> -----Original Message----- > From: [email protected] [mailto:rsyslog- > [email protected]] On Behalf Of Radu Gheorghe > Sent: Thursday, September 13, 2012 3:26 PM > To: rsyslog-users > Subject: Re: [rsyslog] How to escape backslash in rainerscript > if...then conditions > > Hi Rainer, > > We've been trying with the attached patches and, while I don't get > configuration errors anymore as I did in the initial post, now the > "if" conditions don't seem to work at all. For example: >
I'll check ASAP, but I have just started work deep in the grammar fort he new set capability. So it will take a short moment... > # cat /etc/rsyslog.conf > $ModLoad imuxsock > #works > #:msg, startswith, " bla" /tmp/works > #doesn't work > if $msg startswith ' bla' then action(type="omfile" > file="/tmp/works") > > What I get in the debug log when I do `logger bla` is: Could you do a 'logger 'bla bla'" - I just want to outrule that this is an old bug, where startswith does not proper handle exact matches (I didn't change anything in that regard, at least I think so ;). Rainer > > 2317.818569031:7f0ddbede700: processBatch: batch of 1 elements must be > processed > 2317.818571929:7f0ddbede700: Processing next rule > 2317.818579703:7f0ddbede700: rainerscript: var '$msg': ' bla' > 2317.818583752:7f0ddbede700: result of rainerscript filter evaluation: > 0 > 2317.818586574:7f0ddbede700: Processing next action > > With double quotes in the "if" condition I get the same issue. > However, the old property-based filters (see conf above) seem to work > as expected: > > 2637.166169129:7fd906d0b700: processBatch: batch of 1 elements must be > processed > 2637.166172232:7fd906d0b700: Processing next rule > 2637.166177452:7fd906d0b700: Filter: check for property 'msg' (value ' > bla') startswith ' bla': TRUE > 2637.166182436:7fd906d0b700: Processing next action > 2637.166187207:7fd906d0b700: Called action(NotAllMark), processing > batch[0] via 'builtin-file' > 2637.166190037:7fd906d0b700: Called action(Batch), logging to builtin- > file > > Can someone else reproduce this or is it just me? > > Thanks a million (and best regards, too), > Radu > > 2012/9/13 Rainer Gerhards <[email protected]>: > > That was actually even a bug, because in v5 \\ worked. So I > implemented this as a bugfix to v6-stable. Note that Double-quotes are > now also supported, but do currently not permit $ inside the string > (use \$ to include that). > > > > Patch: > > > http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=10bef02e8f8f6bec4f > 1c18d9c634aa6927f4611a > > > > Rainer > > > >> -----Original Message----- > >> From: [email protected] [mailto:rsyslog- > >> [email protected]] On Behalf Of Rainer Gerhards > >> Sent: Wednesday, September 12, 2012 10:23 PM > >> To: [email protected] > >> Subject: Re: [rsyslog] How to escape backslash in rainerscript > >> if...then conditions > >> > >> ok,sounds like I implement the full set... > >> > >> Rainer > >> > >> > >> Sent from phone, thus brief. > >> > >> [email protected] hat geschrieben: > >> yOn Wed, 12 Sep 2012, Abby Edwards wrote: > >> > >> > Date: Wed, 12 Sep 2012 14:44:40 -0500 > >> > > >> > On 9/12/12 2:26 PM, "Rainer Gerhards" <[email protected]> > >> wrote: > >> > > >> > > >> >>>> we really need an option to skip escaping tabs while still > >> escaping > >> >>> all > >> >>>> the other control characters. too many logs include tabs and it > >> gets > >> >>>> 'interesting' to try and read them with #011 replacing them :) > >> >>> > >> >>> I definitely agree with the notion of having a way to escape all > >> >>> control > >> >>> characters except for tabs; I already have some logic in place > in > >> my > >> >>> applications to handle literal tabs, but other control > characters > >> make > >> >>> sense to escape. Right now I have to turn off the feature to > >> escape > >> >>> control characters just to preserve the tab behavior so as not > to > >> break > >> >>> parsing. +1 for this suggestion from me! > >> >> > >> >> Folks, message heard, I'll see if I can add a global option for > >> >> escape-all-but-tab. HOWEVER, my question was a different one ;) > >> >> > >> >> I was talking about escapes for script expressions, inside > constant > >> >> strings. So > >> >> > >> >> If $something contains 'aaa<escape here>bbbb' then ... > >> >> > >> >> This was triggered by Radu's question on how to escape backslash. > >> With > >> >> that said: do we need more than \\, \', \xhh inside script > >> constants? > >> >> > >> > > >> > In light of the fact rsyslog supports octet framing which means > log > >> > messages may actually contain new lines, it might be less > surprising > >> for > >> > end users to be able to specify \r and / or \n directly without > >> having to > >> > specify it by hex code, but the hex code provides enough > flexibility > >> to > >> > cover almost any circumstance. I could see you going either way. > >> > >> good point, I forgot about that. > >> > >> David Lang > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > >> if you DON'T LIKE THAT. > >> _______________________________________________ > >> rsyslog mailing list > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > >> http://www.rsyslog.com/professional-services/ > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > >> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT > POST > >> if you DON'T LIKE THAT. > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST > if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
