| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| |
|
|
|
| |
This is more efficient for some outputs. They new can receive fields not only
as a single string but rather in an array where each string is seperated.
|
| |
|
|
|
| |
to enable simple creation of CSV-formatted outputs (format
from RFC4180 is used)
|
| |\
| |
| |
| |
| |
| |
| | |
Conflicts:
ChangeLog
doc/manual.html
|
| | |
| |
| |
| |
| |
| | |
This allows to return the string 0 if a regular expression is
not found. This is probably useful for storing numerical values into
database columns.
|
| |/
|
|
|
|
|
| |
Multiple immediately successive field delimiters are treated as
a single one.
Signed-off-by: Rainer Gerhards <rgerhards@adiscon.com>
|
| |\
| |
| |
| |
| |
| |
| | |
Conflicts:
doc/property_replacer.html
tools/syslogd.c
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- added a new property replacer option "sp-if-no-1st-sp" to cover
a problem with RFC 3164 based interpreation of tag separation. While
it is a generic approach, it fixes a format problem introduced in
3.18.0, where kernel messages no longer had a space after the tag.
This is done by a modifcation of the default templates.
Please note that this may affect some messages where there intentionally
is no space between the tag and the first character of the message
content. If so, this needs to be worked around via a specific
template. However, we consider this scenario to be quite remote and,
even if it exists, it is not expected that it will actually cause
problems with log parsers (instead, we assume the new default template
behaviour may fix previous problems with log parsers due to the
missing space).
- doc bugfix: property replacer options secpath-replace and
secpath-drop were not documented
|
| | |
| |
| |
| | |
enables to query just the subsecond part of a high-precision timestamp
|
| | | |
|
| | |
| |
| |
| |
| |
| | |
implemented in property replacer: if a regular expression does not match,
it can now either return "**NO MATCH** (default, as before), a blank
property or the full original property text
|
| |/
|
|
|
|
|
| |
- enabled Posix ERE expressions inside the property replacer
(previously BRE was permitted only)
- provided ability to specify that a regular expression submatch shall
be used inside the property replacer
|
| |\
| |
| |
| |
| |
| |
| |
| |
| | |
Conflicts:
ChangeLog
configure.ac
doc/ommail.html
queue.c
|
| | | |
|
| |/ |
|
| | |
|
| |
|
|
|
| |
- added -M rsyslogd option (allows to specify module directory location)
- converted net.c into a loadable library plugin
|
| | |
|
| | |
|
| |
|
|
|
| |
number of patches necessary to core modules, because we need a new
formatting function (date-pgsql).
|
| |
|
|
|
|
|
| |
provided and the calling sequence is more intuitive (there were invalid
calls based on a too-weired interface)
- (hopefully) fixed some remaining bugs rooted in wrong use of the CStr
class. These could lead to program abort.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
call to logerror() that many of the modules do. I have not tried it,
but I think things will become wild when we compile without pthread
support. Threading prevents full recursion, so we have not seen any bad
effects so far. However, the problems that I experienced in ommysl
(that caused me to re-structure startWorker()) are actually rooted in
this issue. I first thought to fix it via a module interace, but I now
came to the conclusion that it is not more effort and much cleaner to
do an internal error buffering class. This is implemented in
errbuf.c/h.
- I just noticed that this is not actually an error buf, but the core of an
input module for all internal messages. As such, I implement it now as
iminternal.c/h. Of course, there is no input module interface yet
designed, but that doesn't matter. Worst-case, I need to re-write the
im, best case I can use the im (at least partly) to define the
interface.
- added a few functions to the linkedlist class
- error messages during startup are now buffered - so we do no longer need
to think about how emergency logging might work. Actually, these are
logged to whatever is instatiated in the log file. This enhances the
chance that we will be able to drop the error message somewhere it is
seen.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
varmojfekoj for the patch
|
| | |
|
| |
|
|
| |
with templates.
|
| | |
|
| | |
|
| |
|
|
| |
This is untested so far (the evening came quicker than anticipated ;))
|
| | |
|
| |
|
|
| |
correctly)
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
