ago 2023 a las 12:07, Redbourne,Michael via rsyslog
() escribió:
>
> Yeah, unfortunately that's what I
yish and ran away screaming ;-)
>
> But, to make things more interesting as far as I remember loading
> certificate chains (for RELP) worked relatively well with gnutls way
> before it did with openssl.
>
> MK
>
> On 2.08.2023 10:21, Rainer Gerhards wrote:
> > d
address
> > issues like this. However, you will require at least rsyslog v8.2210.0.
> >
> > Best regards,
> > Andre Lorbach
> > --
> > Adiscon GmbH
> > Mozartstr. 21
> > 97950 Großrinderfeld, Germany
> > Ph. +49-9349-9298530
> > Geschäftsfüh
>
>
>
>
>
>
> -Ursprüngliche Nachricht-
> Von: rsyslog Im Auftrag von Rainer
> Gerhards via rsyslog
> Gesendet: Montag, 31. Juli 2023 18:21
> An: rsyslog-users
> Cc: Rainer Gerhards
> Betreff: Re: [rsyslog] Support for multiple certificate chains (
I think this version is too old.thre was related work not long ago.
Rainer
Sent from phone, thus brief.
Roman Möller via rsyslog schrieb am Mo., 31.
Juli 2023, 18:18:
> Hello subscribers,
> we are using rsyslog with TLS to collect logs transport encrypted from
> different logsources.
> The
Well, it depends.
For a busy system, the default timeout in the main queue is way to
long (I think I have shortened it recently, but still). This means
while the message ultimately gets deleted, the system can become
sluggish to a point where it looks totally unresponsive.
HOWEVER, you can
I suggest to use the openssl driver (ossl, separate package). A prime
reason for implementing openssl was that the gnutls error messages are
usually very unhelpful. this is much better with openssl.
Rainer
El lun, 17 jul 2023 a las 8:54, Mariusz Kruk via rsyslog
() escribió:
>
> Yes. People came
Original Message-
> From: Rainer Gerhards
> Sent: Wednesday, June 21, 2023 5:17 AM
> To: rsyslog-users
> Cc: Tobias Heaton
> Subject: Re: [rsyslog] rsyslog 8.2306.0 released
>
> CAUTION: This email originated from outside of the University System. Do not
> click links
Where do you install from?
Rainer
El mié, 21 jun 2023 a las 11:14, Tobias Heaton via rsyslog
() escribió:
>
> Good Morning,
>
> The libfastjson package conflict for OEL8 yum update is cropping up again,
> much like it did for the 8.2304.0 release (see errors below).
>
> -Tobias
>
> Error:
>
Derek, Andre,
> > There has been no change on nsd_ossl.c driver since January 2023, so I
> > believe this is not related to the different rsyslog versions you are
> > running.
> > The warnings tell you, that there is no client certificate configured
> > which
> > can be ok but unusual in this
> It might be common, but it's wrong. If you're using cert-based
> authentication, reusing the same certificate is effectively defeating
> the purpose. True, in some specific use cases it might be OK but a
> decision to do so should be preceeded by risk analysis. In general -
> using the same
eFileName fwdSyslog
>> $ActionQueueMaxDiskSpace 500m
>> $ActionQueueSaveOnShutdown on
>> $ActionQueueType LinkedList
>> $ActionQueueResumeRetryCount -1
>> *.debug @1.2.3.4:10975
>>
>> We are running RHEL 8.7.
>>
>> On Thu, M
This is strange. No,everything is supported, we never remove any
config capability without very, very strong reason. Plus, the "if" is
not BSD-Style but script, the most modern filter.
Which version is running on RHEL 8?
How does the full config look like?
What does rsyslogd -N1 split out?
imuxsock? Is really something spamming the unix socket with multiline messages?
nevertheless, imptcp has similar functionality.
Rainer
El vie, 24 mar 2023 a las 14:23, Tan Mientras via rsyslog
() escribió:
>
> Hi
>
> Is imfile the unique module that can handlee multilines with startmsg.regex?
