diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/imklog.html | 5 | ||||
| -rw-r--r-- | doc/imptcp.html | 6 | ||||
| -rw-r--r-- | doc/imtcp.html | 6 | ||||
| -rw-r--r-- | doc/imuxsock.html | 11 | ||||
| -rw-r--r-- | doc/manual.html | 11 | ||||
| -rw-r--r-- | doc/property_replacer.html | 34 | ||||
| -rw-r--r-- | doc/rsyslog_conf_global.html | 26 | ||||
| -rw-r--r-- | doc/v5compatibility.html | 6 | ||||
| -rw-r--r-- | doc/version_naming.html | 4 |
9 files changed, 87 insertions, 22 deletions
diff --git a/doc/imklog.html b/doc/imklog.html index f273753f..2e3b3bc2 100644 --- a/doc/imklog.html +++ b/doc/imklog.html @@ -36,6 +36,11 @@ processing.<span style="font-weight: bold;"></span></li> <li><span style="font-weight: bold;"></span>$DebugPrintKernelSymbols [on/<b>off</b>]<br> Linux only, ignored on other platforms (but may be specified)</li> +<li><b>$klogLocalIPIF</b> [interface name] - (available since 5.9.6) - if provided, the IP of the specified +interface (e.g. "eth0") shall be used as fromhost-ip for imklog-originating messages. +If this directive is not given OR the interface cannot be found (or has no IP address), +the default of "127.0.0.1" is used. +</li> <li>$klogSymbolLookup [on/<b>off</b>] -- disables imklog kernel symbol translation (former klogd -x option). NOTE that this option is counter-productive on recent kernels (>= 2.6) because the diff --git a/doc/imptcp.html b/doc/imptcp.html index a4f43249..4307c603 100644 --- a/doc/imptcp.html +++ b/doc/imptcp.html @@ -43,6 +43,12 @@ very limited interest in fixing this issue. This directive <b>can not</b> fix th That would require much more code changes, which I was unable to do so far. Full details can be found at the <a href="http://www.rsyslog.com/Article321.phtml">Cisco tcp syslog anomaly</a> page. +<li><b>$InputPTCPSupportOctetCountedFraming</b> <<b>on</b>|off><br> +If set to "on", the legacy octed-counted framing (similar to RFC5425 framing) is +activated. This is the default and should be left unchanged until you know +very well what you do. It may be useful to turn it off, if you know this framing +is not used and some senders emit multi-line messages into the message stream. +</li> <li>$InputPTCPServerNotifyOnConnectionClose [on/<b>off</b>]<br> instructs imptcp to emit a message if the remote peer closes a connection.<br> <li><b>$InputPTCPServerKeepAlive</b> <on/<b>off</b>><br> diff --git a/doc/imtcp.html b/doc/imtcp.html index 7653f601..649b08f8 100644 --- a/doc/imtcp.html +++ b/doc/imtcp.html @@ -86,6 +86,12 @@ listener. <id-string> semantics depend on the currently selected AuthMode and <a href="netstream.html">network stream driver</a>. PermittedPeers may not be set in anonymous modes.</li> <li><b>$InputTCPServerBindRuleset</b> <ruleset><br> Binds the listener to a specific <a href="multi_ruleset.html">ruleset</a>.</li> +<li><b>$InputTCPSupportOctetCountedFraming</b> <<b>on</b>|off><br> +If set to "on", the legacy octed-counted framing (similar to RFC5425 framing) is +activated. This is the default and should be left unchanged until you know +very well what you do. It may be useful to turn it off, if you know this framing +is not used and some senders emit multi-line messages into the message stream. +</li> </ul> <b>Caveats/Known Bugs:</b> <ul> diff --git a/doc/imuxsock.html b/doc/imuxsock.html index 734ae889..34a696d9 100644 --- a/doc/imuxsock.html +++ b/doc/imuxsock.html @@ -76,6 +76,11 @@ burst in number of messages. Default is 200. <li><b>$IMUXSockRateLimitSeverity</b> [numerical severity] - specifies the severity of messages that shall be rate-limited. </li> +<li><b>$IMUXSockLocalIPIF</b> [interface name] - (available since 5.9.6) - if provided, the IP of the specified +interface (e.g. "eth0") shall be used as fromhost-ip for imuxsock-originating messages. +If this directive is not given OR the interface cannot be found (or has no IP address), +the default of "127.0.0.1" is used. +</li> <li><b>$InputUnixListenSocketUsePIDFromSystem</b> [on/<b>off</b>] - specifies if the pid being logged shall be obtained from the log socket itself. If so, the TAG part of the message is rewritten. It is recommended to turn this option on, but the default is "off" to keep compatible @@ -181,8 +186,10 @@ $SystemLogSocketAnnotate on <p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] [<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> <p><font size="2">This documentation is part of the -<a href="http://www.rsyslog.com/">rsyslog</a> project.