diff options
| author | Rainer Gerhards <rgerhards@adiscon.com> | 2008-02-19 10:30:42 +0000 |
|---|---|---|
| committer | Rainer Gerhards <rgerhards@adiscon.com> | 2008-02-19 10:30:42 +0000 |
| commit | cd2b24dfc45c4b115ace6d17ab0237511fef3d66 (patch) | |
| tree | de8436b5397e4248327bbddbb223d9dec6fef1ef /doc | |
| parent | 80b1798e2ddaf9ee4090321dba7465f233207682 (diff) | |
| download | rsyslog-cd2b24dfc45c4b115ace6d17ab0237511fef3d66.tar.gz rsyslog-cd2b24dfc45c4b115ace6d17ab0237511fef3d66.tar.xz rsyslog-cd2b24dfc45c4b115ace6d17ab0237511fef3d66.zip | |
- added doc on how expressions will work
- cleaned up the stringbuf Construct interface
- did some cleanup on stringbuf calls - we now have much better interfaces
and macros
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/Makefile.am | 1 | ||||
| -rw-r--r-- | doc/expression.html | 24 | ||||
| -rw-r--r-- | doc/history.html | 4 | ||||
| -rw-r--r-- | doc/imfile.html | 9 | ||||
| -rw-r--r-- | doc/professional_support.html | 125 |
5 files changed, 40 insertions, 123 deletions
diff --git a/doc/Makefile.am b/doc/Makefile.am index e081f88f..49a689c6 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -3,6 +3,7 @@ html_files = \ debug.html \ features.html \ generic_design.html \ + expression.html \ history.html \ how2help.html \ install.html \ diff --git a/doc/expression.html b/doc/expression.html new file mode 100644 index 00000000..51d99900 --- /dev/null +++ b/doc/expression.html @@ -0,0 +1,24 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html><head> +<meta http-equiv="Content-Language" content="en"><title>Expressions</title> + +</head> +<body> +<h1>Expressions</h1> +<p>Rsyslog supports expressions at a growing number of places. So +far, they are supported for filtering messages.</p> +<p></p> +<h2>Formal Definition</h2> + +<p>Below is the formal definition of expression format (in ABNF, RFC 2234):<br> +</p><pre>expr := e_and *("or" e_and)<br>e_and := e_cmp *("and" e_cmp)<br>e_cmp := val cmp_op val<br>val := ["+" / "-"] term *(("+" / "-") term)<br>term := factor *(("*" / "/" / "%") factor)<br>factor := ["not"] terminal<br>terminal := var / constant / function / "(" expr ")"<br>function := name "(" *("," expr) ")"<br>var := "$" varname<br>varname := msgvar / sysvar<br>msgvar := name<br>sysvar := "$" name<br>name := alpha *(alnum)<br>constant := string / number<br>string := simpstr / tplstr ; tplstr will be implemented in next phase<br>simpstr := "'" *char "'" ; use your imagination for char ;)<br>tplstr := '"' template '"' ; not initially implemented<br>number := 1*digit<br>cmp_op := "==" / "!=" / "<" / ">" / "<=" / ">=" <br>digit := %x30-39<br>alpha := "a" ... "z" # all letters<br>alnum :* alpha / digit / "_"<br></pre> +<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] +[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<p><font size="2">This documentation is part of the +<a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer +Gerhards</a> and +<a href="http://www.adiscon.com/">Adiscon</a>. +Released under the GNU GPL version 3 or higher.</font></p> +</body></html>
\ No newline at end of file diff --git a/doc/history.html b/doc/history.html index 4e0b374a..ba6b6fc6 100644 --- a/doc/history.html +++ b/doc/history.html @@ -31,7 +31,7 @@ rather better control over the output format. So there we were, with a rsyslogd that covers a lot of enhancements, but not a single one of these that made its name ;) Since version 0.9.2, receiving syslog messages via plain tcp is finally supported, a bit later sending via -TCP, too. Starting with 1.11.0, RFC 3195 is finally support at the +TCP, too. Starting with 1.11.0, RFC 3195 is finally supported at the receiving side (a.k.a. "listener"). Support for sending via RFC 3195 is still due. Anyhow, rsyslog has come much closer to what it name promises.</p> @@ -118,4 +118,4 @@ Don't be shy to post to either the blog or the <ul> <li><a href="http://www.rsyslog.com/Topic4.phtml">the rsyslog change log</a></li> </ul> -</body></html>
