build/0000775000175000017500000000000013035122652010636 5ustar rgerrgerbuild/.buildinfo0000664000175000017500000000034613035122652012615 0ustar rgerrger# Sphinx build info version 1 # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. config: 0728028647e09551e87ae06ba7beeaeb tags: 645f666f9bcd5a90fca523b33c5a78b7 build/.doctrees/0000775000175000017500000000000013035122644012525 5ustar rgerrgerbuild/.doctrees/community.doctree0000664000175000017500000003635513035122640016130 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X!syslog device configuration guideqX rsyslog wikiqXrainerqXwhy not?q Xcommunity resourcesq NXrsyslog is licensedq X rsyslog faqq Xblogq Xgoogle+qXrsyslog video tutorialsqXrsyslog mailing listqXrainer gerhards at facebookqX rsyslog forumqXrsyslog configuration examplesqX9rsyslog discussion forum - use this for technical supportqXdeutsches rsyslog forumquUsubstitution_defsq}qUparse_messagesq]qcdocutils.nodes system_message q)q}q(U rawsourceqUUparentqcdocutils.nodes section q)q }q!(hUhhUsourceq"X0/home/rger/proj/rsyslog-doc/source/community.rstq#Utagnameq$Usectionq%U attributesq&}q'(Udupnamesq(]Uclassesq)]Ubackrefsq*]Uidsq+]q,Ucommunity-resourcesq-aUnamesq.]q/h auUlineq0KUdocumentq1hUchildrenq2]q3(cdocutils.nodes title q4)q5}q6(hXCommunity Resourcesq7hh h"h#h$Utitleq8h&}q9(h(]h)]h*]h+]h.]uh0Kh1hh2]q:cdocutils.nodes Text q;XCommunity Resourcesq(hh7hh5ubaubcdocutils.nodes paragraph q?)q@}qA(hX3You can also browse the following online resources:qBhh h"h#h$U paragraphqCh&}qD(h(]h)]h*]h+]h.]uh0Kh1hh2]qEh;X3You can also browse the following online resources:qFqG}qH(hhBhh@ubaubcdocutils.nodes bullet_list qI)qJ}qK(hUhh h"h#h$U bullet_listqLh&}qM(UbulletqNX-h+]h*]h(]h)]h.]uh0Kh1hh2]qO(cdocutils.nodes list_item qP)qQ}qR(hXthe `rsyslog wiki `_, a community resource which includes `rsyslog configuration examples `_hhJh"h#h$U list_itemqSh&}qT(h(]h)]h*]h+]h.]uh0Nh1hh2]qUh?)qV}qW(hXthe `rsyslog wiki `_, a community resource which includes `rsyslog configuration examples `_hhQh"h#h$hCh&}qX(h(]h)]h*]h+]h.]uh0Kh2]qY(h;Xthe qZq[}q\(hXthe hhVubcdocutils.nodes reference q])q^}q_(hX*`rsyslog wiki `_h&}q`(UnameX rsyslog wikiUrefuriqaXhttp://wiki.rsyslog.com/qbh+]h*]h(]h)]h.]uhhVh2]qch;X rsyslog wikiqdqe}qf(hUhh^ubah$U referenceqgubcdocutils.nodes target qh)qi}qj(hX U referencedqkKhhVh$Utargetqlh&}qm(Urefurihbh+]qnU rsyslog-wikiqoah*]h(]h)]h.]qphauh2]ubh;X', a community resource which includes qqqr}qs(hX', a community resource which includes hhVubh])qt}qu(hX[`rsyslog configuration examples `_h&}qv(UnameXrsyslog configuration exampleshaX7http://wiki.rsyslog.com/index.php/Configuration_Samplesqwh+]h*]h(]h)]h.]uhhVh2]qxh;Xrsyslog configuration examplesqyqz}q{(hUhhtubah$hgubhh)q|}q}(hX: hkKhhVh$hlh&}q~(Urefurihwh+]qUrsyslog-configuration-examplesqah*]h(]h)]h.]qhauh2]ubeubaubhP)q}q(hXi`rsyslog discussion forum - use this for technical support `_hhJh"h#h$hSh&}q(h(]h)]h*]h+]h.]uh0Nh1hh2]qh?)q}q(hXi`rsyslog discussion forum - use this for technical support `_qhhh"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0K h2]q(h])q}q(hhh&}q(UnameX9rsyslog discussion forum - use this for technical supporthaX*http://kb.monitorware.com/rsyslog-f40.htmlqh+]h*]h(]h)]h.]uhhh2]qh;X9rsyslog discussion forum - use this for technical supportqq}q(hUhhubah$hgubhh)q}q(hX- hkKhhh$hlh&}q(Urefurihh+]qU7rsyslog-discussion-forum-use-this-for-technical-supportqah*]h(]h)]h.]qhauh2]ubeubaubhP)q}q(hX@`rsyslog video tutorials `_qhhJh"h#h$hSh&}q(h(]h)]h*]h+]h.]uh0Nh1hh2]qh?)q}q(hhhhh"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0K h2]q(h])q}q(hhh&}q(UnameXrsyslog video tutorialshaX#http://www.rsyslog.com/Topic8.phtmlqh+]h*]h(]h)]h.]uhhh2]qh;Xrsyslog video tutorialsqq}q(hUhhubah$hgubhh)q}q(hX& hkKhhh$hlh&}q(Urefurihh+]qUrsyslog-video-tutorialsqah*]h(]h)]h.]qhauh2]ubeubaubhP)q}q(hX4`rsyslog FAQ `_qhhJh"h#h$hSh&}q(h(]h)]h*]h+]h.]uh0Nh1hh2]qh?)q}q(hhhhh"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0K h2]q(h])q}q(hhh&}q(UnameX rsyslog FAQhaX#http://www.rsyslog.com/Topic3.phtmlqh+]h*]h(]h)]h.]uhhh2]qh;X rsyslog FAQqq}q(hUhhubah$hgubhh)q}q(hX& hkKhhh$hlh&}q(Urefurihh+]qU rsyslog-faqqah*]h(]h)]h.]qh auh2]ubeubaubhP)q}q(hXh`syslog device configuration guide `_ (off-site)hhJh"h#h$hSh&}q(h(]h)]h*]h+]h.]uh0Nh1hh2]qh?)q}q(hXh`syslog device configuration guide `_ (off-site)hhh"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0K h2]q(h])q}q(hX]`syslog device configuration guide `_h&}q(UnameX!syslog device configuration guidehaX6http://www.monitorware.com/en/syslog-enabled-products/qh+]h*]h(]h)]h.]uhhh2]qh;X!syslog device configuration guideqԅq}q(hUhhubah$hgubhh)q}q(hX9 hkKhhh$hlh&}q(Urefurihh+]qU!syslog-device-configuration-guideqah*]h(]h)]h.]qhauh2]ubh;X (off-site)q݅q}q(hX (off-site)hhubeubaubhP)q}q(hXc`deutsches rsyslog forum `_ (forum in German language) hhJh"h#h$hSh&}q(h(]h)]h*]h+]h.]uh0Nh1hh2]qh?)q}q(hXb`deutsches rsyslog forum `_ (forum in German language)hhh"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0Kh2]q(h])q}q(hXG`deutsches rsyslog forum `_h&}q(UnameXdeutsches rsyslog forumhaX*http://kb.monitorware.com/rsyslog-f49.htmlqh+]h*]h(]h)]h.]uhhh2]qh;Xdeutsches rsyslog forumq텁q}q(hUhhubah$hgubhh)q}q(hX- hkKhhh$hlh&}q(Urefurihh+]qUdeutsches-rsyslog-forumqah*]h(]h)]h.]qhauh2]ubh;X (forum in German language)qq}q(hX (forum in German language)hhubeubaubeubh?)q}q(hX,And don't forget about the `rsyslog mailing list `_. If you are interested in the "backstage", you may find `Rainer `_'s `blog `_ an interesting read (filter on syslog and rsyslog tags). Or meet `Rainer Gerhards at Facebook `_ or `Google+ `_. If you would like to use rsyslog source code inside your open source project, you can do that without any restriction as long as your license is GPLv3 compatible. If your license is incompatible to GPLv3, you may even be still permitted to use rsyslog source code. However, then you need to look at the way `rsyslog is licensed `_.hh h"h#h$hCh&}q(h(]h)]h*]h+]h.]uh0Kh1hh2]q(h;XAnd don't forget about the qq}q(hXAnd don't forget about the hhubh])r}r(hXK`rsyslog mailing list `_h&}r(UnameXrsyslog mailing listhaX1http://lists.adiscon.net/mailman/listinfo/rsyslogrh+]h*]h(]h)]h.]uhhh2]rh;Xrsyslog mailing listrr}r(hUhjubah$hgubhh)r}r (hX4 hkKhhh$hlh&}r (Urefurijh+]r Ursyslog-mailing-listr ah*]h(]h)]h.]r hauh2]ubh;X9. If you are interested in the "backstage", you may find rr}r(hX9. If you are interested in the "backstage", you may find hhubh])r}r(hX*`Rainer `_h&}r(UnameXRainerhaXhttp://www.gerhards.net/rainerrh+]h*]h(]h)]h.]uhhh2]rh;XRainerrr}r(hUhjubah$hgubhh)r}r(hX! hkKhhh$hlh&}r(Urefurijh+]rUrainerrah*]h(]h)]h.]rhauh2]ubh;X's rr }r!(hX's hhubh])r"}r#(hX#`blog `_h&}r$(Unameh haXhttp://blog.gerhards.net/r%h+]h*]h(]h)]h.]uhhh2]r&h;Xblogr'r(}r)(hUhj"ubah$hgubhh)r*}r+(hX hkKhhh$hlh&}r,(Urefurij%h+]r-Ublogr.ah*]h(]h)]h.]r/h auh2]ubh;XB an interesting read (filter on syslog and rsyslog tags). Or meet r0r1}r2(hXB an interesting read (filter on syslog and rsyslog tags). Or meet hhubh])r3}r4(hXZ`Rainer Gerhards at Facebook `_h&}r5(UnameXRainer Gerhards at FacebookhaX9http://www.facebook.com/people/Rainer-Gerhards/1349393098r6h+]h*]h(]h)]h.]uhhh2]r7h;XRainer Gerhards at Facebookr8r9}r:(hUhj3ubah$hgubhh)r;}r<(hX< hkKhhh$hlh&}r=(Urefurij6h+]r>Urainer-gerhards-at-facebookr?ah*]h(]h)]h.]r@hauh2]ubh;X or rArB}rC(hX or hhubh])rD}rE(hX@`Google+ `_h&}rF(UnameXGoogle+haX3https://plus.google.com/112402185904751517878/postsrGh+]h*]h(]h)]h.]uhhh2]rHh;XGoogle+rIrJ}rK(hUhjDubah$hgubhh)rL}rM(hX6 hkKhhh$hlh&}rN(UrefurijGh+]rOUgooglerPah*]h(]h)]h.]rQhauh2]ubh;X5. If you would like to use rsyslog source code inside your open source project, you can do that without any restriction as long as your license is GPLv3 compatible. If your license is incompatible to GPLv3, you may even be still permitted to use rsyslog source code. However, then you need to look at the way rRrS}rT(hX5. If you would like to use rsyslog source code inside your open source project, you can do that without any restriction as long as your license is GPLv3 compatible. If your license is incompatible to GPLv3, you may even be still permitted to use rsyslog source code. However, then you need to look at the way hhubh])rU}rV(hX'`rsyslog is licensed `_h&}rW(UnameXrsyslog is licensedhaXlicensing.htmlrXh+]h*]h(]h)]h.]uhhh2]rYh;Xrsyslog is licensedrZr[}r\(hUhjUubah$hgubhh)r]}r^(hX hkKhhh$hlh&}r_(UrefurijXh+]r`Ursyslog-is-licensedraah*]h(]h)]h.]rbh auh2]ubh;X.rc}rd(hX.hhubeubh?)re}rf(hX$Feedback is always welcome, but if you have a support question, please do not mail Rainer directly (`why not? `_) - use the `rsyslog mailing list `_ or `rsyslog forum `_ instead.hh h"h#h$hCh&}rg(h(]h)]h*]h+]h.]uh0K"h1hh2]rh(h;XdFeedback is always welcome, but if you have a support question, please do not mail Rainer directly (rirj}rk(hXdFeedback is always welcome, but if you have a support question, please do not mail Rainer directly (hjeubh])rl}rm(hX`why not? `_h&}rn(UnameXwhy not?haXfree_support.htmlroh+]h*]h(]h)]h.]uhjeh2]rph;Xwhy not?rqrr}rs(hUhjlubah$hgubhh)rt}ru(hX hkKhjeh$hlh&}rv(Urefurijoh+]rwUwhy-notrxah*]h(]h)]h.]ryh auh2]ubh;X ) - use the rzr{}r|(hX ) - use the hjeubh])r}}r~(hXK`rsyslog mailing list `_h&}r(UnameXrsyslog mailing listhaX1http://lists.adiscon.net/mailman/listinfo/rsyslogrh+]h*]h(]h)]h.]uhjeh2]rh;Xrsyslog mailing listrr}r(hUhj}ubah$hgubhh)r}r(hX4 hkKhjeh$hlh&}r(Urefurijh+]rUid1rah*]h(]rXrsyslog mailing listrah)]h.]uh2]ubh;X or rr}r(hX or hjeubh])r}r(hX=`rsyslog forum `_h&}r(UnameX rsyslog forumhaX*http://kb.monitorware.com/rsyslog-f40.htmlrh+]h*]h(]h)]h.]uhjeh2]rh;X rsyslog forumrr}r(hUhjubah$hgubhh)r}r(hX- hkKhjeh$hlh&}r(Urefurijh+]rU