Hello.
Thought I'd share with you my simple trick. I knw there are already some
available generators for syslog messages but sometimes you might just
want to do with what you have at hand.
Since you can't loop indefinitely in rsyslog (stacking calls will
eventually get you over the heap limits and you'll get your segfault -
been there, done that, not very intentionally ;-)) you have to create
your loop otherwise.
I suppose the easiest thing is to send the message back to ourselves to
reprocess. I add a counter using a global variable so I can check later
if I lost any messages along the way.
So I present to you - a short rsyslog-based event generator :-)
$ModLoad imudp
$UDPServerRun 11514
#We can of course use any other template as long as it contains the
/counter varable so we can track down the message count
template(name="just_send" type="list") {
property(name="/counter")
constant(value="\n")
}
if ( $/counter == "" ) then {
set $/counter = 1;
} else {
set $/counter = $/counter + 1;
}
#The "looping" action to keep our generator going
action(type="omfwd" protocol="UDP" port="11514" target="127.0.0.1"
template="just_send")
#The actual output action sending the messages away. Substitute address
with your syslog target
action(type="omfwd" protocol="UDP" port="514" target="172.16.0.88"
template="just_send")
The generator needs jumpstarting by sending anything to the "loop port".
Just use logger or nc, use python, whatever.
Of course the second action could be different but I'm afraid it could
get tricky performance-wise.
Hope this helps someone :-)
Have a good weekend!
MK
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Thought I'd share with you my simple trick. I knw there are already some
available generators for syslog messages but sometimes you might just
want to do with what you have at hand.
Since you can't loop indefinitely in rsyslog (stacking calls will
eventually get you over the heap limits and you'll get your segfault -
been there, done that, not very intentionally ;-)) you have to create
your loop otherwise.
I suppose the easiest thing is to send the message back to ourselves to
reprocess. I add a counter using a global variable so I can check later
if I lost any messages along the way.
So I present to you - a short rsyslog-based event generator :-)
$ModLoad imudp
$UDPServerRun 11514
#We can of course use any other template as long as it contains the
/counter varable so we can track down the message count
template(name="just_send" type="list") {
property(name="/counter")
constant(value="\n")
}
if ( $/counter == "" ) then {
set $/counter = 1;
} else {
set $/counter = $/counter + 1;
}
#The "looping" action to keep our generator going
action(type="omfwd" protocol="UDP" port="11514" target="127.0.0.1"
template="just_send")
#The actual output action sending the messages away. Substitute address
with your syslog target
action(type="omfwd" protocol="UDP" port="514" target="172.16.0.88"
template="just_send")
The generator needs jumpstarting by sending anything to the "loop port".
Just use logger or nc, use python, whatever.
Of course the second action could be different but I'm afraid it could
get tricky performance-wise.
Hope this helps someone :-)
Have a good weekend!
MK
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.