\ No newline at end of file +</body></html> diff --git a/doc/imfile.html b/doc/imfile.html index 3cc8308d..c35fd022 100644 --- a/doc/imfile.html +++ b/doc/imfile.html @@ -3,7 +3,6 @@ <meta http-equiv="Content-Language" content="en"><title>Text File Input Monitor</title> </head> - <body> <h1>Text File Input Module</h1> <p><b>Module Name: imfile</b></p> @@ -58,12 +57,14 @@ specified multiple times.</li> facility</span><br> The syslog facility to be assigned to lines read. Can be specified in textual form (e.g. "local0", "local1", ...) or as numbers (e.g. 128 for -"local0"). Textual form is suggested. <span style="font-weight: bold;">Default</span> is "local0".<span style="font-weight: bold;"></span></li> +"local0"). Textual form is suggested. <span style="font-weight: bold;">Default</span> is +"local0".<span style="font-weight: bold;"></span></li> <li><span style="font-weight: bold;">$InputFileSeverity</span><br> The syslog severity to be assigned to lines read. Can be specified in textual form (e.g. "info", "warning", ...) or as numbers (e.g. 4 for -"info"). Textual form is suggested. <span style="font-weight: bold;">Default</span> is "notice".</li> +"info"). Textual form is suggested. <span style="font-weight: bold;">Default</span> +is "notice".</li> <li><span style="font-weight: bold;">$InputRunFileMonitor</span><br> This <span style="font-weight: bold;">activates</span> the current monitor. It has no parameters. If you forget this @@ -122,7 +123,7 @@ $InputFilePollingInterval 10 <p><font size="2">This documentation is part of the <a href="http://www.rsyslog.com/">rsyslog</a> project.<br> -Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer +Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and <a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL version 3 or higher.</font></p> diff --git a/doc/professional_support.html b/doc/professional_support.html index 3cc8308d..83556b66 100644 --- a/doc/professional_support.html +++ b/doc/professional_support.html @@ -1,128 +1,19 @@ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><head> -<meta http-equiv="Content-Language" content="en"><title>Text File Input Monitor</title> +<meta http-equiv="Content-Language" content="en"><title>Professional Support for Rsyslog</title> </head> - <body> -<h1>Text File Input Module</h1> -<p><b>Module Name: imfile</b></p> -<p><b>Author: </b>Rainer Gerhards -<rgerhards@adiscon.com></p> -<p><b>Description</b>:</p> -<p>Provides the ability to convert any standard text file into -a syslog message. A standard -text file is a file consisting of printable characters with lines -being delimited by LF.</p> -<p>The file is read line-by-line and any line read is passed to -rsyslog's rule engine. The rule engine applies filter conditons and -selects which actions needs to be carried out.</p> -<p>As new lines are written they are taken from the file and -processed. Please note that this happens based on a polling interval -and not immediately. The file monitor support file rotation. To fully -work, rsyslogd must run while the file is rotated. Then, any remaining -lines from the old file are read and processed and when done with that, -the new file is being processed from the beginning. If rsyslogd is -stopped during rotation, the new file is read, but any not-yet-reported -lines from the previous file can no longer be obtained.</p> -<p>When rsyslogd is stopped while monitoring a text file, it -records the last processed location and continues to work from there -upon restart. So no data is lost during a restart (except, as noted -above, if the file is rotated just in this very moment).</p> -<p>Currently, the file must have a fixed name and location -(directory). It is planned to add support for dynamically generating -file names in the future.</p> -<p>Multiple files may be monitored by specifying -$InputRunFileMonitor multiple times. -</p> -<p><b>Configuration Directives</b>:</p> -<ul> -<li><strong>$InputFileName /path/to/file</strong><br> -The file being monitored. So far, this must be an absolute name (no -macros or templates)</li> -<li><span style="font-weight: bold;">$InputFileTag -tag:</span><br> -The tag to be used for messages that originate from this file. If you -would like to see the colon after the tag, you need to specify it here -(as shown above).