Does anyone know of a quick and easy template to remove the double quote
character from a %msg% before it is inserted into the database (MySQL in
my case). I have a %msg% that looks like this:
user pid=21214 uid=0 auid=4294967295 msg='PAM setcred: user="oracle"
exe="/bin/su" (hostname=?, addr=?, terminal=? result=Success)'
I am reading the %msg% from the MySQL database and returning it in JSON
formatting. When it encounters a double-quote character, it causes
issues. I can always fix the program that returns it in JSON, but I
think rsyslog can pre-fix the %msg%.
Daniel M. Anson
Linux Systems Engineer
Rackspace
danson@rackspace.com
Office: (210)312-5114
Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse@rackspace.com, and delete the original message.
Your cooperation is appreciated.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
character from a %msg% before it is inserted into the database (MySQL in
my case). I have a %msg% that looks like this:
user pid=21214 uid=0 auid=4294967295 msg='PAM setcred: user="oracle"
exe="/bin/su" (hostname=?, addr=?, terminal=? result=Success)'
I am reading the %msg% from the MySQL database and returning it in JSON
formatting. When it encounters a double-quote character, it causes
issues. I can always fix the program that returns it in JSON, but I
think rsyslog can pre-fix the %msg%.
Daniel M. Anson
Linux Systems Engineer
Rackspace
danson@rackspace.com
Office: (210)312-5114
Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse@rackspace.com, and delete the original message.
Your cooperation is appreciated.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com