diff options
Diffstat (limited to 'doc/pmlastmsg.html')
| -rw-r--r-- | doc/pmlastmsg.html | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/doc/pmlastmsg.html b/doc/pmlastmsg.html new file mode 100644 index 00000000..397016df --- /dev/null +++ b/doc/pmlastmsg.html @@ -0,0 +1,62 @@ +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> +<html><head> +<meta http-equiv="Content-Language" content="en"> +<title>parser module for "last message repeated n times" (pmlastmsg)</title> +</head> +<body> +<a href="rsyslog_conf_modules.html">rsyslog module reference</a> + +<h1>parser module for "last message repeated n times" (pmlastmsg)</h1> +<p><b>Module Name: pmlastmsg</b></p> +<p><b>Module Type: parser module</b></p> +<p><b>Author: </b>Rainer Gerhards <rgerhards@adiscon.com></p> +<p><b>Available Since</b>: 5.5.6</p> +<p><b>Description</b>:</p> +<p>Some syslogds are known to emit severily malformed messages with content +"last message repeated n times". These messages can mess up message reception, as +they lead to wrong interpretation with the standard RFC3164 parser. Rather than +trying to fix this issue in pmrfc3164, we have created a new parser module +specifically for these messages. The reason is that some processing overhead is +involved in processing these messages (they must be recognized) and we would +not like to place this toll on every user but only on those actually in need +of the feature. Note that the performance toll is not large -- but if you expect +a very high message rate with tenthousands of messages per second, you will notice +a difference. +<p>This module should be loaded first inside <a href="messageparser.html">rsyslog's +parser chain</a>. It processes all those messages that contain a PRI, then none or +some spaces and then the exact text (case-insensitive) "last message repeated n times" +where n must be an integer. All other messages are left untouched. + +<p><b>Configuration Directives</b>:</p> +<p>There do not currently exist any configuration directives for this module. +<p><b>Examples:</b></p> +<p>This example is the typical use case, where some systems emit malformed +"repeated msg" messages. Other than that, the default RFC5424 and RFC3164 parsers +should be used. Note that when a parser is specified, the default parser chain +is removed, so we need to specify all three parsers. We use this together with the +default ruleset. +</p> +<textarea rows="15" cols="80">$ModLoad pmlastline # this parser is NOT a built-in module + +# note that parser are tried in the +# order they appear in rsyslog.conf, so put pmlastline first +$RulesetParser rsyslog.lastline +# as we have removed the default parser chain, we +# need to add the default parsers as well. +$RulesetParser rsyslog.rfc5424 +$RulesetParser rsyslog.rfc3164 + +# now come the typical rules, like... +*.* /path/to/file.log +</textarea> +<p><b>Caveats/Known Bugs:</b> +<p>currently none +<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] +[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> +<p><font size="2">This documentation is part of the +<a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2010 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and +<a href="http://www.adiscon.com/">Adiscon</a>. +Released under the GNU GPL version 3 or higher.</font></p> +</body></html> |