If messages are being dropped because of ratelimiting, an internal
message is generated to inform about this fact. This should happen
only uppon the firs occurance but the counter that tracks the number
of dropped messages was incremented only after sending the message. If
the message itself gets ratelimited, an endless loop spins out of
control. Thanks to Jerry James for notifying about this.
This prevents a segfault when a malformed journal entry field doesn't
contain an equal sign. Should not ever happen but was actually
triggered by a real bug in systemd journal.
This module provides the capability to count log messages by severity
or json property of given app-name. The count value is added into the
log message as json property named 'mmcount'
Example usage of the module in the configuration file
module(load="mmcount")
# count each severity of appname gluster
action(type="mmcount" appname="gluster")
# count each value of gf_code of appname gluster
action(type="mmcount" appname="glusterd" key="!gf_code")
# count value 9999 of gf_code of appname gluster
action(type="mmcount" appname="glusterfsd" key="!gf_code" value="9999")
# send email for every 50th mmcount
if $app-name == 'glusterfsd' and $!mmcount <> 0 and $!mmcount % 50 == 0 then {
$ActionMailSMTPServer smtp.example.com
$ActionMailFrom rsyslog@example.com
$ActionMailTo glusteradmin@example.com
$template mailSubject,"50th message of gf_code=9999 on %hostname%"
$template mailBody,"RSYSLOG Alert\r\nmsg='%msg%'"
$ActionMailSubject mailSubject
$ActionExecOnlyOnceEveryInterval 30
:ommail:;RSYSLOG_SyslogProtocol23Format
}
Signed-off-by: Bala.FA <barumuga@redhat.com>
If the listen socket is opened earlier (during configuration parsing),
it is closed again during early init.
The start has been postponed to the 'runInput' stage, which has an
unpleasant side effect that it will fail if the priviledges are
dropped.
The code should be eventually fixed to support the new config system.
If multiple spaces were used in front of the template name, all but one
of them became actually part of the template name. So
$template a,"..." would be name " a", and as such "a" was not
available, e.g. in
*.* /var/log/file;a
This is a legacy config problem. As it was unreported for many years,
no backport of the fix to old versions will happen.
This is a long-standing bug that was only recently reported by forum
user mc-sim.
Reference: http://kb.monitorware.com/post23448.html
permits to build rsyslog on a system where rst2man is not installed. In
that case, cached versions of the man pages are used (they were built
during "make dist", so they should be current for the version in
question.
This reverts commit 813c9c7f524976ef598864afbb729bca31557c32.
Removing references to libee.h in the previous commit solves the build
issue so the cflag shoudn't be needed after all.