rsyslog-forumrah*]h(]h)]h.]rhauh2]ubh;X instead.rr}r(hX instead.hjeubeubeubh"h#h$Usystem_messagerh&}r(h(]UlevelKh+]h*]rjaUsourceh#h)]h.]UlineKUtypeUINFOruh0K&h1hh2]rh?)r}r(hX7Duplicate explicit target name: "rsyslog mailing list".h&}r(h(]h)]h*]h+]h.]uhhh2]rh;X7Duplicate explicit target name: "rsyslog mailing list".rr}r(hUhjubah$hCubaubaUcurrent_sourcerNU decorationrNUautofootnote_startrKUnameidsr}r(hhhhohjh jxh h-h jah hh j.hjPhhhj hj?hjhhhhhhuh2]rh ahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh1hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixr Uidr Udoctitle_xformr Ustrip_elements_with_classesr NU _config_filesr ]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(jPjLhhhohijaj]h-h hh|hhhhj.j*j jjjj?j;jxjtjjhhhhjjuUsubstitution_namesr}rh$h1h&}r(h(]h+]h*]Usourceh#h)]h.]uU footnotesr]rUrefidsr}rub.build/.doctrees/how2help.doctree0000664000175000017500000004017013035122643015625 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xwww.rsyslog.comqX5purchasing professional support or add-on developmentqXadisconqXhow you can helpq NXmonitorware productsq Xdrop rainer a noteq Xsyslog configuration databaseq uUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUwww-rsyslog-comqhU5purchasing-professional-support-or-add-on-developmentqhUadisconqh Uhow-you-can-helpqh Umonitorware-productsqh Udrop-rainer-a-noteqh Usyslog-configuration-databasequUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$X//home/rger/proj/rsyslog-doc/source/how2help.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0h auUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"XHow you can Helpq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;XHow you can Helpq(h"h7h#h5ubaubcdocutils.nodes paragraph q?)q@}qA(h"X **You like rsyslog and would like to lend us a helping hand?** This page tells you how easy it is to help a little bit. You can contribute to the project even with a single mouse click! If you could pick a single item from the wish list, that would be awfully helpful!h#h h$h%h&U paragraphqBh(}qC(h*]h+]h,]h-]h/]uh1Kh2hh]qD(cdocutils.nodes strong qE)qF}qG(h"X>**You like rsyslog and would like to lend us a helping hand?**h(}qH(h*]h+]h,]h-]h/]uh#h@h]qIh;X:You like rsyslog and would like to lend us a helping hand?qJqK}qL(h"Uh#hFubah&UstrongqMubh;X This page tells you how easy it is to help a little bit. You can contribute to the project even with a single mouse click! If you could pick a single item from the wish list, that would be awfully helpful!qNqO}qP(h"X This page tells you how easy it is to help a little bit. You can contribute to the project even with a single mouse click! If you could pick a single item from the wish list, that would be awfully helpful!h#h@ubeubh?)qQ}qR(h"XThis is our wish list:qSh#h h$h%h&hBh(}qT(h*]h+]h,]h-]h/]uh1K h2hh]qUh;XThis is our wish list:qVqW}qX(h"hSh#hQubaubcdocutils.nodes bullet_list qY)qZ}q[(h"Uh#h h$h%h&U bullet_listq\h(}q](Ubulletq^X-h-]h,]h*]h+]h/]uh1K h2hh]q_(cdocutils.nodes list_item q`)qa}qb(h"Xlet others know how great rsyslog is - spread word about rsyslog in forums and newsgroups - place a link to `www.rsyslog.com `_ from your home page h#hZh$Nh&U list_itemqch(}qd(h*]h+]h,]h-]h/]uh1Nh2hh]qe(h?)qf}qg(h"X$let others know how great rsyslog isqhh#hah$h%h&hBh(}qi(h*]h+]h,]h-]h/]uh1K h]qjh;X$let others know how great rsyslog isqkql}qm(h"hhh#hfubaubhY)qn}qo(h"Uh(}qp(h^X-h-]h,]h*]h+]h/]uh#hah]qq(h`)qr}qs(h"X2spread word about rsyslog in forums and newsgroupsqth(}qu(h*]h+]h,]h-]h/]uh#hnh]qvh?)qw}qx(h"hth#hrh$h%h&hBh(}qy(h*]h+]h,]h-]h/]uh1K h]qzh;X2spread word about rsyslog in forums and newsgroupsq{q|}q}(h"hth#hwubaubah&hcubh`)q~}q(h"XPplace a link to `www.rsyslog.com `_ from your home page h(}q(h*]h+]h,]h-]h/]uh#hnh]qh?)q}q(h"XOplace a link to `www.rsyslog.com `_ from your home pageh#h~h$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]q(h;Xplace a link to qq}q(h"Xplace a link to h#hubcdocutils.nodes reference q)q}q(h"X+`www.rsyslog.com `_h(}q(UnamehUrefuriqXhttp://www.rsyslog.comqh-]h,]h*]h+]h/]uh#hh]qh;Xwww.rsyslog.comqq}q(h"Uh#hubah&U referencequbcdocutils.nodes target q)q}q(h"X U referencedqKh#hh&Utargetqh(}q(Urefurihh-]qhah,]h*]h+]h/]qhauh]ubh;X from your home pageqq}q(h"X from your home pageh#hubeubah&hcubeh&h\ubeubh`)q}q(h"Xlet us know about rsyslog - we are eager for feedback - tell us what you like and what you not like - so that we can include that into development - tell us what you use rsyslog for - especially if you have high traffic volume or an otherwise "uncommon" deployment. We are looking for case studies and experience how rsyslog performs in unusual scenarios. - allow us to post your thoughts and experiences as a "user story" on the web site (so far, none are there ;)) h#hZh$Nh&hch(}q(h*]h+]h,]h-]h/]uh1Nh2hh]q(h?)q}q(h"X5let us know about rsyslog - we are eager for feedbackqh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X5let us know about rsyslog - we are eager for feedbackqq}q(h"hh#hubaubhY)q}q(h"Uh(}q(h^X-h-]h,]h*]h+]h/]uh#hh]q(h`)q}q(h"XZtell us what you like and what you not like - so that we can include that into developmenth(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"XZtell us what you like and what you not like - so that we can include that into developmentqh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;XZtell us what you like and what you not like - so that we can include that into developmentqq}q(h"hh#hubaubah&hcubh`)q}q(h"Xtell us what you use rsyslog for - especially if you have high traffic volume or an otherwise "uncommon" deployment. We are looking for case studies and experience how rsyslog performs in unusual scenarios.h(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"Xtell us what you use rsyslog for - especially if you have high traffic volume or an otherwise "uncommon" deployment. We are looking for case studies and experience how rsyslog performs in unusual scenarios.qh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;Xtell us what you use rsyslog for - especially if you have high traffic volume or an otherwise "uncommon" deployment. We are looking for case studies and experience how rsyslog performs in unusual scenarios.qąq}q(h"hh#hubaubah&hcubh`)q}q(h"Xmallow us to post your thoughts and experiences as a "user story" on the web site (so far, none are there ;)) h(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"Xlallow us to post your thoughts and experiences as a "user story" on the web site (so far, none are there ;))qh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;Xlallow us to post your thoughts and experiences as a "user story" on the web site (so far, none are there ;))qЅq}q(h"hh#hubaubah&hcubeh&h\ubeubh`)q}q(h"Xfif you know how to create packages (rpm, deb, ...) - we would very much appreciate your help with package creation. We know that it is important to have good binary packages for a product to spread widely. Yet, we do not have the knowledge to do it all ourselves. `Drop Rainer a note `_\ if you could help us out. h#hZh$Nh&hch(}q(h*]h+]h,]h-]h/]uh1Nh2hh]q(h?)q}q(h"X2if you know how to create packages (rpm, deb, ...)qh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X2if you know how to create packages (rpm, deb, ...)q܅q}q(h"hh#hubaubhY)q}q(h"Uh(}q(h^X-h-]h,]h*]h+]h/]uh#hh]qh`)q}q(h"X#we would very much appreciate your help with package creation. We know that it is important to have good binary packages for a product to spread widely. Yet, we do not have the knowledge to do it all ourselves. `Drop Rainer a note `_\ if you could help us out. h(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"X"we would very much appreciate your help with package creation. We know that it is important to have good binary packages for a product to spread widely. Yet, we do not have the knowledge to do it all ourselves. `Drop Rainer a note `_\ if you could help us out.h#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]q(h;Xwe would very much appreciate your help with package creation. We know that it is important to have good binary packages for a product to spread widely. Yet, we do not have the knowledge to do it all ourselves. q녁q}q(h"Xwe would very much appreciate your help with package creation. We know that it is important to have good binary packages for a product to spread widely. Yet, we do not have the knowledge to do it all ourselves. h#hubh)q}q(h"X4`Drop Rainer a note `_h(}q(UnameXDrop Rainer a notehXmailto:rgerhards@adiscon.comqh-]h,]h*]h+]h/]uh#hh]qh;XDrop Rainer a noteqq}q(h"Uh#hubah&hubh)q}q(h"X hKh#hh&hh(}q(Urefurihh-]qhah,]h*]h+]h/]qh auh]ubh;Xif you could help us out.qq}q(h"X\ if you could help us out.h#hubeubah&hcubah&h\ubeubh`)q}q(h"Xif you have configured a device for sending syslog data, and that device is not in our `syslog configuration database `_, you might want to tell us how to configure it.h#hZh$h%h&hch(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"Xif you have configured a device for sending syslog data, and that device is not in our `syslog configuration database `_, you might want to tell us how to configure it.h#hh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K$h]r(h;XWif you have configured a device for sending syslog data, and that device is not in our rr}r(h"XWif you have configured a device for sending syslog data, and that device is not in our h#jubh)r }r (h"XY`syslog configuration database `_h(}r (UnameXsyslog configuration databasehX6http://www.monitorware.com/en/syslog-enabled-products/r h-]h,]h*]h+]h/]uh#jh]r h;Xsyslog configuration databaserr}r(h"Uh#j ubah&hubh)r}r(h"X9 hKh#jh&hh(}r(Urefurij h-]rhah,]h*]h+]h/]rh auh]ubh;X0, you might want to tell us how to configure it.rr}r(h"X0, you might want to tell us how to configure it.h#jubeubaubh`)r}r(h"Xif you are a corporate user - you might consider `Adiscon `_'s commercial `MonitorWare products `_ for Windows, e.g. to deliver Windows Event Log data to rsyslogd (sales of the commercial products funds the open source development - and they also work very well). - you might be interested in `purchasing professional support or add-on development `_ for rsyslog h#hZh$Nh&hch(}r(h*]h+]h,]h-]h/]uh1Nh2hh]r(h?)r}r(h"Xif you are a corporate userrh#jh$h%h&hBh(}r (h*]h+]h,]h-]h/]uh1K(h]r!h;Xif you are a corporate userr"r#}r$(h"jh#jubaubhY)r%}r&(h"Uh(}r'(h^X-h-]h,]h*]h+]h/]uh#jh]r((h`)r)}r*(h"Xyou might consider `Adiscon `_'s commercial `MonitorWare products `_ for Windows, e.g. to deliver Windows Event Log data to rsyslogd (sales of the commercial products funds the open source development - and they also work very well).h(}r+(h*]h+]h,]h-]h/]uh#j%h]r,h?)r-}r.