Hi Rainer,
We've been trying with the attached patches and, while I don't get
configuration errors anymore as I did in the initial post, now the
"if" conditions don't seem to work at all. For example:
# cat /etc/rsyslog.conf
$ModLoad imuxsock
#works
#:msg, startswith, " bla" /tmp/works
#doesn't work
if $msg startswith ' bla' then action(type="omfile"
file="/tmp/works")
What I get in the debug log when I do `logger bla` is:
2317.818569031:7f0ddbede700: processBatch: batch of 1 elements must be processed
2317.818571929:7f0ddbede700: Processing next rule
2317.818579703:7f0ddbede700: rainerscript: var '$msg': ' bla'
2317.818583752:7f0ddbede700: result of rainerscript filter evaluation: 0
2317.818586574:7f0ddbede700: Processing next action
With double quotes in the "if" condition I get the same issue.
However, the old property-based filters (see conf above) seem to work
as expected:
2637.166169129:7fd906d0b700: processBatch: batch of 1 elements must be processed
2637.166172232:7fd906d0b700: Processing next rule
2637.166177452:7fd906d0b700: Filter: check for property 'msg' (value '
bla') startswith ' bla': TRUE
2637.166182436:7fd906d0b700: Processing next action
2637.166187207:7fd906d0b700: Called action(NotAllMark), processing
batch[0] via 'builtin-file'
2637.166190037:7fd906d0b700: Called action(Batch), logging to builtin-file
Can someone else reproduce this or is it just me?
Thanks a million (and best regards, too),
Radu
2012/9/13 Rainer Gerhards <[email protected]>:
> That was actually even a bug, because in v5 \\ worked. So I implemented this
> as a bugfix to v6-stable. Note that Double-quotes are now also supported, but
> do currently not permit $ inside the string (use \$ to include that).
>
> Patch:
> http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=10bef02e8f8f6bec4f1c18d9c634aa6927f4611a
>
> Rainer
>
>> -----Original Message-----
>> From: [email protected] [mailto:rsyslog-
>> [email protected]] On Behalf Of Rainer Gerhards
>> Sent: Wednesday, September 12, 2012 10:23 PM
>> To: [email protected]
>> Subject: Re: [rsyslog] How to escape backslash in rainerscript
>> if...then conditions
>>
>> ok,sounds like I implement the full set...
>>
>> Rainer
>>
>>
>> Sent from phone, thus brief.
>>
>> [email protected] hat geschrieben:
>> yOn Wed, 12 Sep 2012, Abby Edwards wrote:
>>
>> > Date: Wed, 12 Sep 2012 14:44:40 -0500
>> >
>> > On 9/12/12 2:26 PM, "Rainer Gerhards" <[email protected]>
>> wrote:
>> >
>> >
>> >>>> we really need an option to skip escaping tabs while still
>> escaping
>> >>> all
>> >>>> the other control characters. too many logs include tabs and it
>> gets
>> >>>> 'interesting' to try and read them with #011 replacing them :)
>> >>>
>> >>> I definitely agree with the notion of having a way to escape all
>> >>> control
>> >>> characters except for tabs; I already have some logic in place in
>> my
>> >>> applications to handle literal tabs, but other control characters
>> make
>> >>> sense to escape. Right now I have to turn off the feature to
>> escape
>> >>> control characters just to preserve the tab behavior so as not to
>> break
>> >>> parsing. +1 for this suggestion from me!
>> >>
>> >> Folks, message heard, I'll see if I can add a global option for
>> >> escape-all-but-tab. HOWEVER, my question was a different one ;)
>> >>
>> >> I was talking about escapes for script expressions, inside constant
>> >> strings. So
>> >>
>> >> If $something contains 'aaa<escape here>bbbb' then ...
>> >>
>> >> This was triggered by Radu's question on how to escape backslash.
>> With
>> >> that said: do we need more than \\, \', \xhh inside script
>> constants?
>> >>
>> >
>> > In light of the fact rsyslog supports octet framing which means log
>> > messages may actually contain new lines, it might be less surprising
>> for
>> > end users to be able to specify \r and / or \n directly without
>> having to
>> > specify it by hex code, but the hex code provides enough flexibility
>> to
>> > cover almost any circumstance. I could see you going either way.
>>
>> good point, I forgot about that.
>>
>> David Lang
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
>> _______________________________________________
>> rsyslog mailing list
>> http://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
