From b9cc60deeb0201e263ee011a20b0bce4eb6001f4 Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 16 Dec 2010 14:53:54 +0100 Subject: preparing for 6.1.2 release --- doc/Makefile.am | 1 + doc/manual.html | 2 +- doc/mmnormalize.html | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 doc/mmnormalize.html (limited to 'doc') diff --git a/doc/Makefile.am b/doc/Makefile.am index 27471737..6adb14d4 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -110,6 +110,7 @@ html_files = \ src/tls_cert.dia \ gssapi.html \ licensing.html \ + mmnormalize.html \ ommail.html \ omuxsock.html \ omrelp.html \ diff --git a/doc/manual.html b/doc/manual.html index ab1725fb..49a4300b 100644 --- a/doc/manual.html +++ b/doc/manual.html @@ -19,7 +19,7 @@ rsyslog support available directly from the source!

Please visit the rsyslog sponsor's page to honor the project sponsors or become one yourself! We are very grateful for any help towards the project goals.

This documentation is for version 6.1.1 (beta branch) of rsyslog. +

This documentation is for version 6.1.2 (devel branch) of rsyslog. Visit the rsyslog status page to obtain current version information and project status.

If you like rsyslog, you might diff --git a/doc/mmnormalize.html b/doc/mmnormalize.html new file mode 100644 index 00000000..82f9b6a2 --- /dev/null +++ b/doc/mmnormalize.html @@ -0,0 +1,56 @@ + + +Log Message Normalization Module (mmnormalize) + + +back + +

Log Message Normalization Module

+
Module Name: mmnormalize
+
Available since: 6.1.2+ +
Author: Rainer Gerhards <rgerhards@adiscon.com>
+
Description:
+
This module provides the capability to normalize log messages via +liblognorm. Thanks to libee, unstructured text, +like usually found in log messages, can very quickly be parsed and put into +a normal form. This is done so quickly, that it usually should be possible +to normalize events in realtime. +
This module is implemented via the output module interface. That means that +mmnormalize should be called just like an action. After it has been called, +the normalized message properties are avaialable and can be access. These properties +are called the "CEE" properties, because liblognorm creates a format that is +inspired by the CEE approach. +
Note that mmnormalize should only be called once on each message. Behaviour is +undifined if multiple calls to mmnormalize happen for the same message. +
+
Configuration Directives:
+
+
$mmnormalizeRuleBase <rulebase-file>
+Specifies which rulebase file is to use. This file is loaded. If there are +multiple mmnormalize instances, each one can use a different file. However, +a single instance can use only a single file. This parameter MUST be given, +because normalization can only happen based on a rulebase. +
$mmnormalizeUseRawMsg <on/off>
+Specifies if the raw message should be used for normalization (on) or just the +MSG part of the message (off). Default is "off". +
+Caveats/Known Bugs: +
None known at this time. + +
Sample:
+
This activates the module and applies normalization to all messages:
+
+$ModLoad mmnormalize +$mmnormalizeRuleBase rulebase.rb +*.* :mmnormalize: + +
[rsyslog.conf overview] +[manual index] [rsyslog site]
+
This documentation is part of the +rsyslog +project.
+Copyright © 2010 by Rainer +Gerhards and +Adiscon. +Released under the GNU GPL version 3 or higher.
+ -- cgit