(h"Xyou might consider `Adiscon `_'s commercial `MonitorWare products `_ for Windows, e.g. to deliver Windows Event Log data to rsyslogd (sales of the commercial products funds the open source development - and they also work very well).h#j)h$h%h&hBh(}r/(h*]h+]h,]h-]h/]uh1K*h]r0(h;Xyou might consider r1r2}r3(h"Xyou might consider h#j-ubh)r4}r5(h"X#`Adiscon `_h(}r6(UnameXAdisconhXhttp://www.adiscon.comr7h-]h,]h*]h+]h/]uh#j-h]r8h;XAdisconr9r:}r;(h"Uh#j4ubah&hubh)r<}r=(h"X hKh#j-h&hh(}r>(Urefurij7h-]r?hah,]h*]h+]h/]r@hauh]ubh;X's commercial rArB}rC(h"X's commercial h#j-ubh)rD}rE(h"X5`MonitorWare products `_h(}rF(UnameXMonitorWare productshXhttp://www.monitorware.com/rGh-]h,]h*]h+]h/]uh#j-h]rHh;XMonitorWare productsrIrJ}rK(h"Uh#jDubah&hubh)rL}rM(h"X hKh#j-h&hh(}rN(UrefurijGh-]rOhah,]h*]h+]h/]rPh auh]ubh;X for Windows, e.g. to deliver Windows Event Log data to rsyslogd (sales of the commercial products funds the open source development - and they also work very well).rQrR}rS(h"X for Windows, e.g. to deliver Windows Event Log data to rsyslogd (sales of the commercial products funds the open source development - and they also work very well).h#j-ubeubah&hcubh`)rT}rU(h"Xyou might be interested in `purchasing professional support or add-on development `_ for rsyslog h(}rV(h*]h+]h,]h-]h/]uh#j%h]rWh?)rX}rY(h"Xyou might be interested in `purchasing professional support or add-on development `_ for rsyslogh#jTh$h%h&hBh(}rZ(h*]h+]h,]h-]h/]uh1K/h]r[(h;Xyou might be interested in r\r]}r^(h"Xyou might be interested in h#jXubh)r_}r`(h"Xp`purchasing professional support or add-on development `_h(}ra(UnameX5purchasing professional support or add-on developmenthX5http://www.adiscon.com/Common/en/Products/techsup.phprbh-]h,]h*]h+]h/]uh#jXh]rch;X5purchasing professional support or add-on developmentrdre}rf(h"Uh#j_ubah&hubh)rg}rh(h"X8 hKh#jXh&hh(}ri(Urefurijbh-]rjhah,]h*]h+]h/]rkhauh]ubh;X for rsyslogrlrm}rn(h"X for rsyslogh#jXubeubah&hcubeh&h\ubeubeubh?)ro}rp(h"XQ**We appreciate your help very much.** A big thank you for anything you might do!h#h h$h%h&hBh(}rq(h*]h+]h,]h-]h/]uh1K4h2hh]rr(hE)rs}rt(h"X&**We appreciate your help very much.**h(}ru(h*]h+]h,]h-]h/]uh#joh]rvh;X"We appreciate your help very much.rwrx}ry(h"Uh#jsubah&hMubh;X+ A big thank you for anything you might do!rzr{}r|(h"X+ A big thank you for anything you might do!h#joubeubeubah"UU transformerr}NU footnote_refsr~}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh2hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh%Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhjghjhjLhh hhhj<uUsubstitution_namesr}rh&h2h(}r(h*]h-]h,]Usourceh%h+]h/]uU footnotesr]rUrefidsr}rub.build/.doctrees/free_support.doctree0000664000175000017500000002677113035122643016625 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X rsyslog forumqXrsyslog professional supportqXtroubleshooting guideqXrsyslog mailing listq Xfree services for rsyslogq NuUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU rsyslog-forumqhUrsyslog-professional-supportqhUtroubleshooting-guideqh Ursyslog-mailing-listqh Ufree-services-for-rsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq X3/home/rger/proj/rsyslog-doc/source/free_support.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,h auUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hXFree Services for Rsyslogq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7XFree Services for Rsyslogq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hX=*A personal word from Rainer, the lead developer of rsyslog:*q>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qAcdocutils.nodes emphasis qB)qC}qD(hh>h$}qE(h&]h']h(]h)]h+]uhh`_ **to get started.**hhh h!h"h?h$}qM(h&]h']h(]h)]h+]uh-Kh.hh]qN(cdocutils.nodes strong qO)qP}qQ(hXO**The rsyslog community provides ample free support resources. Please see our**h$}qR(h&]h']h(]h)]h+]uhhKh]qSh7XKThe rsyslog community provides ample free support resources. Please see ourqTqU}qV(hUhhPubah"UstrongqWubh7X qX}qY(hX hhKubcdocutils.nodes reference qZ)q[}q\(hX5`troubleshooting guide `_h$}q](UnameXtroubleshooting guideUrefuriq^Xtroubleshooting/index.htmlq_h)]h(]h&]h']h+]uhhKh]q`h7Xtroubleshooting guideqaqb}qc(hUhh[ubah"U referenceqdubcdocutils.nodes target qe)qf}qg(hX U referencedqhKhhKh"Utargetqih$}qj(Urefurih_h)]qkhah(]h&]h']h+]qlhauh]ubh7X qm}qn(hX hhKubhO)qo}qp(hX**to get started.**h$}qq(h&]h']h(]h)]h+]uhhKh]qrh7Xto get started.qsqt}qu(hUhhoubah"hWubeubh;)qv}qw(hXEvery now and then I receive private mail with support questions. I appreciate any feedback, but I must limit my resources so that I can help driver a great logging system forward.qxhhh h!h"h?h$}qy(h&]h']h(]h)]h+]uh-K h.hh]qzh7XEvery now and then I receive private mail with support questions. I appreciate any feedback, but I must limit my resources so that I can help driver a great logging system forward.q{q|}q}(hhxhhvubaubh;)q~}q(hXTo do so, I have decided not to reply to unsolicited support emails, at least not with a solution (but rather a link to this page ;)). I hope this does not offend you. The reason is quite simple: If I do personal support, you gain some advantage without contributing something back. Think about it: if you ask your question on the public forum or mailing list, others with the same problem can help you and, most importantly, even years later find your post (and the answer) and get the problem solved. So by solving your issue in public, you help create a great community resource and also help your fellow users find solutions quicker. In the long term, this also contributes to improved code because the more questions users can find solutions to themselves, the fewer I need to look at.qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K h.hh]qh7XTo do so, I have decided not to reply to unsolicited support emails, at least not with a solution (but rather a link to this page ;)). I hope this does not offend you. The reason is quite simple: If I do personal support, you gain some advantage without contributing something back. Think about it: if you ask your question on the public forum or mailing list, others with the same problem can help you and, most importantly, even years later find your post (and the answer) and get the problem solved. So by solving your issue in public, you help create a great community resource and also help your fellow users find solutions quicker. In the long term, this also contributes to improved code because the more questions users can find solutions to themselves, the fewer I need to look at.qq}q(hhhh~ubaubh;)q}q(hX<But it becomes even better: the rsyslog community is much broader than Rainer ;) - there are other helpful members hanging around the public places. They often answer questions, so that I do not need to look at them (btw, once again a big "thank you", folks!). And, more important, those folks have a different background than me. So they often either know better how to solve your problem (e.g. because it is distro-specific) or they know how to better phrase it (after all, I like abstract terms and concepts ;)). So you do yourself a favor if you use the public places.qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7X<But it becomes even better: the rsyslog community is much broader than Rainer ;) - there are other helpful members hanging around the public places. They often answer questions, so that I do not need to look at them (btw, once again a big "thank you", folks!). And, more important, those folks have a different background than me. So they often either know better how to solve your problem (e.g. because it is distro-specific) or they know how to better phrase it (after all, I like abstract terms and concepts ;)). So you do yourself a favor if you use the public places.qq}q(hhhhubaubh;)q}q(hX7An excellent place to go to is the `rsyslog forum `_ inside the knowledge base (which in itself is a great place to visit!). For those used to mailing lists, the `rsyslog mailing list `_ also offers excellent advise.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K#h.hh]q(h7X#An excellent place to go to is the qq}q(hX#An excellent place to go to is the hhubhZ)q}q(hX=`rsyslog forum `_h$}q(UnameX rsyslog forumh^X*http://kb.monitorware.com/rsyslog-f40.htmlqh)]h(]h&]h']h+]uhhh]qh7X rsyslog forumqq}q(hUhhubah"hdubhe)q}q(hX- hhKhhh"hih$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7Xn inside the knowledge base (which in itself is a great place to visit!). For those used to mailing lists, the qq}q(hXn inside the knowledge base (which in itself is a great place to visit!). For those used to mailing lists, the hhubhZ)q}q(hXK`rsyslog mailing list `_h$}q(UnameXrsyslog mailing listh^X1http://lists.adiscon.net/mailman/listinfo/rsyslogqh)]h(]h&]h']h+]uhhh]qh7Xrsyslog mailing listqq}q(hUhhubah"hdubhe)q}q(hX4 hhKhhh"hih$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X also offers excellent advise.qq}q(hX also offers excellent advise.hhubeubh;)q}q(hXb**Don't like to post your question in a public place?