mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-15 10:30:40 +01:00
e0dcad6cdf
This patch adds a robust, optional mechanism for handling "headerless" input—
log messages that do not conform to traditional syslog formatting.
- **Headerless detection (opt-in)**
- Controlled by the new `detect.headerless` boolean (default: off)
- Detects messages with **no PRI** and **no valid timestamp**
- Excludes structured inputs (e.g. JSON starting with `{` or `[`) as
before
- Injects default `hostname` and `tag` values
- Flags message internally as `HEADERLESS_MSG` for further processing
- **Fallback processing options**
- `headerless.ruleset`: route headerless messages to a dedicated ruleset
- `headerless.errorfile`: optionally store raw input to a file
- `headerless.drop`: discard headerless messages early if desired
- **Thread-safe HUP signal handling**
- New `doHUPParser` entry point allows safe log rotation for error file
- Follows standard reopen-on-write pattern post-HUP
- **Testing & Maintenance**
- Adds two test cases: `pmrfc3164-headerless.sh` and `pmrfc3164-drop.sh`
- Extends documentation for all new parameters
- Cleans up code formatting, includes, and bumps copyright
Some environments produce mixed or malformed input streams. This patch enables
early, lightweight detection of non-syslog input, with customizable recovery
and routing strategies. It avoids unnecessary parsing work and gives operators
better tools to isolate or discard garbage input—without breaking legacy behavior.
31 lines
908 B
Bash
Executable File
31 lines
908 B
Bash
Executable File
#!/bin/bash
|
|
# added 2025-07-18 by Codex, released under ASL 2.0
|
|
. ${srcdir:=.}/diag.sh init
|
|
|
|
generate_conf
|
|
add_conf '
|
|
module(load="../plugins/imtcp/.libs/imtcp")
|
|
input(type="imtcp" port="0" listenPortFileName="'$RSYSLOG_DYNNAME'.tcpflood_port" ruleset="input")
|
|
parser(name="p3164" type="pmrfc3164"
|
|
detect.headerless="on" headerless.errorfile="'$RSYSLOG_OUT_LOG'.err"
|
|
headerless.drop="on")
|
|
|
|
ruleset(name="input" parser="p3164") {
|
|
action(type="omfile" file="'$RSYSLOG_OUT_LOG'")
|
|
}
|
|
'
|
|
|
|
startup
|
|
|
|
tcpflood -p $TCPFLOOD_PORT -m1 -M "\"this is not syslog\""
|
|
tcpflood -p $TCPFLOOD_PORT -m1 -M "\"<13>Oct 11 22:14:15 host tag: normal\""
|
|
|
|
shutdown_when_empty
|
|
wait_shutdown
|
|
|
|
! grep -q 'this is not syslog' $RSYSLOG_OUT_LOG
|
|
grep -q 'normal' $RSYSLOG_OUT_LOG || { cat $RSYSLOG_OUT_LOG; error_exit 1; }
|
|
grep -q 'this is not syslog' ${RSYSLOG_OUT_LOG}.err || { cat ${RSYSLOG_OUT_LOG}.err; error_exit 1; }
|
|
|
|
exit_test
|