<br> -Copyright © 2008-2011 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and +<a href="http://www.rsyslog.com/">rsyslog</a> +project.<br> +Copyright © 2008-2012 by <a href="http://www.gerhards.net/rainer">Rainer +Gerhards</a> and <a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL version 3 or higher.</font></p> </body></html> diff --git a/doc/manual.html b/doc/manual.html index 565b3758..8f74e806 100644 --- a/doc/manual.html +++ b/doc/manual.html @@ -19,7 +19,7 @@ rsyslog support</a> available directly from the source!</p> <p><b>Please visit the <a href="http://www.rsyslog.com/sponsors">rsyslog sponsor's page</a> to honor the project sponsors or become one yourself!</b> We are very grateful for any help towards the project goals.</p> -<p><b>This documentation is for version 6.3.7 (devel branch) of rsyslog.</b> +<p><b>This documentation is for version 6.3.8 (devel branch) of rsyslog.</b> Visit the <i><a href="http://www.rsyslog.com/status">rsyslog status page</a></i></b> to obtain current version information and project status. </p><p><b>If you like rsyslog, you might @@ -49,8 +49,9 @@ if you do not read the doc, but doing so will definitely improve your experience <li><a href="generic_design.html">backgrounder on generic syslog application design</a></li> <li><a href="modules.html">description of rsyslog modules</a></li> <li><a href="rsyslog_packages.html">rsyslog packages</a></li> -<li><a href="http://cookbook.rsyslog.com">the rsyslog "cookbook"</a> - a set of configurations ready to use</li> </ul> +<p><b>To keep current on rsyslog development, follow +<a href="http://twitter.com/rgerhards">Rainer's twitter feed</a>.</b></p> <p><b>We have some in-depth papers on</b></p> <ul> <li><a href="install.html">installing rsyslog</a></li> @@ -106,14 +107,16 @@ online documentation (most current version only)</a></li> mailing list</a>. If you are interested in the "backstage", you may find <a href="http://www.gerhards.net/rainer">Rainer</a>'s -<a href="http://rgerhards.blogspot.com/">blog</a> an +<a href="http://blog.gerhards.net/">blog</a> an interesting read (filter on syslog and rsyslog tags). +Or meet <a href="http://www.facebook.com/people/Rainer-Gerhards/1349393098">Rainer Gerhards at Facebook</a> +or <a href="https://plus.google.com/112402185904751517878/posts">Google+</a>. If you would like to use rsyslog source code inside your open source project, you can do that without any restriction as long as your license is GPLv3 compatible. If your license is incompatible to GPLv3, you may even be still permitted to use rsyslog source code. However, then you need to look at the way <a href="licensing.html">rsyslog is licensed</a>.</p> <p>Feedback is always welcome, but if you have a support question, please do not mail Rainer directly (<a href="free_support.html">why not?</a>) - use the -<a href="http://lists.adiscon.net/mailman/listinfo/rsyslog">rsyslogmailing list</a> +<a href="http://lists.adiscon.net/mailman/listinfo/rsyslog">rsyslog mailing list</a> or <a href="http://kb.monitorware.com/rsyslog-f40.html">rsyslog formum</a> instead. </body></html> diff --git a/doc/property_replacer.html b/doc/property_replacer.html index 3af56182..5ee1d096 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -13,7 +13,7 @@ the value, e.g. by converting all characters to lower case.</p> <p>Syslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by the property replacer. The full syntax is as follows:</p> -<blockquote><b><code>%propname:fromChar:toChar:options%</code></b></blockquote> +<blockquote><b><code>%propname:fromChar:toChar:options:fieldname%</code></b></blockquote> <h2>Available Properties</h2> <p><b><code>propname</code></b> is the name of the property to access. It is case-insensitive (prior to 3.17.0, they were case-senstive). @@ -179,6 +179,10 @@ than messages generated somewhere. in templates for RFC5424 support, when the character set is know to be Unicode.