From f7debed88d432708109040c7eda8985d4d5f1dc8 Mon Sep 17 00:00:00 2001 From: Radu Gheorghe Date: Tue, 15 Jan 2013 19:30:03 +0200 Subject: - added $!all-json to property replacer - specified that $! can be used with CEE-enhanced syslog (once parsed via mmjsonparse) --- doc/property_replacer.html | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/doc/property_replacer.html b/doc/property_replacer.html index dc09d33c..c7624b2d 100644 --- a/doc/property_replacer.html +++ b/doc/property_replacer.html @@ -228,7 +228,15 @@ for filtering in a generic way) This is the "bridge" to syslog message normalization (via mmnormalize): name is a name defined inside the normalization rule. It has the value selected by the rule -or none if no rule with this field did match. +or none if no rule with this field did match. You can also use these +properties to specify JSON fields from the CEE-enhanced syslog +message, once you parse it with mmjsonparse + + + +$!all-json +This is the JSON part of the CEE-enhanced syslog message, which +can be parsed with mmjsonparse -- cgit v1.2.3 From f2365ae761645d4d828be0b21f19c40c571d656d Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Thu, 24 Jan 2013 08:52:11 +0100 Subject: added omusrmsg changes to v7 compatibility doc Thanks to Tomas Heinrich for pointing out that this was missing. --- doc/v7compatibility.html | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/doc/v7compatibility.html b/doc/v7compatibility.html index 8834cd54..5b885ba9 100644 --- a/doc/v7compatibility.html +++ b/doc/v7compatibility.html @@ -25,6 +25,37 @@ has been implemented. Consequently, situations where the previous behaviour were desired need now to be solved differently. We do not think that this will cause any problems to anyone, especially as in v6 this was announced as a missing feature. +

omusrmsr: using just a username or "*" is deprecated

+

In legacy config format, the asterisk denotes writing the message to all users. +This is usually used for emergency messages and configured like this: +

+*.emerg  *
+
+

Unfortunately, the use of this single character conflicts with other uses, for +example with the multiplication operator. While rsyslog up to versions v7.4 preserves the meaning of +asterisk as an action, it is deprecated and will probably be removed in future versions. +Consequently, a warning message is emitted. To make this warning go away, the action must +be explicitly given, as follows: +

+*.emerg  :omusrmsg:*
+
+

The same holds true for user names. For example +

+*.emerg  john
+
+

at a minimum should be rewritten as +

+*.emerg  :omusrmsg:john
+
+

Of course, for even more clarity the new RainerScript style of action can +also be used: +

+*.emerg  action(type="omusrmsg" users="john")
+
+

In Rainer's blog, there is more +background +information on why omusrmsg needed to be changed available. +

omruleset and discard (~) action are deprecated

Both continue to work, but have been replaced by better alternatives.

The discard action (tilde character) has been replaced by the "stop" @@ -54,7 +85,7 @@ In practice, we do NOT expect that.

This documentation is part of the rsyslog project.
-Copyright © 2011-2012 by Rainer Gerhards and +Copyright © 2011-2013 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 2 or higher.

-- cgit v1.2.3