** Well, then you should consider purchasing `rsyslog professional support `_. The fees are very low and help fund the project. If you use rsyslog seriously inside a corporate environment, there is no excuse for not getting one of the support packages ;)hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K*h.hh]q(hO)q}q(hX7**Don't like to post your question in a public place?**h$}q(h&]h']h(]h)]h+]uhhh]qh7X3Don't like to post your question in a public place?qq}q(hUhhubah"hWubh7X+ Well, then you should consider purchasing qq}q(hX+ Well, then you should consider purchasing hhubhZ)q}q(hXO`rsyslog professional support `_h$}q(UnameXrsyslog professional supporth^X-http://www.rsyslog.com/professional-services/qh)]h(]h&]h']h+]uhhh]qh7Xrsyslog professional supportqȅq}q(hUhhubah"hdubhe)q}q(hX0 hhKhhh"hih$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X. The fees are very low and help fund the project. If you use rsyslog seriously inside a corporate environment, there is no excuse for not getting one of the support packages ;)qЅq}q(hX. The fees are very low and help fund the project. If you use rsyslog seriously inside a corporate environment, there is no excuse for not getting one of the support packages ;)hhubeubh;)q}q(hXOf course, things are different when I ask you to mail me privately. I'll usually do that when I think it makes sense, for example when we exchange debug logs.qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K1h.hh]qh7XOf course, things are different when I ask you to mail me privately. I'll usually do that when I think it makes sense, for example when we exchange debug logs.q؅q}q(hhhhubaubh;)q}q(hXI hope you now understand the free support options and the reasoning for them. I hope I haven't offended you with my words - this is not my intension. I just needed to make clear why there are some limits on my responsiveness. Happy logging!qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K5h.hh]qh7XI hope you now understand the free support options and the reasoning for them. I hope I haven't offended you with my words - this is not my intension. I just needed to make clear why there are some limits on my responsiveness. Happy logging!qq}q(hhhhubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh.hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenr U datestampr NU report_levelr KU _destinationr NU halt_levelr KU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvr NUdump_pseudo_xmlr!NUexpose_internalsr"NUsectsubtitle_xformr#U source_linkr$NUrfc_referencesr%NUoutput_encodingr&Uutf-8r'U source_urlr(NUinput_encodingr)U utf-8-sigr*U_disable_configr+NU id_prefixr,UU tab_widthr-KUerror_encodingr.UUTF-8r/U_sourcer0h!Ugettext_compactr1U generatorr2NUdump_internalsr3NU smart_quotesr4U pep_base_urlr5U https://www.python.org/dev/peps/r6Usyntax_highlightr7Ulongr8Uinput_encoding_error_handlerr9jUauto_id_prefixr:Uidr;Udoctitle_xformr<Ustrip_elements_with_classesr=NU _config_filesr>]r?Ufile_insertion_enabledr@U raw_enabledrAKU dump_settingsrBNubUsymbol_footnote_startrCKUidsrD}rE(hhfhhhhhhhhuUsubstitution_namesrF}rGh"h.h$}rH(h&]h)]h(]Usourceh!h']h+]uU footnotesrI]rJUrefidsrK}rLub.build/.doctrees/rainerscript/0000775000175000017500000000000013035122644015232 5ustar rgerrgerbuild/.doctrees/rainerscript/constant_strings.doctree0000664000175000017500000001031013035122643022175 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X&rainerscript string escape online toolqXconstant stringsqNuUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hU&rainerscript-string-escape-online-toolqhUconstant-stringsquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXD/home/rger/proj/rsyslog-doc/source/rainerscript/constant_strings.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hXConstant Stringsq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1XConstant Stringsq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hXString constants are necessary in many places: comparisons, configuration parameter values and function arguments, to name a few important ones.q8hhhhhU paragraphq9h}q:(h ]h!]h"]h#]h%]uh'Kh(hh]q;h1XString constants are necessary in many places: comparisons, configuration parameter values and function arguments, to name a few important ones.q(hh8hh6ubaubh5)q?}q@(hXIn constant strings, special characters are escape by prepending a backslash in front of them -- just in the same way this is done in the C programming language or PHP.qAhhhhhh9h}qB(h ]h!]h"]h#]h%]uh'Kh(hh]qCh1XIn constant strings, special characters are escape by prepending a backslash in front of them -- just in the same way this is done in the C programming language or PHP.qDqE}qF(hhAhh?ubaubh5)qG}qH(hXIf in doubt how to properly escape, use the `RainerScript String Escape Online Tool `_.hhhhhh9h}qI(h ]h!]h"]h#]h%]uh'K h(hh]qJ(h1X,If in doubt how to properly escape, use the qKqL}qM(hX,If in doubt how to properly escape, use the hhGubcdocutils.nodes reference qN)qO}qP(hXh`RainerScript String Escape Online Tool `_h}qQ(UnameX&RainerScript String Escape Online ToolUrefuriqRX<http://www.rsyslog.com/rainerscript-constant-string-escaper/qSh#]h"]h ]h!]h%]uhhGh]qTh1X&RainerScript String Escape Online ToolqUqV}qW(hUhhOubahU referenceqXubcdocutils.nodes target qY)qZ}q[(hX? U referencedq\KhhGhUtargetq]h}q^(UrefurihSh#]q_hah"]h ]h!]h%]q`hauh]ubh1X.qa}qb(hX.hhGubeubeubahUU transformerqcNU footnote_refsqd}qeUrefnamesqf}qgUsymbol_footnotesqh]qiUautofootnote_refsqj]qkUsymbol_footnote_refsql]qmU citationsqn]qoh(hU current_lineqpNUtransform_messagesqq]qrUreporterqsNUid_startqtKU autofootnotesqu]qvU citation_refsqw}qxUindirect_targetsqy]qzUsettingsq{(cdocutils.frontend Values q|oq}}q~(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh.NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}q(hhZhhuUsubstitution_namesq}qhh(h}q(h ]h#]h"]Usourcehh!]h%]uU footnotesq]qUrefidsq}qub.build/.doctrees/rainerscript/functions.doctree0000664000175000017500000005641413035122644020623 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X cstr(expr)qNX functionsqNX cnum(expr)qNX getenv(str)q NX strlen(str)q NX tolower(str)q NXfield(str, delim, matchnbr)q NX#wrap(str, wrapper_str, escaper_str)q NXprifilt(constant)qNX'lookup(table_name_litteral_string, key)qNX)dyn_inc(bucket_name_litteral_string, str)qNXre_match(expr, re)qNX/re_extract(expr, re, match, submatch, no-found)qNX-replace(str, substr_to_replace, replace_with)qNXwrap(str, wrapper_str)qNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU cstr-exprqhU functionsqhU cnum-exprq h U getenv-strq!h U strlen-strq"h U tolower-strq#h Ufield-str-delim-matchnbrq$h U wrap-str-wrapper-str-escaper-strq%hUprifilt-constantq&hU%lookup-table-name-litteral-string-keyq'hU'dyn-inc-bucket-name-litteral-string-strq(hUre-match-expr-req)hU*re-extract-expr-re-match-submatch-no-foundq*hU*replace-str-substr-to-replace-replace-withq+hUwrap-str-wrapper-strq,uUchildrenq-]q.cdocutils.nodes section q/)q0}q1(U rawsourceq2UUparentq3hUsourceq4X=/home/rger/proj/rsyslog-doc/source/rainerscript/functions.rstq5Utagnameq6Usectionq7U attributesq8}q9(Udupnamesq:]Uclassesq;]Ubackrefsq<]Uidsq=]q>haUnamesq?]q@hauUlineqAKUdocumentqBhh-]qC(cdocutils.nodes title qD)qE}qF(h2X FunctionsqGh3h0h4h5h6UtitleqHh8}qI(h:]h;]h<]h=]h?]uhAKhBhh-]qJcdocutils.nodes Text qKX FunctionsqLqM}qN(h2hGh3hEubaubcdocutils.nodes paragraph qO)qP}qQ(h2XARainerScript supports a currently quite limited set of functions:qRh3h0h4h5h6U paragraphqSh8}qT(h:]h;]h<]h=]h?]uhAKhBhh-]qUhKXARainerScript supports a currently quite limited set of functions:qVqW}qX(h2hRh3hPubaubh/)qY}qZ(h2Uh3h0h4h5h6h7h8}q[(h:]h;]h<]h=]q\h!ah?]q]h auhAKhBhh-]q^(hD)q_}q`(h2X getenv(str)qah3hYh4h5h6hHh8}qb(h:]h;]h<]h=]h?]uhAKhBhh-]qchKX getenv(str)qdqe}qf(h2hah3h_ubaubcdocutils.nodes block_quote qg)qh}qi(h2Uh3hYh4h5h6U block_quoteqjh8}qk(h:]h;]h<]h=]h?]uhANhBhh-]ql(hO)qm}qn(h2X|like the OS call, returns the value of the environment variable, if it exists. Returns an empty string if it does not exist.qoh3hhh4h5h6hSh8}qp(h:]h;]h<]h=]h?]uhAK h-]qqhKX|like the OS call, returns the value of the environment variable, if it exists. Returns an empty string if it does not exist.qrqs}qt(h2hoh3hmubaubhO)qu}qv(h2X_The following example can be used to build a dynamic filter based on some environment variable:qwh3hhh4h5h6hSh8}qx(h:]h;]h<]h=]h?]uhAK h-]qyhKX_The following example can be used to build a dynamic filter based on some environment variable:qzq{}q|(h2hwh3huubaubeubcdocutils.nodes literal_block q})q~}q(h2X;if $msg contains getenv('TRIGGERVAR') then /path/to/errfileh3hYh4h5h6U literal_blockqh8}q(U xml:spaceqUpreserveqh=]h<]h:]h;]h?]uhAKhBhh-]qhKX;if $msg contains getenv('TRIGGERVAR') then /path/to/errfileqq}q(h2Uh3h~ubaubeubh/)q}q(h2Uh3h0h4h5h6h7h8}q(h:]h;]h<]h=]qh"ah?]qh auhAKhBhh-]q(hD)q}q(h2X strlen(str)qh3hh4h5h6hHh8}q(h:]h;]h<]h=]h?]uhAKhBhh-]qhKX strlen(str)qq}q(h2hh3hubaubhg)q}q(h2Uh3hh4h5h6hjh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2X)returns the length of the provided stringqh3hh4h5h6hSh8}q(h:]h;]h<]h=]h?]uhAKh-]qhKX)returns the length of the provided stringqq}q(h2hh3hubaubaubeubh/)q}q(h2Uh3h0h4h5h6h7h8}q(h:]h;]h<]h=]qh#ah?]qh auhAKhBhh-]q(hD)q}q(h2X tolower(str)qh3hh4h5h6hHh8}q(h:]h;]h<]h=]h?]uhAKhBhh-]qhKX tolower(str)qq}q(h2hh3hubaubhg)q}q(h2Uh3hh4h5h6hjh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2X+converts