>
pect just a bit different `packer` config
> to create the image)..
>
> Thank you!
>
> On Wed, 22 Mar 2023 at 15:30, Rainer Gerhards via rsyslog
> wrote:
>>
>> Hi all,
>>
>> just some info you might find interesting. We have been working the
>> past
Hi all,
just some info you might find interesting. We have been working the
past couple of weeks on an AWS rsyslog offering. Quick Intro is here:
https://www.rsyslog.com/aws-rsyslog-an-overview/
Why are we doing this?
We were approached by some folks that currently AWS host a rsyslog
What do you expect?
Sent from phone, thus brief.
Tan Mientras via rsyslog schrieb am Mo., 6.
März 2023, 13:27:
> Found
>
> https://github.com/rsyslog/rsyslog-doc/commit/912bc5dcc54966be2cea9890c81414a1e96a94ce
> however it isn't working as expected (or at least how I expect)
>
> On Mon, Mar 6,
IMHO this is a JSON question, not rsyslog. But iirc it is \"
Rainer
Sent from phone, thus brief.
Tan Mientras via rsyslog schrieb am Mo., 6.
März 2023, 12:36:
> Hi
>
> Receiving the following log:
>
> 2023-03-06T12:30:19+00:00 mycomputer windows/windows: {
>
> > Code w/ comments:
> >
> > https://github.com/rsyslog/liblognorm/blob/master/src/parser.c#L2578
>
> That's what I remember seeing, but I don't see it in the documentation page
Yeah, but it's a full feature for quite a while. As I said, there is a
doc build problem or a doc issue in general.
I checked a bit ;-)
> > is it as simple as taking the PR and changing the type name?
>
> I need to look, but probably not - else I would have done it.
That would cause a lot of code duplication - bad. The proper solution
is to control this via options.
>
> >
> > given that we don't have an
> is it as simple as taking the PR and changing the type name?
I need to look, but probably not - else I would have done it.
>
> given that we don't have an existing name-value type, what backwards
> compatibility broke?
We already have one, the iptables type.
Rainer
> note that I know I've seen patches go by for the name-value type, but I'm not
> seeing it in the documentation at
> https://www.liblognorm.com/files/manual/configuration.html#field-types
>
> @rainer, have those patches not made it to a release?
IIRC no, because they broke backwards
Post the output of the debug file template.
Rainer
Sent from phone, thus brief.
John Chivian via rsyslog schrieb am Mi., 1.
März 2023, 14:33:
> The needParse option for imfile is how you tell rsyslog to attempt to read
> syslog header elements out of the imfile content. If it is not used,
also: do you send a proper RELP greeting via telnet? If not, this is
the reason the connection is closed.
Rainer
El vie, 24 feb 2023 a las 18:23, David Lang via rsyslog
() escribió:
>
> what is the rest of your config? what you have shown is the config to receive
> logs, but not any instructions
yes and yes - I suggest a simple script to run during the deployment process.
Rainer
El vie, 17 feb 2023 a las 16:13, Mariusz Kruk via rsyslog
() escribió:
>
> Just double-checking.
>
> Please confirm that I see it right and there is no way of "looping"
> outside of the message processing
System test after some maintenance work. Please disregard.
Rainer
___
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE
The problem is that these are multi-line messages (#012 is LF). This
will most probably hurt you in later log processing and may give
problem in log forwarding. Thus they are escaped. Validly formed logs
usually have no LF. If and only if the other log sources behave well,
there would be no
I checked, it's contributed code that I just merged (via commit and
some fixes). It depends on libuuid. Patch is here:
https://github.com/rsyslog/rsyslog/commit/744d7c426da4aa3229771358a5da27b79e2edf52
If you have text for the doc, feel free to create a doc PR or at least
le me know some
I ignore the database logging issue. When you have rate-limiting
issues again, please report, together with the description of what
happens.
If you think this is related to mysql, please address that issue first.
Rainer
El mié, 14 dic 2022 a las 17:48, helices
() escribió:
>
> REF:
ur
> attempt to understand what is happening, after which we can act to correct
> these problems.