</td> </tr> +<td><b>$uptime</b></td> +<td>system-uptime in seconds (as reported by operating system). +</td> +</tr> <tr> <td><b>$now</b></td> <td>The current date stamp in the format YYYY-MM-DD</td> @@ -345,7 +349,24 @@ case-insensitive. Currently, the following options are defined: <td><b>json</b></td> <td>encode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for -example US-ASCII LF is replaced by "\n".</td> +example US-ASCII LF is replaced by "\n". +The json option cannot be used together with either jsonf or csv options. +</td> +</tr> +<tr> +<td><b>jsonf</b></td> +<td><i>(available in 6.3.9+)</i> +This signifies that the property should be expressed as a json <b>f</b>ield. +That means not only the property is written, but rather a complete json field in +the format<br> +"fieldname"="value"</b> +where "filedname" is the assigend field name (or the property name if none was assigned) +and value is the end result of property replacer operation. Note that value supports +all property replacer options, like substrings, case converson and the like. +Values are properly json-escaped. However, field names are (currently) not. It is +expected that proper field names are configured. +The jsonf option cannot be used together with either json or csv options. +</td> </tr> <tr> <td valign="top"><b>csv</b></td> @@ -356,6 +377,7 @@ text, you need to define a proper template. An example is this one: <br>$template csvline,"%syslogtag:::csv%,%msg:::csv%" <br>Most importantly, you need to provide the commas between the fields inside the template. +The csv option cannot be used together with either json or jsonf options. <br><i>This feature was introduced in rsyslog 4.1.6.</i> </td> </tr> @@ -461,13 +483,19 @@ Useful for secure pathname generation (with dynafiles). them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together, the last one will override the previous one. For example, using "escape-cc,drop-cc" will use drop-cc and "drop-cc,escape-cc" will use escape-cc mode. +<h2>Fieldname</h2> +<p><i>(available in 6.3.9+)</i> +<p>This field permits to specify a field name for structured-data emitting property replacer +options. It was initially introduced to support the "jsonf" option, for which it provides +the capability to set an alternative field name. If it is not specified, it defaults to +the property name. <h2>Further Links</h2> <ul> <li>Article on "<a href="rsyslog_recording_pri.html">Recording the Priority of Syslog Messages</a>" (describes use of templates to record severity and facility of a message)</li> <li><a href="rsyslog_conf.html">Configuration file -syntax</a>, this is where you actually use the property replacer.</li> +format</a>, this is where you actually use the property replacer.</li> </ul> <p>[<a href="manual.html">manual index</a>] [<a href="rsyslog_conf.html">rsyslog.conf</a>] diff --git a/doc/rsyslog_conf_global.html b/doc/rsyslog_conf_global.html index b254f366..6c20f4c2 100644 --- a/doc/rsyslog_conf_global.html +++ b/doc/rsyslog_conf_global.html @@ -153,15 +153,6 @@ our paper on <a href="multi_ruleset.html">using multiple rule sets in rsyslog</a <li><a href="rsconf1_gssforwardservicename.html">$GssForwardServiceName</a></li> <li><a href="rsconf1_gsslistenservicename.html">$GssListenServiceName</a></li> <li><a href="rsconf1_gssmode.html">$GssMode</a></li> -<li>$HUPisRestart [on/<b>off</b>] - if set to on, a HUP is a full daemon restart. This means any queued messages are discarded (depending -on queue configuration, of course) all modules are unloaded and reloaded. This mode keeps compatible with sysklogd, but is -not recommended for use with rsyslog. To do a full restart, simply stop and start the daemon. The default (since 4.5.1) is "off". -If it is set to "off", a HUP will only close open files. This is a much quicker action and usually -the only one that is needed e.g. for log rotation. <b>Restart-type HUPs (value "on") are depricated</b> -and will go away in rsyslog v5. So it is a good idea to change anything that needs it, now. -Usually that should not be a big issue, as the restart-type HUP can easily be replaced by -something along the lines of "/etc/init.d/rsyslog restart". -</li> <li><a href="rsconf1_includeconfig.html">$IncludeConfig</a></li><li>MainMsgQueueCheckpointInterval <number></li> <li><b>$LocalHostName</b> [name] - this directive permits to overwrite the system hostname with the one specified in the directive. If the directive is given @@ -302,9 +293,22 @@ the value, the less precise the timestamp. <li><b>$Sleep</b> <seconds> - puts the rsyslog main thread to sleep for the specified number of seconds immediately when the directive is encountered. You should have a good reason for using this directive!