the provided string into lowercaseqh3hh4h5h6hSh8}q(h:]h;]h<]h=]h?]uhAKh-]qhKX+converts the provided string into lowercaseqq}q(h2hh3hubaubaubeubh/)q}q(h2Uh3h0h4h5h6h7h8}q(h:]h;]h<]h=]qhah?]qhauhAK hBhh-]q(hD)q}q(h2X cstr(expr)qh3hh4h5h6hHh8}q(h:]h;]h<]h=]h?]uhAK hBhh-]qhKX cstr(expr)qDžq}q(h2hh3hubaubhg)q}q(h2Uh3hh4h5h6hjh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2Xconverts expr to a string valueqh3hh4h5h6hSh8}q(h:]h;]h<]h=]h?]uhAK"h-]qhKXconverts expr to a string valueqӅq}q(h2hh3hubaubaubeubh/)q}q(h2Uh3h0h4h5h6h7h8}q(h:]h;]h<]h=]qh ah?]qhauhAK%hBhh-]q(hD)q}q(h2X cnum(expr)qh3hh4h5h6hHh8}q(h:]h;]h<]h=]h?]uhAK%hBhh-]qhKX cnum(expr)qᅁq}q(h2hh3hubaubhg)q}q(h2Uh3hh4h5h6hjh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2Xwconverts expr to a number (integer) Note: if the expression does not contain a numerical value, behaviour is undefined.qh3hh4h5h6hSh8}q(h:]h;]h<]h=]h?]uhAK'h-]qhKXwconverts expr to a number (integer) Note: if the expression does not contain a numerical value, behaviour is undefined.q텁q}q(h2hh3hubaubaubeubh/)q}q(h2Uh3h0h4h5h6h7h8}q(h:]h;]h<]h=]qh,ah?]qhauhAK,hBhh-]q(hD)q}q(h2Xwrap(str, wrapper_str)qh3hh4h5h6hHh8}q(h:]h;]h<]h=]h?]uhAK,hBhh-]qhKXwrap(str, wrapper_str)qq}q(h2hh3hubaubhg)q}q(h2Uh3hh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]rhO)r}r(h2X-returns the str wrapped with wrapper_str. Eg.rh3hh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAK.h-]rhKX-returns the str wrapped with wrapper_str. Eg.rr}r (h2jh3jubaubaubh})r }r (h2Xwrap("foo bar", "##")h3hh4h5h6hh8}r (hhh=]h<]h:]h;]h?]uhAK2hBhh-]r hKXwrap("foo bar", "##")rr}r(h2Uh3j ubaubhO)r}r(h2Xproducesrh3hh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAK4hBhh-]rhKXproducesrr}r(h2jh3jubaubh})r}r(h2X "##foo bar##"h3hh4h5h6hh8}r(hhh=]h<]h:]h;]h?]uhAK8hBhh-]rhKX "##foo bar##"rr}r(h2Uh3jubaubeubh/)r }r!(h2Uh3h0h4h5h6h7h8}r"(h:]h;]h<]h=]r#h%ah?]r$h auhAK;hBhh-]r%(hD)r&}r'(h2X#wrap(str, wrapper_str, escaper_str)r(h3j h4h5h6hHh8}r)(h:]h;]h<]h=]h?]uhAK;hBhh-]r*hKX#wrap(str, wrapper_str, escaper_str)r+r,}r-(h2j(h3j&ubaubhg)r.}r/(h2Uh3j h4h5h6hjh8}r0(h:]h;]h<]h=]h?]uhANhBhh-]r1hO)r2}r3(h2Xreturns the str wrapped with wrapper_str. But additionally, any instances of wrapper_str appearing in str would be replaced by the escaper_str. Eg.r4h3j.h4h5h6hSh8}r5(h:]h;]h<]h=]h?]uhAK=h-]r6hKXreturns the str wrapped with wrapper_str. But additionally, any instances of wrapper_str appearing in str would be replaced by the escaper_str. Eg.r7r8}r9(h2j4h3j2ubaubaubh})r:}r;(h2Xwrap("foo'bar", "'", "_")h3j h4h5h6hh8}r<(hhh=]h<]h:]h;]h?]uhAKChBhh-]r=hKXwrap("foo'bar", "'", "_")r>r?}r@(h2Uh3j:ubaubhO)rA}rB(h2XproducesrCh3j h4h5h6hSh8}rD(h:]h;]h<]h=]h?]uhAKEhBhh-]rEhKXproducesrFrG}rH(h2jCh3jAubaubh})rI}rJ(h2X "'foo_bar'"h3j h4h5h6hh8}rK(hhh=]h<]h:]h;]h?]uhAKIhBhh-]rLhKX "'foo_bar'"rMrN}rO(h2Uh3jIubaubeubh/)rP}rQ(h2Uh3h0h4h5h6h7h8}rR(h:]h;]h<]h=]rSh+ah?]rThauhAKLhBhh-]rU(hD)rV}rW(h2X-replace(str, substr_to_replace, replace_with)rXh3jPh4h5h6hHh8}rY(h:]h;]h<]h=]h?]uhAKLhBhh-]rZhKX-replace(str, substr_to_replace, replace_with)r[r\}r](h2jXh3jVubaubhg)r^}r_(h2Uh3jPh4h5h6hjh8}r`(h:]h;]h<]h=]h?]uhANhBhh-]rahO)rb}rc(h2XXreturns new string with all instances of substr_to_replace replaced by replace_with. Eg.rdh3j^h4h5h6hSh8}re(h:]h;]h<]h=]h?]uhAKNh-]rfhKXXreturns new string with all instances of substr_to_replace replaced by replace_with. Eg.rgrh}ri(h2jdh3jbubaubaubh})rj}rk(h2X#replace("foo bar baz", " b", ", B")h3jPh4h5h6hh8}rl(hhh=]h<]h:]h;]h?]uhAKShBhh-]rmhKX#replace("foo bar baz", " b", ", B")rnro}rp(h2Uh3jjubaubhO)rq}rr(h2Xproducesrsh3jPh4h5h6hSh8}rt(h:]h;]h<]h=]h?]uhAKUhBhh-]ruhKXproducesrvrw}rx(h2jsh3jqubaubh})ry}rz(h2X"foo, Bar, Baz".h3jPh4h5h6hh8}r{(hhh=]h<]h:]h;]h?]uhAKYhBhh-]r|hKX"foo, Bar, Baz".r}r~}r(h2Uh3jyubaubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh)ah?]rhauhAK\hBhh-]r(hD)r}r(h2Xre\_match(expr, re)rh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAK\hBhh-]rhKXre_match(expr, re)rr}r(h2Xre\_match(expr, re)rh3jubaubhg)r}r(h2Uh3jh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]rhO)r}r(h2X;returns 1, if expr matches re, 0 otherwise. Uses POSIX ERE.rh3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAK^h-]rhKX;returns 1, if expr matches re, 0 otherwise. Uses POSIX ERE.rr}r(h2jh3jubaubaubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh*ah?]rhauhAKahBhh-]r(hD)r}r(h2X0re\_extract(expr, re, match, submatch, no-found)rh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAKahBhh-]rhKX/re_extract(expr, re, match, submatch, no-found)rr}r(h2X0re\_extract(expr, re, match, submatch, no-found)rh3jubaubhg)r}r(h2Uh3jh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]rhO)r}r(h2Xextracts data from a string (property) via a regular expression match. POSIX ERE regular expressions are used. The variable "match" contains the number of the match to use. This permits to pick up more than the first expression match. Submatch is the submatch to match (max 50 supported). The "no-found" parameter specifies which string is to be returned in case when the regular expression is not found. Note that match and submatch start with zero. It currently is not possible to extract more than one submatch with a single call.rh3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKch-]rhKXextracts data from a string (property) via a regular expression match. POSIX ERE regular expressions are used. The variable "match" contains the number of the match to use. This permits to pick up more than the first expression match. Submatch is the submatch to match (max 50 supported). The "no-found" parameter specifies which string is to be returned in case when the regular expression is not found. Note that match and submatch start with zero. It currently is not possible to extract more than one submatch with a single call.rr}r(h2jh3jubaubaubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh$ah?]rh auhAKmhBhh-]r(hD)r}r(h2Xfield(str, delim, matchnbr)rh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAKmhBhh-]rhKXfield(str, delim, matchnbr)rr}r(h2jh3jubaubhg)r}r(h2Uh3jh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]r(hO)r}r(h2Xwreturns a field-based substring. str is the string to search, delim is the delimiter and matchnbr is the match to search for (the first match starts at 1). This works similar as the field based property-replacer option. Versions prior to 7.3.7 only support a single character as delimiter character. Starting with version 7.3.7, a full string can be used as delimiter. If a single character is being used as delimiter, delim is the numerical ascii value of the field delimiter character (so that non-printable characters can by specified). If a string is used as delmiter, a multi-character string (e.g. "#011") is to be specified.rh3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKoh-]rhKXwreturns a field-based substring. str is the string to search, delim is the delimiter and matchnbr is the match to search for (the first match starts at 1). This works similar as the field based property-replacer option. Versions prior to 7.3.7 only support a single character as delimiter character. Starting with version 7.3.7, a full string can be used as delimiter. If a single character is being used as delimiter, delim is the numerical ascii value of the field delimiter character (so that non-printable characters can by specified). If a string is used as delmiter, a multi-character string (e.g. "#011") is to be specified.rr}r(h2jh3jubaubhO)r}r(h2XNote that when a single character is specified as string ``field($msg, ",", 3)`` a string-based extraction is done, which is more performance intense than the equivalent single-character ``field($msg, 44 ,3)`` extraction. Eg.h3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKzh-]r(hKX9Note that when a single character is specified as string rr}r(h2X9Note that when a single character is specified as string h3jubcdocutils.nodes literal r)r}r(h2X``field($msg, ",", 3)``h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKXfield($msg, ",", 3)rr}r(h2Uh3jubah6UliteralrubhKXk a string-based extraction is done, which is more performance intense than the equivalent single-character rr}r(h2Xk a string-based extraction is done, which is more performance intense than the equivalent single-character h3jubj)r}r(h2X``field($msg, 44 ,3)``h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKXfield($msg, 44 ,3)rr}r(h2Uh3jubah6jubhKX extraction. Eg.rr}r(h2X extraction. Eg.h3jubeubeubh})r}r(h2Xset $!usr!field = field($msg, 32, 3); -- the third field, delimited by space set $!usr!field = field($msg, "#011", 2); -- the second field, delmited by "#011"h3jh4h5h6hh8}r(hhh=]h<]h:]h;]h?]uhAKhBhh-]rhKXset $!usr!field = field($msg, 32, 3); -- the third field, delimited by space set $!usr!field = field($msg, "#011", 2); -- the second field, delmited by "#011"rr}r(h2Uh3jubaubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh&ah?]rhauhAKhBhh-]r(hD)r}r(h2Xprifilt(constant)rh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAKhBhh-]rhKXprifilt(constant)rr}r(h2jh3jubaubhg)r}r(h2Uh3jh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]rhO)r}r(h2Xmimics a traditional PRI-based filter (like "\*.\*" or "mail.info"). The traditional filter string must be given as a **constant string**. Dynamic string evaluation is not permitted (for performance reasons).h3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKh-]r (hKXtmimics a traditional PRI-based filter (like "*.*" or "mail.info"). The traditional filter string must be given as a r r }r (h2Xvmimics a traditional PRI-based filter (like "\*.