>
> Interestingly, we are not aware of any missing files from this or any other
> file transfer clients.
>
> On Wed, Dec 14, 2022 at 2:54 AM Rainer Gerhards
> wrote:
>
2 at 9:02 AM Rainer Gerhards
> wrote:
>>
>> well, for the debug log to make sense to me, I need the whole thing at
>> least for the startup sequence. You can post it in a gist or something
>> like pastebin. I guess David would also be interested in it.
>>
>> Ra
> 0953.050339793:main thread: rainerscript.c: consoleloglevel: (unset)
> 0953.050348442:main thread: rainerscript.c: parsekerneltimestamp: (unset)
> 0953.050357122:main thread: rainerscript.c: keepkerneltimestamp: (unset)
> 0953.050365783:main thread: rainerscript.c: inte
main unclear on how to get more details regarding this to a log file.
>
> Thank you for your assistance.
>
> ~ Mike
>
>
>
> On Tue, Dec 13, 2022 at 8:01 AM Rainer Gerhards
> wrote:
>>
>> I would probably make sense to create a debug log, at least for
>
disk on shutdown
>> $ActionQueueType LinkedList # Use asynchronous processing
>> $ActionResumeRetryCount -1# Infinite retries on insert failure
>> *.* @@10.199.1.160
>> Mon Dec 12 13:56:12 CST 2022
>>
>> On Mon, Dec
you set the interval, but not ratelimit.burst
doc: https://www.rsyslog.com/doc/v8-stable/configuration/modules/imjournal.html
Rainer
El mar, 6 dic 2022 a las 15:16, helices via rsyslog
() escribió:
>
> David,
>
> What am I doing wrong?
>
> module(load="imjournal" Ratelimit.Interval="1"
>
You do this at the input() level.
Rainer
Sent from phone, thus brief.
Robert Gabriel via rsyslog schrieb am Mi., 23.
Nov. 2022, 18:55:
> Hi,
>
> Am I right in saying that multiple different TLS certs across multiple
> ports is unsupported?
>
> So, I cannot declare various configs with
ing selector effect in RainerScript
>
> +1 on the doc fix. It's not that it's a bug per se. And I suppose there
> might be installations "in the wild" relying on the filter specification
> mechanics so I don't think changing it is called for. It's just that the
> docs should
1.7 0.1 0:01.66 in:imtcp
> >>>
> >>> /etc/sysctl.conf
> >>> net.core.rmem_default = 33554432
> >>> net.core.rmem_max = 268435456
> >>> net.core.wmem_default = 33554432
> >>> net.core.wmem_max = 268435456
> >>> net.ipv4.t
essages long before I have problems
> accepting them)
>
> David Lang
>
> On Tue, 15 Nov 2022, Rainer Gerhards wrote:
>
> > let me add: look into setting imudp to realtime priority. Doc:
> >
> > https://www.rsyslog.com/doc/master/configuration/modules/imudp.html
>
let me add: look into setting imudp to realtime priority. Doc:
https://www.rsyslog.com/doc/master/configuration/modules/imudp.html
Rainer
El mar, 15 nov 2022 a las 5:04, David Lang via rsyslog
() escribió:
>
> Some additional comments on the config
>
>
>
> These action queue configs probably
can fix this "bug", but that would
probably cause a lt of grief with long-existing configs. So I
would tend to say it is a doc bug so let's fix the doc and be done.
Any comments? David Lang maybe?
Rainer
El jue, 3 nov 2022 a las 10:26, Rainer Gerhards
() escribió:
>
n my
> case, what numbers should I write in FileCreatorMode so all users get full
> access?
>
> action(type="omfile" dirCreateMode="0700" FileCreateMode=""
>File="/home/pi/logs/hive_manager.log")
>
>
> Have a good day!
&g
In any case, if it is a bug, fixing it is hard for compatibility
reasons. The code has not been touched for a very long time.
https://github.com/rsyslog/rsyslog/blame/master/runtime/conf.c#L356
Rainer
El jue, 3 nov 2022 a las 10:08, Rainer Gerhards
() escribió:
>
> maybe I have not
Gordon did. It might
> need rewording if it works differently.
