mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-22 01:20:42 +01:00
57 lines
2.5 KiB
HTML
57 lines
2.5 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html><head>
|
|
<title>Log Message Normalization Module (mmnormalize)</title>
|
|
</head>
|
|
<body>
|
|
<a href="rsyslog_conf_modules.html">back</a>
|
|
|
|
<h1>Log Message Normalization Module</h1>
|
|
<p><b>Module Name: mmnormalize</b></p>
|
|
<p><b>Available since: </b>6.1.2+
|
|
<p><b>Author: </b>Rainer Gerhards <rgerhards@adiscon.com></p>
|
|
<p><b>Description</b>:</p>
|
|
<p>This module provides the capability to normalize log messages via
|
|
<a href="http://www.liblognorm.com">liblognorm</a>. Thanks to libee, unstructured text,
|
|
like usually found in log messages, can very quickly be parsed and put into
|
|
a normal form. This is done so quickly, that it usually should be possible
|
|
to normalize events in realtime.
|
|
<p>This module is implemented via the output module interface. That means that
|
|
mmnormalize should be called just like an action. After it has been called,
|
|
the normalized message properties are avaialable and can be access. These properties
|
|
are called the "CEE" properties, because liblognorm creates a format that is
|
|
inspired by the CEE approach.
|
|
<p>Note that mmnormalize should only be called once on each message. Behaviour is
|
|
undifined if multiple calls to mmnormalize happen for the same message.
|
|
</p>
|
|
<p><b>Configuration Directives</b>:</p>
|
|
<ul>
|
|
<li>$mmnormalizeRuleBase <rulebase-file><br>
|
|
Specifies which rulebase file is to use. This file is loaded. If there are
|
|
multiple mmnormalize instances, each one can use a different file. However,
|
|
a single instance can use only a single file. This parameter MUST be given,
|
|
because normalization can only happen based on a rulebase.
|
|
<li>$mmnormalizeUseRawMsg <on/off><br>
|
|
Specifies if the raw message should be used for normalization (on) or just the
|
|
MSG part of the message (off). Default is "off".
|
|
</ul>
|
|
<b>Caveats/Known Bugs:</b>
|
|
<p>None known at this time.
|
|
</ul>
|
|
<p><b>Sample:</b></p>
|
|
<p>This activates the module and applies normalization to all messages:<br>
|
|
</p>
|
|
<textarea rows="8" cols="60">$ModLoad mmnormalize
|
|
$mmnormalizeRuleBase rulebase.rb
|
|
*.* :mmnormalize:
|
|
</textarea>
|
|
<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>]
|
|
[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
|
|
<p><font size="2">This documentation is part of the
|
|
<a href="http://www.rsyslog.com/">rsyslog</a>
|
|
project.<br>
|
|
Copyright © 2010 by <a href="http://www.gerhards.net/rainer">Rainer
|
|
Gerhards</a> and
|
|
<a href="http://www.adiscon.com/">Adiscon</a>.
|
|
Released under the GNU GPL version 3 or higher.</font></p>
|
|
</body></html>
|