\*" or "mail.info"). The traditional filter string must be given as a h3jubcdocutils.nodes strong r )r}r(h2X**constant string**h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKXconstant stringrr}r(h2Uh3jubah6UstrongrubhKXG. Dynamic string evaluation is not permitted (for performance reasons).rr}r(h2XG. Dynamic string evaluation is not permitted (for performance reasons).h3jubeubaubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh(ah?]rhauhAKhBhh-]r(hD)r}r (h2X)dyn_inc(bucket_name_litteral_string, str)r!h3jh4h5h6hHh8}r"(h:]h;]h<]h=]h?]uhAKhBhh-]r#hKX)dyn_inc(bucket_name_litteral_string, str)r$r%}r&(h2j!h3jubaubhg)r'}r((h2Uh3jh4h5h6hjh8}r)(h:]h;]h<]h=]h?]uhANhBhh-]r*(hO)r+}r,(h2XIncrements counter identified by ``str`` in dyn-stats bucket identified by ``bucket_name_litteral_string``. Returns 0 when increment is successful, any other return value indicates increment failed.h3j'h4h5h6hSh8}r-(h:]h;]h<]h=]h?]uhAKh-]r.(hKX!Increments counter identified by r/r0}r1(h2X!Increments counter identified by h3j+ubj)r2}r3(h2X``str``h8}r4(h:]h;]h<]h=]h?]uh3j+h-]r5hKXstrr6r7}r8(h2Uh3j2ubah6jubhKX# in dyn-stats bucket identified by r9r:}r;(h2X# in dyn-stats bucket identified by h3j+ubj)r<}r=(h2X``bucket_name_litteral_string``h8}r>(h:]h;]h<]h=]h?]uh3j+h-]r?hKXbucket_name_litteral_stringr@rA}rB(h2Uh3j<ubah6jubhKX\. Returns 0 when increment is successful, any other return value indicates increment failed.rCrD}rE(h2X\. Returns 0 when increment is successful, any other return value indicates increment failed.h3j+ubeubhO)rF}rG(h2X3Counters updated here are reported by **impstats**.h3j'h4h5h6hSh8}rH(h:]h;]h<]h=]h?]uhAKh-]rI(hKX&Counters updated here are reported by rJrK}rL(h2X&Counters updated here are reported by h3jFubj )rM}rN(h2X **impstats**h8}rO(h:]h;]h<]h=]h?]uh3jFh-]rPhKXimpstatsrQrR}rS(h2Uh3jMubah6jubhKX.rT}rU(h2X.h3jFubeubhO)rV}rW(h2XHExcept for special circumstances (such as memory allocation failing etc), increment may fail due to metric-name cardinality being under-estimated. Bucket is configured to support a maximum cardinality (to prevent abuse) and it rejects increment-operation if it encounters a new(previously unseen) metric-name(``str``) when full.h3j'h4h5h6hSh8}rX(h:]h;]h<]h=]h?]uhAKh-]rY(hKX5Except for special circumstances (such as memory allocation failing etc), increment may fail due to metric-name cardinality being under-estimated. Bucket is configured to support a maximum cardinality (to prevent abuse) and it rejects increment-operation if it encounters a new(previously unseen) metric-name(rZr[}r\(h2X5Except for special circumstances (such as memory allocation failing etc), increment may fail due to metric-name cardinality being under-estimated. Bucket is configured to support a maximum cardinality (to prevent abuse) and it rejects increment-operation if it encounters a new(previously unseen) metric-name(h3jVubj)r]}r^(h2X``str``h8}r_(h:]h;]h<]h=]h?]uh3jVh-]r`hKXstrrarb}rc(h2Uh3j]ubah6jubhKX ) when full.rdre}rf(h2X ) when full.h3jVubeubhO)rg}rh(h2XL**Read more about it here** :doc:`Dynamic Stats<../configuration/dyn_stats>`h3j'h4h5h6hSh8}ri(h:]h;]h<]h=]h?]uhAKh-]rj(j )rk}rl(h2X**Read more about it here**h8}rm(h:]h;]h<]h=]h?]uh3jgh-]rnhKXRead more about it hererorp}rq(h2Uh3jkubah6jubhKX rr}rs(h2X h3jgubcsphinx.addnodes pending_xref rt)ru}rv(h2X0:doc:`Dynamic Stats<../configuration/dyn_stats>`rwh3jgh4h5h6U pending_xrefrxh8}ry(UreftypeXdocrzUrefwarnr{U reftargetr|X../configuration/dyn_statsU refdomainUh=]h<]U refexplicith:]h;]h?]Urefdocr}Xrainerscript/functionsr~uhAKh-]rj)r}r(h2jwh8}r(h:]h;]r(Uxrefrjzeh<]h=]h?]uh3juh-]rhKX Dynamic Statsrr}r(h2Uh3jubah6jubaubeubeubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh'ah?]rhauhAKhBhh-]r(hD)r}r(h2X'lookup(table_name_litteral_string, key)rh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAKhBhh-]rhKX'lookup(table_name_litteral_string, key)rr}r(h2jh3jubaubhg)r}r(h2Uh3jh4h5h6hjh8}r(h:]h;]h<]h=]h?]uhANhBhh-]r(hO)r}r(h2XLookup tables are a powerful construct to obtain *class* information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).h3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKh-]r(hKX1Lookup tables are a powerful construct to obtain rr}r(h2X1Lookup tables are a powerful construct to obtain h3jubcdocutils.nodes emphasis r)r}r(h2X*class*h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKXclassrr}r(h2Uh3jubah6UemphasisrubhKX information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).rr}r(h2X information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).h3jubeubhO)r}r(h2XThe idea is to use a message properties (or derivatives of it) as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in.rh3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKh-]rhKXThe idea is to use a message properties (or derivatives of it) as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in.rr}r(h2jh3jubaubhO)r}r(h2XP**Read more about it here** :doc:`Lookup Tables<../configuration/lookup_tables>`rh3jh4h5h6hSh8}r(h:]h;]h<]h=]h?]uhAKh-]r(j )r}r(h2X**Read more about it here**h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKXRead more about it hererr}r(h2Uh3jubah6jubhKX r}r(h2X h3jubjt)r}r(h2X4:doc:`Lookup Tables<../configuration/lookup_tables>`rh3jh4h5h6jxh8}r(UreftypeXdocrj{j|X../configuration/lookup_tablesU refdomainUh=]h<]U refexplicith:]h;]h?]j}j~uhAKh-]rj)r}r(h2jh8}r(h:]h;]r(jjeh<]h=]h?]uh3jh-]rhKX Lookup Tablesrr}r(h2Uh3jubah6jubaubeubeubeubeubah2UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhBhU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhHNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04dr Uexit_status_levelr KUconfigr NUstrict_visitorr NUcloak_email_addressesr Utrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh5Ugettext_compactr U generatorr!NUdump_internalsr"NU smart_quotesr#U pep_base_urlr$U https://www.python.org/dev/peps/r%Usyntax_highlightr&Ulongr'Uinput_encoding_error_handlerr(jUauto_id_prefixr)Uidr*Udoctitle_xformr+Ustrip_elements_with_classesr,NU _config_filesr-]r.Ufile_insertion_enabledr/U raw_enabledr0KU dump_settingsr1NubUsymbol_footnote_startr2KUidsr3}r4(hh0h*jhhh&jh!hYh%j h(jh'jh$jh"hh)jh+jPh hh,hh#huUsubstitution_namesr5}r6h6hBh8}r7(h:]h=]h<]Usourceh5h;]h?]uU footnotesr8]r9Urefidsr:}r;ub.build/.doctrees/rainerscript/control_structures.doctree0000664000175000017500000003634213035122644022574 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xcontrol structuresqNXif/else-if/elseqNXcontinueqNXcallq NXforeachq NXifq NuUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUcontrol-structuresqhUif-else-if-elseqhUcontinueqh Ucallqh Uforeachqh UifquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceq UUparentq!hUsourceq"XF/home/rger/proj/rsyslog-doc/source/rainerscript/control_structures.rstq#Utagnameq$Usectionq%U attributesq&}q'(Udupnamesq(]Uclassesq)]Ubackrefsq*]Uidsq+]q,haUnamesq-]q.hauUlineq/KUdocumentq0hh]q1(cdocutils.nodes title q2)q3}q4(h XControl Structuresq5h!hh"h#h$Utitleq6h&}q7(h(]h)]h*]h+]h-]uh/Kh0hh]q8cdocutils.nodes Text q9XControl Structuresq:q;}q<(h h5h!h3ubaubcdocutils.nodes paragraph q=)q>}q?(h XtControl structures in RainerScript are similar in semantics to a lot of other mainstream languages such as C, Java, Javascript, Ruby, Bash etc. So this section assumes the reader is familier with semantics of such structures, and goes about describing RainerScript implementation in usage-example form rather than by formal-definition and detailed semantics documentation.q@h!hh"h#h$U paragraphqAh&}qB(h(]h)]h*]h+]h-]uh/Kh0hh]qCh9XtControl structures in RainerScript are similar in semantics to a lot of other mainstream languages such as C, Java, Javascript, Ruby, Bash etc. So this section assumes the reader is familier with semantics of such structures, and goes about describing RainerScript implementation in usage-example form rather than by formal-definition and detailed semantics documentation.qDqE}qF(h h@h!h>ubaubh=)qG}qH(h X3RainerScript supports following control structures:qIh!hh"h#h$hAh&}qJ(h(]h)]h*]h+]h-]uh/K h0hh]qKh9X3RainerScript supports following control structures:qLqM}qN(h hIh!hGubaubh)qO}qP(h Uh!hh"h#h$h%h&}qQ(h(]h)]h*]h+]qRhah-]qSh auh/Kh0hh]qT(h2)qU}qV(h XifqWh!hOh"h#h$h6h&}qX(h(]h)]h*]h+]h-]uh/Kh0hh]qYh9XifqZq[}q\(h hWh!hUubaubcdocutils.nodes literal_block q])q^}q_(h Xif ($msg contains "important") then { if ( $. foo != "" ) then set $.foo = $.bar & $.baz; action(type="omfile" file="/var/log/important.log" template="outfmt") }h!hOh"h#h$U literal_blockq`h&}qa(U xml:spaceqbUpreserveqch+]h*]h(]h)]h-]uh/Kh0hh]qdh9Xif ($msg contains "important") then { if ( $. foo != "" ) then set $.foo = $.bar & $.baz; action(type="omfile" file="/var/log/important.log" template="outfmt") }qeqf}qg(h Uh!h^ubaubeubh)qh}qi(h Uh!hh"h#h$h%h&}qj(h(]h)]h*]h+]qkhah-]qlhauh/Kh0hh]qm(h2)qn}qo(h Xif/else-if/elseqph!hhh"h#h$h6h&}qq(h(]h)]h*]h+]h-]uh/Kh0hh]qrh9Xif/else-if/elseqsqt}qu(h hph!hnubaubh])qv}qw(h Xnif ($msg contains "important") then { set $.foo = $.bar & $.baz; action(type="omfile" file="/var/log/important.log" template="outfmt") } else if ($msg startswith "slow-query:") then { action(type="omfile" file="/var/log/slow_log.log" template="outfmt") } else { set $.foo = $.quux; action(type="omfile" file="/var/log/general.log" template="outfmt") }h!hhh"h#h$h`h&}qx(hbhch+]h*]h(]h)]h-]uh/Kh0hh]qyh9Xnif ($msg contains "important") then { set $.foo = $.bar & $.baz; action(type="omfile" file="/var/log/important.log" template="outfmt") } else if ($msg startswith "slow-query:") then { action(type="omfile" file="/var/log/slow_log.log" template="outfmt") } else { set $.foo = $.quux; action(type="omfile" file="/var/log/general.log" template="outfmt") }qzq{}q|(h