>
> MK
>
> On 2.11.2022 20:18, Rainer Gerhards via rsyslog wrote:
> > Info is higher severity than debug, so it validly matches.
> >
> > Sent from phone, thus brief.
> >
> > David Lang via rs
specify the settings in the action() object. Doc:
https://www.rsyslog.com/doc/v8-stable/configuration/modules/omfile.html
side-note: I am not sure, but I think the legacy construct you quoted
just changes the setting for the next output action. But I am too lazy
to look this up, as it is not
If you want to match only debug in old Style, it is
*.=debug
See man page. It's odd, but it is this way since 40+ years...
Rainer
Sent from phone, thus brief.
John Chivian via rsyslog schrieb am Mi., 2.
Nov. 2022, 20:46:
> I think what Rainer is saying is that *.debug matches all events of
Info is higher severity than debug, so it validly matches.
Sent from phone, thus brief.
David Lang via rsyslog schrieb am Mi., 2. Nov.
2022, 20:10:
> not that I expect this to fix it (this isn't something I've seen as a
> known
> bug), but could you please confirm that this still happens on
>> specified to be used. This template is:
> >>>>>>>>
> >>>>>>>> template(name="BSON" type="string" string="\\"sys\\" :
> >>>>>>>> \\"%hostname%\\&quo
El jue, 6 oct 2022 a las 14:54, Felipe Gasper via rsyslog
() escribió:
>
>
> > On Oct 6, 2022, at 03:41, Rainer Gerhards via rsyslog
> > wrote:
> >
> > El jue, 6 oct 2022 a las 8:20, Mariusz Kruk via rsyslog
> > () escribió:
> >>
> >> Escap
El jue, 6 oct 2022 a las 8:20, Mariusz Kruk via rsyslog
() escribió:
>
> Escaping is done on input so you can't disable it on output. You could
> try to "unescape" it but there's no way of knowing if - for example -
> #11 is a literal string or escaped tab character.
> I don't remember if you can
Hi David,
I was out of office last week. I'll check and update. Legacy should be
mentioned, albeit IMHO only brief info is needed, a al
Legacy is
$template ,
as should be defined. This, together with 1 or 2 samples.
What do you think?
Rainer
El mié, 28 sept 2022 a las 22:12, David Lang via
I do not fully understand the question (maybe language issue on my
side), but there is a syntax error:
In a string template, properties must be enclosed in percent sign. so:
... string="%msg%
HTH
Rainer
El lun, 3 oct 2022 a las 13:18, Marcin Mirosław via rsyslog
() escribió:
>
> Hello!
> Field
The - does not throw a syntax error, but is ignored for many years. iIRC it
caused a sync after each write, which would be crazy for actual systems.
Rainer
Sent from phone, thus brief.
John Chivian via rsyslog schrieb am Do., 29.
Sep. 2022, 23:25:
> If I am not mistaken, buffering is the
I suggest updating to 8.2208.0. IIRC there is a patch that prevents a
temporary stall if TCP connections receive data extremely fast.
Rainer
El mié, 14 sept 2022 a las 11:14, Tomas Bekecs Zvarillo via rsyslog
() escribió:
>
> Hi rsyslog group,
>
> I'm stuck with rsyslog connectivity during
John,
please have a look here:
https://github.com/rsyslog/rsyslog/pull/4969
While I have tested the patch, it wouldn't hurt if you give it a try
and report back.
Rainer
El mar, 23 ago 2022 a las 9:26, Rainer Gerhards
() escribió:
>
> There is a lot of history in rsyslog. If a directive
There is a lot of history in rsyslog. If a directive exists in one
module but not the other, it was probably implemented for a specific
use case. And not carried over. We try to avoid this, but often it
makes sense (especially when experimenting, contributions, etc.).
That said, I'll look what it
1 - 100 of 5201 matches
Mail list logo