| Commit message (Collapse) | Author | Age | Files | Lines |
|\ |
|
| |
| |
| |
| |
| |
| | |
because the sql/stdsql option could not be specified. This has been
solved by permitting the strgen to include the opton inside its name.
closes: http://bugzilla.adiscon.com/show_bug.cgi?id=195
|
|/
|
|
| |
closes: http://bugzilla.adiscon.com/show_bug.cgi?id=243
|
|
|
|
| |
needs testig and verification (wrong system for doing that ;))
|
|
|
|
|
|
| |
plus some minor nits. This was found after a clang static code analyzer
analysis (great tool, and special thanks to Marcin for telling me about
it!)
|
|
|
|
|
| |
Bug: http://bugzilla.adiscon.com/show_bug.cgi?id=206
Thanks to David Hill for alerting us.
|
|
|
|
|
|
| |
and also provided four build-in modules for the most common use
cases, hopefully resulting in a speedup of around 5% for typical
rsyslog processing.
|
|
|
|
|
| |
and a first built-in strgen module. Some tweaks and more default strgens
are needed, but the code doesn't look too bad ;)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This was a test done to try to generate templates with C code, via
a new (potentially to-be-implemented) class of template modules. We have
a rough POC inside this code, and it showed around 5% or better speedup. So
it semms worth continuing in this direction.
Note that this experimental commit works correct, but does any
template in the form of
$template tpl,=somewhat
will lead to fixed template expansion based on the default file format.
|
| |
|
|
|
|
|
| |
primarily to ease migration from syslog-ng. See property replacer doc
for details.
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Conflicts:
ChangeLog
configure.ac
doc/manual.html
plugins/imuxsock/imuxsock.c
template.c
tests/Makefile.am
tests/parsertest.sh
|
| | |
|
|\| |
|
| |\ |
|
| | |
| | |
| | |
| | | |
Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
|
| | |
| | |
| | |
| | |
| | |
| | | |
This was a result of an internal processing error if maximum field
sizes had been specified in the property replacer.
Also did some testbench improvements, including omstdout.
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
support for enhancing probability of memory addressing failure by
using non-NULL default value for malloced memory (optional, only if
requested by configure option). This helps to track down some
otherwise undetected issues within the testbench and is expected
to be very useful in the future.
|
| | |
| | |
| | |
| | |
| | |
| | | |
however, this had no negative effect, as the message processing state
was not evaluated when a batch was deleted, and that was the only case
where the state could be wrong.
|
| | |
| | |
| | |
| | |
| | | |
bugfix: debug string larger than 1K were improperly displayed. Max size
is now 32K, and if a string is even longer it is meaningful truncated.
|
| | |
| | |
| | |
| | |
| | | |
This did NOT leak based on message volume. Also, did some cleanup during
the commit.
|
|/ /
| |
| |
| |
| | |
This was a result of an internal processing error if maximum field
sizes had been specified in the property replacer.
|
| | |
|
| | |
|
| | |
|
| |
| |
| |
| | |
this was a regression I introduced this afternoon
|
|/ |
|
| |
|
|
|
|
|
| |
This is more efficient for some outputs. They new can receive fields not only
as a single string but rather in an array where each string is seperated.
|
|
|
|
|
| |
to enable simple creation of CSV-formatted outputs (format
from RFC4180 is used)
|
|\
| |
| |
| |
| |
| |
| | |
Conflicts:
ChangeLog
doc/manual.html
|
| |
| |
| |
| |
| |
| | |
This allows to return the string 0 if a regular expression is
not found. This is probably useful for storing numerical values into
database columns.
|
|/
|
|
|
|
|
| |
Multiple immediately successive field delimiters are treated as
a single one.
Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
|
|\
| |
| |
| |
| |
| |
| | |
Conflicts:
doc/property_replacer.html
tools/syslogd.c
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- added a new property replacer option "sp-if-no-1st-sp" to cover
a problem with RFC 3164 based interpreation of tag separation. While
it is a generic approach, it fixes a format problem introduced in
3.18.0, where kernel messages no longer had a space after the tag.
This is done by a modifcation of the default templates.
Please note that this may affect some messages where there intentionally
is no space between the tag and the first character of the message
content. If so, this needs to be worked around via a specific
template. However, we consider this scenario to be quite remote and,
even if it exists, it is not expected that it will actually cause
problems with log parsers (instead, we assume the new default template
behaviour may fix previous problems with log parsers due to the
missing space).
- doc bugfix: property replacer options secpath-replace and
secpath-drop were not documented
|
| |
| |
| |
| |
| | |
Also added redirector to web description of error codes
closes bug http://bugzilla.adiscon.com/show_bug.cgi?id=20
|
| |
| |
| |
| | |
enables to query just the subsecond part of a high-precision timestamp
|
| | |
|
| |
| |
| |
| |
| |
| | |
implemented in property replacer: if a regular expression does not match,
it can now either return "**NO MATCH** (default, as before), a blank
property or the full original property text
|
| |
| |
| |
| |
| |
| |
| | |
- enabled Posix ERE expressions inside the property replacer
(previously BRE was permitted only)
- provided ability to specify that a regular expression submatch shall
be used inside the property replacer
|
|/
|
|
|
| |
reduced dependencies, moved non-runtime files to its own directory except
for some whom's status is unclear
|
| |
|
| |
|
| |
|
|
|
|
| |
loaded
|
|
|
|
| |
scheme (like im* and om*)
|
| |
|
| |
|
| |
|