Uh!hvubaubeubh)q}}q~(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qh auh/K&h0hh]q(h2)q}q(h Xforeachqh!h}h"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/K&h0hh]qh9Xforeachqq}q(h hh!hubaubh=)q}q(h XForeach can iterate both arrays and objects. As opposed to array-iteration (which is ordered), object-iteration accesses key-values in arbitrary order (is unordered).qh!h}h"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K'h0hh]qh9XForeach can iterate both arrays and objects. As opposed to array-iteration (which is ordered), object-iteration accesses key-values in arbitrary order (is unordered).qq}q(h hh!hubaubh=)q}q(h X!For the foreach invocation below:qh!h}h"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K*h0hh]qh9X!For the foreach invocation below:qq}q(h hh!hubaubh])q}q(h X+foreach ($.i in $.collection) do { ... }h!h}h"h#h$h`h&}q(hbhch+]h*]h(]h)]h-]uh/K.h0hh]qh9X+foreach ($.i in $.collection) do { ... }qq}q(h Uh!hubaubh=)q}q(h XSay ``$.collection`` holds an array ``[1, "2", {"a": "b"}, 4]``, value of ``$.i`` across invocations would be ``1``, ``"2"``, ``{"a" : "b"}`` and ``4``.h!h}h"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K2h0hh]q(h9XSay qq}q(h XSay h!hubcdocutils.nodes literal q)q}q(h X``$.collection``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X $.collectionqq}q(h Uh!hubah$Uliteralqubh9X holds an array qq}q(h X holds an array h!hubh)q}q(h X``[1, "2", {"a": "b"}, 4]``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X[1, "2", {"a": "b"}, 4]qq}q(h Uh!hubah$hubh9X , value of qq}q(h X , value of h!hubh)q}q(h X``$.i``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X$.iqÅq}q(h Uh!hubah$hubh9X across invocations would be qƅq}q(h X across invocations would be h!hubh)q}q(h X``1``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X1q}q(h Uh!hubah$hubh9X, qυq}q(h X, h!hubh)q}q(h X``"2"``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X"2"qօq}q(h Uh!hubah$hubh9X, qمq}q(h X, h!hubh)q}q(h X``{"a" : "b"}``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X {"a" : "b"}qq}q(h Uh!hubah$hubh9X and qㅁq}q(h X and h!hubh)q}q(h X``4``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X4q}q(h Uh!hubah$hubh9X.q}q(h X.h!hubeubh=)q}q(h XWhen ``$.collection`` holds an object ``{"a": "b", "c" : [1, 2, 3], "d" : {"foo": "bar"}}``, value of ``$.i`` across invocations would be ``{"key" : "a", "value" : "b"}``, ``{"key" : "c", "value" : [1, 2, 3]}`` and ``{"key" : "d", "value" : {"foo" : "bar"}}`` (not necessarily in the that order). In this case key and value will need to be accessed as ``$.i!key`` and ``$.i!value`` respectively.h!h}h"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K5h0hh]q(h9XWhen qq}q(h XWhen h!hubh)q}q(h X``$.collection``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X $.collectionqq}q(h Uh!hubah$hubh9X holds an object qq}q(h X holds an object h!hubh)q}r(h X5``{"a": "b", "c" : [1, 2, 3], "d" : {"foo": "bar"}}``h&}r(h(]h)]h*]h+]h-]uh!hh]rh9X1{"a": "b", "c" : [1, 2, 3], "d" : {"foo": "bar"}}rr}r(h Uh!hubah$hubh9X , value of rr}r(h X , value of h!hubh)r }r (h X``$.i``h&}r (h(]h)]h*]h+]h-]uh!hh]r h9X$.ir r}r(h Uh!j ubah$hubh9X across invocations would be rr}r(h X across invocations would be h!hubh)r}r(h X ``{"key" : "a", "value" : "b"}``h&}r(h(]h)]h*]h+]h-]uh!hh]rh9X{"key" : "a", "value" : "b"}rr}r(h Uh!jubah$hubh9X, rr}r(h X, h!hubh)r}r(h X&``{"key" : "c", "value" : [1, 2, 3]}``h&}r(h(]h)]h*]h+]h-]uh!hh]r h9X"{"key" : "c", "value" : [1, 2, 3]}r!r"}r#(h Uh!jubah$hubh9X and r$r%}r&(h X and h!hubh)r'}r((h X,``{"key" : "d", "value" : {"foo" : "bar"}}``h&}r)(h(]h)]h*]h+]h-]uh!hh]r*h9X({"key" : "d", "value" : {"foo" : "bar"}}r+r,}r-(h Uh!j'ubah$hubh9X] (not necessarily in the that order). In this case key and value will need to be accessed as r.r/}r0(h X] (not necessarily in the that order). In this case key and value will need to be accessed as h!hubh)r1}r2(h X ``$.i!key``h&}r3(h(]h)]h*]h+]h-]uh!hh]r4h9X$.i!keyr5r6}r7(h Uh!j1ubah$hubh9X and r8r9}r:(h X and h!hubh)r;}r<(h X ``$.i!value``h&}r=(h(]h)]h*]h+]h-]uh!hh]r>h9X $.i!valuer?r@}rA(h Uh!j;ubah$hubh9X respectively.rBrC}rD(h X respectively.h!hubeubh=)rE}rF(h X1Here is an example of a nested foreach statement:rGh!h}h"h#h$hAh&}rH(h(]h)]h*]h+]h-]uh/K9h0hh]rIh9X1Here is an example of a nested foreach statement:rJrK}rL(h jGh!jEubaubh])rM}rN(h Xoforeach ($.quux in $!foo) do { action(type="omfile" file="./rsyslog.out.log" template="quux") foreach ($.corge in $.quux!bar) do { reset $.grault = $.corge; action(type="omfile" file="./rsyslog.out.log" template="grault") if ($.garply != "") then set $.garply = $.garply & ", "; reset $.garply = $.garply & $.grault!baz; } }h!h}h"h#h$h`h&}rO(hbhch+]h*]h(]h)]h-]uh/K=h0hh]rPh9Xoforeach ($.quux in $!foo) do { action(type="omfile" file="./rsyslog.out.log" template="quux") foreach ($.corge in $.quux!bar) do { reset $.grault = $.corge; action(type="omfile" file="./rsyslog.out.log" template="grault") if ($.garply != "") then set $.garply = $.garply & ", "; reset $.garply = $.garply & $.grault!baz; } }rQrR}rS(h Uh!jMubaubh=)rT}rU(h X1Please note that asynchronous-action calls in foreach-statement body should almost always set ``action.copyMsg`` to ``on``. This is because action calls within foreach usually want to work with the variable loop populates(in the above example, ``$.quux`` and ``$.corge``) which causes message-mutation and async-action must see message as it was in a certain invocation of loop-body, so they must make a copy to keep it safe from further modification as iteration continues. For instance, an async-action invocation with linked-list based queue would look like:h!h}h"h#h$hAh&}rV(h(]h)]h*]h+]h-]uh/KHh0hh]rW(h9X^Please note that asynchronous-action calls in foreach-statement body should almost always set rXrY}rZ(h X^Please note that asynchronous-action calls in foreach-statement body should almost always set h!jTubh)r[}r\(h X``action.copyMsg``h&}r](h(]h)]h*]h+]h-]uh!jTh]r^h9Xaction.copyMsgr_r`}ra(h Uh!j[ubah$hubh9X to rbrc}rd(h X to h!jTubh)re}rf(h X``on``h&}rg(h(]h)]h*]h+]h-]uh!jTh]rhh9Xonrirj}rk(h Uh!jeubah$hubh9Xz. This is because action calls within foreach usually want to work with the variable loop populates(in the above example, rlrm}rn(h Xz. This is because action calls within foreach usually want to work with the variable loop populates(in the above example, h!jTubh)ro}rp(h X ``$.quux``h&}rq(h(]h)]h*]h+]h-]uh!jTh]rrh9X$.quuxrsrt}ru(h Uh!joubah$hubh9X and rvrw}rx(h X and h!jTubh)ry}rz(h X ``$.corge``h&}r{(h(]h)]h*]h+]h-]uh!jTh]r|h9X$.corger}r~}r(h Uh!jyubah$hubh9X#) which causes message-mutation and async-action must see message as it was in a certain invocation of loop-body, so they must make a copy to keep it safe from further modification as iteration continues. For instance, an async-action invocation with linked-list based queue would look like:rr}r(h X#) which causes message-mutation and async-action must see message as it was in a certain invocation of loop-body, so they must make a copy to keep it safe from further modification as iteration continues. For instance, an async-action invocation with linked-list based queue would look like:h!jTubeubh])r}r(h Xforeach ($.quux in $!foo) do { action(type="omfile" file="./rsyslog.out.log" template="quux" queue.type="linkedlist" action.copyMsg="on") }h!h}h"h#h$h`h&}r(hbhch+]h*]h(]h)]h-]uh/KRh0hh]rh9Xforeach ($.quux in $!foo) do { action(type="omfile" file="./rsyslog.out.log" template="quux" queue.type="linkedlist" action.copyMsg="on") }rr}r(h Uh!jubaubeubh)r}r(h Uh!hh"h#h$h%h&}r(h(]h)]h*]h+]rhah-]rh auh/KXh0hh]r(h2)r}r(h Xcallrh!jh"h#h$h6h&}r(h(]h)]h*]h+]h-]uh/KXh0hh]rh9Xcallrr}r(h jh!jubaubh=)r}r(h X&Details here: :doc:`rainerscript_call`rh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/KYh0hh]r(h9XDetails here: rr}r(h XDetails here: h!jubcsphinx.addnodes pending_xref r)r}r(h X:doc:`rainerscript_call`rh!jh"h#h$U pending_xrefrh&}r(UreftypeXdocrUrefwarnrU reftargetrXrainerscript_callU refdomainUh+]h*]U refexplicith(]h)]h-]UrefdocrXrainerscript/control_structuresruh/KYh]rh)r}r(h jh&}r(h(]h)]r(Uxrefrjeh*]h+]h-]uh!jh]rh9Xrainerscript_callrr}r(h Uh!jubah$hubaubeubeubh)r}r(h Uh!hh"h#h$h%h&}r(h(]h)]h*]h+]rhah-]rhauh/K\h0hh]r(h2)r}r(h Xcontinuerh!jh"h#h$h6h&}r(h(]h)]h*]h+]h-]uh/K\h0hh]rh9Xcontinuerr}r(h jh!jubaubh=)r}r(h X0a NOP, useful e.g. inside the then part of an ifrh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/K]h0hh]rh9X0a NOP, useful e.g. inside the then part of an ifrr}r(h jh!jubaubeubeubah UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh0hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh6NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesr NUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongr Uinput_encoding_error_handlerr!jUauto_id_prefixr"Uidr#Udoctitle_xformr$Ustrip_elements_with_classesr%NU _config_filesr&]Ufile_insertion_enabledr'U raw_enabledr(KU dump_settingsr)NubUsymbol_footnote_startr*KUidsr+}r,(hhhhjhjhh}hhhhOuUsubstitution_namesr-}r.h$h0h&}r/(h(]h+]h*]Usourceh#h)]h-]uU footnotesr0]r1Urefidsr2}r3ub.build/.doctrees/rainerscript/expressions.doctree0000664000175000017500000001363713035122644021175 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX expressionsqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU expressionsqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX?/home/rger/proj/rsyslog-doc/source/rainerscript/expressions.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Expressionsq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Expressionsq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXThe language supports arbitrary complex expressions. All usual operators are supported. The precedence of operations is as follows (with operations being higher in the list being carried out before those lower in the list, e.g. multiplications are done before additions.