</li> +<li><b>$LocalHostIPIF</b> <interface name> - (available since 5.9.6) - if provided, the IP of the specified +interface (e.g. "eth0") shall be used as fromhost-ip for locall-originating messages. +If this directive is not given OR the interface cannot be found (or has no IP address), +the default of "127.0.0.1" is used. Note that this directive can be given only +once. Trying to reset will result in an error message and the new value will +be ignored. Please note that modules must have support for obtaining the local +IP address set via this directive. While this is the case for rsyslog-provided +modules, it may not always be the case for contributed plugins. +<br><b>Important:</b> This directive shall be placed <b>right at the top of +rsyslog.conf</b>. Otherwise, if error messages are triggered before this directive +is processed, rsyslog will fix the local host IP to "127.0.0.1", what than can +not be reset. +</li> <li><a href="rsconf1_umask.html">$UMASK</a></li> </ul> -<p><b>Where <size_nbr> is specified above,</b> +<p><b>Where <size_nbr> or integers are specified above,</b> modifiers can be used after the number part. For example, 1k means 1024. Supported are k(ilo), m(ega), g(iga), t(era), p(eta) and e(xa). Lower case letters refer to the traditional binary defintion (e.g. 1m @@ -312,7 +316,7 @@ equals 1,048,576) whereas upper case letters refer to their new 1000-based definition (e.g 1M equals 1,000,000).</p> <p>Numbers may include '.' and ',' for readability. So you can for example specify either "1000" or "1,000" with the same result. -Please note that rsyslogd simply ignores the punctuation. Form it's +Please note that rsyslogd simply ignores the punctuation. From it's point of view, "1,,0.0.,.,0" also has the value 1000. </p> <p>[<a href="manual.html">manual index</a>] diff --git a/doc/v5compatibility.html b/doc/v5compatibility.html index 6d60062f..fc4289c5 100644 --- a/doc/v5compatibility.html +++ b/doc/v5compatibility.html @@ -16,6 +16,12 @@ available. This processing was redundant and had a lot a drawbacks. For details, please see the <a href="v4compatibility.html">rsyslog v4 compatibility notes</a> which elaborate on the reasons and the (few) things you may need to change. +<p>Please note that starting with 5.8.11 HUP will also requery the local hostname. +<h2>Queue on-disk format</h2> +<p>The queue information file format has been changed. When upgrading from v4 to +v5, make sure that the queue is emptied and no on-disk structure present. We did +not go great length in understanding the old format, as there was too little demand +for that (and it being quite some effort if done right). <h2>Queue Worker Thread Shutdown</h2> <p>Previous rsyslog versions had the capability to "run" on zero queue worker if no work was required. This was done to save a very limited number of resources. However, diff --git a/doc/version_naming.html b/doc/version_naming.html index 8c1b9187..3bfa19bb 100644 --- a/doc/version_naming.html +++ b/doc/version_naming.html @@ -105,7 +105,7 @@ versions. It applies to versions 1.0.0 and above. Versions below that are all unstable and have a different naming schema.</p> <p><b>Please note that version naming is currently being changed. There is a -<a href="http://rgerhards.blogspot.com/2007/08/on-rsyslog-versions.html">blog +<a href="http://blog.gerhards.net/2007/08/on-rsyslog-versions.html">blog post about future rsyslog versions</a>.</b></p> <p>The major version is incremented whenever a considerate, major features have been added. This is expected to happen quite infrequently.</p> @@ -127,4 +127,4 @@ expected to happen quite infrequently.</p> <p>In general, the unstable branch carries all new development. Once it concludes with a sufficiently-enhanced, quite stable version, a new major stable version is assigned.</p> -</body></html>
\ No newline at end of file +</body></html> |