This module provides the capability to count log messages by severity
or json property of given app-name. The count value is added into the
log message as json property named 'mmcount'
Example usage of the module in the configuration file
module(load="mmcount")
# count each severity of appname gluster
action(type="mmcount" appname="gluster")
# count each value of gf_code of appname gluster
action(type="mmcount" appname="glusterd" key="!gf_code")
# count value 9999 of gf_code of appname gluster
action(type="mmcount" appname="glusterfsd" key="!gf_code" value="9999")
# send email for every 50th mmcount
if $app-name == 'glusterfsd' and $!mmcount <> 0 and $!mmcount % 50 == 0 then {
$ActionMailSMTPServer smtp.example.com
$ActionMailFrom rsyslog@example.com
$ActionMailTo glusteradmin@example.com
$template mailSubject,"50th message of gf_code=9999 on %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
$ActionExecOnlyOnceEveryInterval 30
:ommail:;RSYSLOG_SyslogProtocol23Format
}
Signed-off-by: Bala.FA <barumuga@redhat.com>
For reading messages with all fields from structured systemd journal
log messages.
Loading module with $ModLoad imjournal is enough to start pulling messages
no other configuration is needed.
modified: Makefile.am
modified: configure.ac
new file: plugins/imjournal/Makefile.am
new file: plugins/imjournal/imjournal.c
new file: plugins/imjournal/imjournal.h
Thanks to Michael Biebl for identifying this as the culprit for
several build-related issues. The plugin is a placeholder, and was
not used for quite some while. It is definitely not worth the effort
to keep it along. If needed, can be quickly created.
This is still in development, bute ready to be commited to master.
modified: Makefile.am
modified: configure.ac
new file: plugins/imkmsg/Makefile.am
new file: plugins/imkmsg/imkmsg.c
new file: plugins/imkmsg/imkmsg.h
new file: plugins/imkmsg/kmsg.c
someone claimed to write a module with this functionality, if a
template were provided. And indeed, it was provided but never
anything happend (at least nothing was contributed back...). Removing
this silly template now. If someone really intends to take up on it,
get a copy from older git versions.
Add support for sending events to elasticsearch - a distributed,
RESTful, search engine built on Lucene (www.elasticsearch.org).
The output module is enabled via a configure option, and uses
libcurl to send the messages from rsyslog to elasticsearch.
This patch makes use of the earlier JSON quoting patch to ensure
valid JSON strings are sent to the server.
Signed-off-by: Nathan Scott <nathans@aconex.com>
The actual input/output modules are better copy templates. Instead, the
now-removed modules cost time for maintenance AND often caused confusion
on what their role was.
