Mailing List Archive

Message in mailbody is not complete
Hello everyone,

I have a problem with e-mail alerting and possibly with regexp.

Config:

template(name="mailBody" type="list") {
constant(value="Message:")
constant(value="\n")
property(name="msg" droplastlf="on" )
constant(value="\n")
}


if re_match($msg, "(PM-4-ERR_DISABLE)|(On battery power in response)|(Stack port changed to down)|(SPANTREE-2-ROOTGUARD_BLOCK)|(SPANTREE-2-ROOTGUARD_UNBLOCK)|(S
PANTREE-2-BLOCK_BPDUGUARD)|(DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT)|(SA creation error)|(DUPADDR)|(PSECURE)")
then
{
action(
type="ommail"
template="mailBody"
...
)
}

When I test it with command `echo "SA creation error" | nc -u -q0 127.0.0.1 514`
I get e-mail alert with message like " error".

When I test it with command `echo "(SA creation error)" | nc -u -q0 127.0.0.1 514`
I get e-mail alert with message like " creation error".

When regexp in re_match does not contain brackets, the output is " error".
When I prepend some text, so the command is like `echo "bla SA creation error" | nc -u -q0 127.0.0.1 514`, the output is same.
I need to prepend "bla bla SA creation error" then the output is correct (= SA creation error)


---
T?to spr?va je urcen? v?lucne osobe v nej uvedenej a je predmetom obchodn?ho tajomstva. Pokial nie je urcen? V?m, bezodkladne ju, pros?m zmazte a upovedomte odosielatela.
This message is confidential and addressed only to the person named in the message. If you are not the intended recipient of the message, please delete it immediately and notify sender.

Osobn? ?daje dotknut?ch os?b, ktor? s? s?castou tejto mailovej komunik?cie s? sprac?van? na vopred vymedzen? ?cel v s?lade s Nariaden?m Eur?pskeho parlamentu a Rady (E?) 2016/679 o ochrane fyzick?ch os?b pri sprac?van? osobn?ch ?dajov a o volnom pohybe tak?chto ?dajov a z?kona c. 18/2018 Z. z. o ochrane osobn?ch ?dajov a o zmene a doplnen? niektor?ch z?konov.
Blizsie inform?cie n?jdete na https://www.ucm.sk/sk/gdpr-ochrana-osobnych-udajov/.
---
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Re: Message in mailbody is not complete [ In reply to ]
whenever you have a case where the content is not what you expect, log the
message using the template RSYSLOG_DebugFormat so you can see how rsyslog
understandsthe message. I'll bet that it's not getting parsed the way you are
epecting.

David Lang

On Tue, 23 Feb 2021, HERCEK, Mari?n via rsyslog wrote:

> Date: Tue, 23 Feb 2021 09:27:16 +0000
> From: "HERCEK, Mari?n via rsyslog" <rsyslog@lists.adiscon.com>
> To: "rsyslog@lists.adiscon.com" <rsyslog@lists.adiscon.com>
> Cc: "HERCEK, Mari?n" <marian.hercek@ucm.sk>
> Subject: [rsyslog] Message in mailbody is not complete
>
> Hello everyone,
>
> I have a problem with e-mail alerting and possibly with regexp.
>
> Config:
>
> template(name="mailBody" type="list") {
> constant(value="Message:")
> constant(value="\n")
> property(name="msg" droplastlf="on" )
> constant(value="\n")
> }
>
>
> if re_match($msg, "(PM-4-ERR_DISABLE)|(On battery power in response)|(Stack port changed to down)|(SPANTREE-2-ROOTGUARD_BLOCK)|(SPANTREE-2-ROOTGUARD_UNBLOCK)|(S
> PANTREE-2-BLOCK_BPDUGUARD)|(DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT)|(SA creation error)|(DUPADDR)|(PSECURE)")
> then
> {
> action(
> type="ommail"
> template="mailBody"
> ...
> )
> }
>
> When I test it with command `echo "SA creation error" | nc -u -q0 127.0.0.1 514`
> I get e-mail alert with message like " error".
>
> When I test it with command `echo "(SA creation error)" | nc -u -q0 127.0.0.1 514`
> I get e-mail alert with message like " creation error".
>
> When regexp in re_match does not contain brackets, the output is " error".
> When I prepend some text, so the command is like `echo "bla SA creation error" | nc -u -q0 127.0.0.1 514`, the output is same.
> I need to prepend "bla bla SA creation error" then the output is correct (= SA creation error)
>
>
> ---
> T?to spr?va je urcen? v?lucne osobe v nej uvedenej a je predmetom obchodn?ho tajomstva. Pokial nie je urcen? V?m, bezodkladne ju, pros?m zmazte a upovedomte odosielatela.
> This message is confidential and addressed only to the person named in the message. If you are not the intended recipient of the message, please delete it immediately and notify sender.
>
> Osobn? ?daje dotknut?ch os?b, ktor? s? s?castou tejto mailovej komunik?cie s? sprac?van? na vopred vymedzen? ?cel v s?lade s Nariaden?m Eur?pskeho parlamentu a Rady (E?) 2016/679 o ochrane fyzick?ch os?b pri sprac?van? osobn?ch ?dajov a o volnom pohybe tak?chto ?dajov a z?kona c. 18/2018 Z. z. o ochrane osobn?ch ?dajov a o zmene a doplnen? niektor?ch z?konov.
> Blizsie inform?cie n?jdete na https://www.ucm.sk/sk/gdpr-ochrana-osobnych-udajov/.
> ---
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
>
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.