</li> -<li><span style="font-weight: bold;">$InputFileStateFile -<name-of-state-file></span><br> -Rsyslog must keep track of which parts of the to be monitored file it -already processed. This is done in the state file. This file always is -created in the rsyslog working directory (configurable via -$WorkDirectory). Be careful to use unique names for different files -being monitored. If there are duplicates, all sorts of "interesting" -things may happen. Rsyslog currently does not check if a name is -specified multiple times.</li> -<li><span style="font-weight: bold;">$InputFileFacility -facility</span><br> -The syslog facility to be assigned to lines read. Can be specified in -textual form (e.g. "local0", "local1", ...) or as numbers (e.g. 128 for -"local0"). Textual form is suggested. <span style="font-weight: bold;">Default</span> is "local0".<span style="font-weight: bold;"></span></li> -<li><span style="font-weight: bold;">$InputFileSeverity</span><br> -The -syslog severity to be assigned to lines read. Can be specified in -textual form (e.g. "info", "warning", ...) or as numbers (e.g. 4 for -"info"). Textual form is suggested. <span style="font-weight: bold;">Default</span> is "notice".</li> -<li><span style="font-weight: bold;">$InputRunFileMonitor</span><br> -This <span style="font-weight: bold;">activates</span> -the current monitor. It has no parameters. If you forget this -directive, no file monitoring will take place.</li> -<li><span style="font-weight: bold;">$InputFilePollInterval -seconds</span><br> -This is a global setting. It specifies how often files are to be polled -for new data. The time specified is in seconds. The <span style="font-weight: bold;">default value</span> is 10 -seconds. Please note that future -releases of imfile may support per-file polling intervals, but -currently this is not the case. If multiple $InputFilePollInterval -statements are present in rsyslog.conf, only the last one is used.<br> -A short poll interval provides more rapid message forwarding, but -requires more system ressources. While it is possible, we stongly -recommend not to set the polling interval to 0 seconds. That will make -rsyslogd become a CPU hog, taking up considerable ressources. It is -supported, however, for the few very unusual situations where this -level may be needed. Even if you need quick response, 1 seconds should -be well enough. Please note that imfile keeps reading files as long as -there is any data in them. So a "polling sleep" will only happen when -nothing is left to be processed.</li> -</ul> -<b>Caveats/Known Bugs:</b> -<p>So far, only 100 files can be monitored. If more are needed, -the source needs to be patched. See define MAX_INPUT_FILES in imfile.c -</p> -<p><b>Sample:</b></p> -<p>The following sample monitors two files. If you need just one, -remove the second one. If you need more, add them according to the -sample ;). This code must be placed in /etc/rsyslog.conf (or wherever -your distro puts rsyslog's config files). Note that only commands -actually needed need to be specified. The second file uses less -commands and uses defaults instead.<br> -</p> -<textarea rows="15" cols="60">$ModLoad imfile.so # -needs to be done just once -# File 1 -$InputFileName /path/to/file1 -$InputFileTag tag1: -$InputFileStateFile stat-file1 -$InputFileSeverity error -$InputFileFacility local7 -$InputRunFileMonitor -# File 2 -$InputFileName /path/to/file2 -$InputFileTag tag2: -$InputFileStateFile stat-file2 -$InputRunFileMonitor -# ... and so on ... -# -# check for new lines every 10 seconds -$InputFilePollingInterval 10 -</textarea> -<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] -[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<h1>Professional Support for Rsyslog</h1> +<p>Professional Support is offered by <a href="http://www.adiscon.com">Adiscon</a>, the company +that sponsored rsyslog development. For details, please either contact <a href="mailto:info%40adiscon.com">Adiscon Sales</a> or +view <a href="http://sourceforge.net/services/project_services.php?project_id=123448">our +offerings on the sourceforge market place</a>.</p> +<p>[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> <p><font size="2">This documentation is part of the <a href="http://www.rsyslog.com/">rsyslog</a> project.<br> -Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer +Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and <a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL version 3 or higher.</font></p> |