On 17.09.2021 09:32, Rainer Gerhards wrote:
El vie, 17 sept 2021 a las 9:15, Mariusz Kruk via rsyslog
(<[email protected]>) escribió:
Hmm...
OK, so a simple setup of:
[cut]
ruleset(name="whatever" queue.type="direct") {
set $.msg="whatever";
}
set $.msg=$msg;
call whatever
template using $.msg
output with the template
[cut]
Which from my tests shows that $.msg retains the $msg value even though
it was supposed to be overwritten by the "whatever" ruleset is caused
not by the queue mechanics but by non-linearity of execution and race?
I'll check. Maybe my memory served me incorrectly - but I don't think so.
Rainer
Sure. I'm not the one to argue with you about the internals of the code,
especially when I haven't looked into it ;-)
But - just to check - I did a config of:
[typical standard fedora rsyslog at the beginning and then:]
ruleset(name="whatever" queue.type="Direct") {
set $.msg="static value";
}
template(name="dumper" type="list") {
property(name=".msg")
constant(value="\n")
}
set $.msg=$msg;
call whatever
action(type="omfile" file="/tmp/log.log" template="dumper")
action(type="omfile" file="/tmp/rsyslog.debug"
template="RSYSLOG_DebugFormat")
In the log.log file I got a normal log of system events (obviously
without the headers since the template includes only $.msg which is
assigned a value of $msg).
In the debug file I have entries like
Debug line with all properties:
FROMHOST: 'scmkrlx', fromhost-ip: '127.0.0.1', HOSTNAME: 'scmkrlx', PRI:
86, syslogtag 'sudo:', programname: 'sudo', APP-NAME: 'sudo', PROCID:
'-', MSGID: '-', TIMESTAMP: 'Sep 17 10:28:28', STRUCTURED-DATA: '-',
msg: ' pam_unix(sudo:session): session opened for user root(uid=0) by
(uid=1000)'
escaped msg: ' pam_unix(sudo:session): session opened for user
root(uid=0) by (uid=1000)'
inputname: imuxsock rawmsg: '<86>Sep 17 10:28:28 sudo:
pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)'
$!:
$.:{ "msg": " pam_unix(sudo:session): session opened for user
root(uid=0) by (uid=1000)" }
As you can clearly see, the $.msg is getting assigned the $msg value and
_not_ overwritten by the static value.
But if I omit the queue type completely from the ruleset definition
ruleset(name="whatever") {
set $.msg="static value";
}
The rest of the config being the same, I get:
Debug line with all properties:
FROMHOST: 'scmkrlx', fromhost-ip: '127.0.0.1', HOSTNAME: 'scmkrlx', PRI:
86, syslogtag 'sudo:', programname: 'sudo', APP-NAME: 'sudo', PROCID:
'-', MSGID: '-', TIMESTAMP: 'Sep 17 10:36:13', STRUCTURED-DATA: '-',
msg: ' pam_unix(sudo:session): session opened for user root(uid=0) by
(uid=1000)'
escaped msg: ' pam_unix(sudo:session): session opened for user
root(uid=0) by (uid=1000)'
inputname: imuxsock rawmsg: '<86>Sep 17 10:36:13 sudo:
pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)'
$!:
$.:{ "msg": "static value" }
$/:
And of course in the "main" log I get only the lines with "static value"
instead of the original $msg.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