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XThe language supports arbitrary complex expressions. All usual operators are supported. The precedence of operations is as follows (with operations being higher in the list being carried out before those lower in the list, e.g. multiplications are done before additions.q:q;}q<(hh6hh4ubaubcdocutils.nodes bullet_list q=)q>}q?(hUhhhhhU bullet_listq@h}qA(UbulletqBX-h!]h ]h]h]h#]uh%K h&hh]qC(cdocutils.nodes list_item qD)qE}qF(hXexpressions in parenthesisqGhh>hhhU list_itemqHh}qI(h]h]h ]h!]h#]uh%Nh&hh]qJh3)qK}qL(hhGhhEhhhh7h}qM(h]h]h ]h!]h#]uh%K h]qNh/Xexpressions in parenthesisqOqP}qQ(hhGhhKubaubaubhD)qR}qS(hXnot, unary minusqThh>hhhhHh}qU(h]h]h ]h!]h#]uh%Nh&hh]qVh3)qW}qX(hhThhRhhhh7h}qY(h]h]h ]h!]h#]uh%K h]qZh/Xnot, unary minusq[q\}q](hhThhWubaubaubhD)q^}q_(hX\*, /, % (modulus, as in C)q`hh>hhhhHh}qa(h]h]h ]h!]h#]uh%Nh&hh]qbh3)qc}qd(hh`hh^hhhh7h}qe(h]h]h ]h!]h#]uh%K h]qfh/X*, /, % (modulus, as in C)qgqh}qi(hX\*, /, % (modulus, as in C)hhcubaubaubhD)qj}qk(hX+, -, & (string concatenation)qlhh>hhhhHh}qm(h]h]h ]h!]h#]uh%Nh&hh]qnh3)qo}qp(hhlhhjhhhh7h}qq(h]h]h ]h!]h#]uh%K h]qrh/X+, -, & (string concatenation)qsqt}qu(hhlhhoubaubaubhD)qv}qw(hXD==, !=, <>, <, >, <=, >=, contains (strings!), startswith (strings!)qxhh>hhhhHh}qy(h]h]h ]h!]h#]uh%Nh&hh]qzh3)q{}q|(hhxhhvhhhh7h}q}(h]h]h ]h!]h#]uh%K h]q~h/XD==, !=, <>, <, >, <=, >=, contains (strings!), startswith (strings!)qq}q(hhxhh{ubaubaubhD)q}q(hXandqhh>hhhhHh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hhhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]qh/Xandqq}q(hhhhubaubaubhD)q}q(hXor hh>hhhhHh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hXorqhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]qh/Xorqq}q(hhhhubaubaubeubh3)q}q(hXhFor example, "not a == b" probably returns not what you intended. The script processor will first evaluate "not a" and then compare the resulting boolean to the value of b. What you probably intended to do is "not (a == b)". And if you just want to test for inequality, we highly suggest to use "!=" or "<>". Both are exactly the same and are provided so that you can pick whichever you like best. So inquality of a and b should be tested as "a <> b". The "not" operator should be reserved to cases where it actually is needed to form a complex boolean expression. In those cases, parenthesis are highly recommended.qhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh&hh]qh/XhFor example, "not a == b" probably returns not what you intended. The script processor will first evaluate "not a" and then compare the resulting boolean to the value of b. What you probably intended to do is "not (a == b)". And if you just want to test for inequality, we highly suggest to use "!=" or "<>". Both are exactly the same and are provided so that you can pick whichever you like best. So inquality of a and b should be tested as "a <> b". The "not" operator should be reserved to cases where it actually is needed to form a complex boolean expression. In those cases, parenthesis are highly recommended.qq}q(hhhhubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqˆUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqщUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesq݈Utrim_footnote_reference_spaceqމUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}rhhsUsubstitution_namesr}rhh&h}r(h]h!]h ]Usourcehh]h#]uU footnotesr]r Urefidsr }r ub.build/.doctrees/rainerscript/data_types.doctree0000664000175000017500000000625313035122644020744 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX data typesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU data-typesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX>/home/rger/proj/rsyslog-doc/source/rainerscript/data_types.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Data Typesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Data Typesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXlRainerScript is a typeless language. That doesn't imply you don't need to care about types. Of course, expressions like "A" + "B" will not return a valid result, as you can't really add two letters (to concatenate them, use the concatenation operator &).  However, all type conversions are automatically done by the script interpreter when there is need to do so.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XlRainerScript is a typeless language. That doesn't imply you don't need to care about types. Of course, expressions like "A" + "B" will not return a valid result, as you can't really add two letters (to concatenate them, use the concatenation operator &).  However, all type conversions are automatically done by the script interpreter when there is need to do so.q:q;}q<(hh6hh4ubaubeubahUU transformerq=NU footnote_refsq>}q?Urefnamesq@}qAUsymbol_footnotesqB]qCUautofootnote_refsqD]qEUsymbol_footnote_refsqF]qGU citationsqH]qIh&hU current_lineqJNUtransform_messagesqK]qLUreporterqMNUid_startqNKU autofootnotesqO]qPU citation_refsqQ}qRUindirect_targetsqS]qTUsettingsqU(cdocutils.frontend Values qVoqW}qX(Ufootnote_backlinksqYKUrecord_dependenciesqZNU rfc_base_urlq[Uhttps://tools.ietf.org/html/q\U tracebackq]Upep_referencesq^NUstrip_commentsq_NU toc_backlinksq`UentryqaU language_codeqbUenqcU datestampqdNU report_levelqeKU _destinationqfNU halt_levelqgKU strip_classesqhNh,NUerror_encoding_error_handlerqiUbackslashreplaceqjUdebugqkNUembed_stylesheetqlUoutput_encoding_error_handlerqmUstrictqnU sectnum_xformqoKUdump_transformsqpNU docinfo_xformqqKUwarning_streamqrNUpep_file_url_templateqsUpep-%04dqtUexit_status_levelquKUconfigqvNUstrict_visitorqwNUcloak_email_addressesqxUtrim_footnote_reference_spaceqyUenvqzNUdump_pseudo_xmlq{NUexpose_internalsq|NUsectsubtitle_xformq}U source_linkq~NUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhnUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/rainerscript/rainerscript_call.doctree0000664000175000017500000002320613035122644022304 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xthe rsyslog "call" statementqNX6blog posting announcing "call" statement (with sample)qXrainer gerhardsqXadisconq Xsyntaxq NXrsyslogq X related linksq NuUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUthe-rsyslog-call-statementqhU2blog-posting-announcing-call-statement-with-sampleqhUrainer-gerhardsqh Uadisconqh Usyntaxqh Ursyslogqh U related-linksquUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$XE/home/rger/proj/rsyslog-doc/source/rainerscript/rainerscript_call.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0hauUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"XThe rsyslog "call" statementq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;XThe rsyslog "call" statementq(h"h7h#h5ubaubcdocutils.nodes paragraph q?)q@}qA(h"XThe rsyslog "call" statement is used to tie rulesets together. It is modelled after the usual programming language "call" statement. Think of a ruleset as a subroutine (what it really is!) and you get the picture.qBh#h h$h%h&U paragraphqCh(}qD(h*]h+]h,]h-]h/]uh1Kh2hh]qEh;XThe rsyslog "call" statement is used to tie rulesets together. It is modelled after the usual programming language "call" statement. Think of a ruleset as a subroutine (what it really is!) and you get the picture.qFqG}qH(h"hBh#h@ubaubh?)qI}qJ(h"X:The "call" statement can be used to call into any type of rulesets. If a rule set has a queue assigned, the message will be posted to that queue and processed asynchronously. Otherwise, the ruleset will be executed synchronously and control returns to right after the call when the rule set has finished execution.qKh#h h$h%h&hCh(}qL(h*]h+]h,]h-]h/]uh1Kh2hh]qMh;X:The "call" statement can be used to call into any type of rulesets. If a rule set has a queue assigned, the message will be posted to that queue and processed asynchronously. Otherwise, the ruleset will be executed synchronously and control returns to right after the call when the rule set has finished execution.qNqO}qP(h"hKh#hIubaubh?)qQ}qR(h"XNote that there is an important difference between asynchronous and synchronous execution in regard to the "stop" statement. It will not affect processing of the original message when run asynchronously.qSh#h h$h%h&hCh(}qT(h*]h+]h,]h-]h/]uh1Kh2hh]qUh;XNote that there is an important difference between asynchronous and synchronous execution in regard to the "stop" statement. It will not affect processing of the original message when run asynchronously.qVqW}qX(h"hSh#hQubaubh?)qY}qZ(h"XJThe "call" statement replaces the deprecated omruleset module. It offers all capabilities omruleset has, but works in a much more efficient way. Note that omruleset was a hack that made calling rulesets possible within the constraints of the pre-v7 engine. "call" is the clean solution for the new engine. Especially for rulesets without associated queues (synchronous operation), it has zero overhead (really!). omruleset always needs to duplicate messages, which usually means at least ~250 bytes of memory writes, some allocs and frees - and even more performance-intense operations.q[h#h h$h%h&hCh(}q\(h*]h+]h,]h-]h/]uh1Kh2hh]q]h;XJThe "call" statement replaces the deprecated omruleset module. It offers all capabilities omruleset has, but works in a much more efficient way. Note that omruleset was a hack that made calling rulesets possible within the constraints of the pre-v7 engine. "call" is the clean solution for the new engine. Especially for rulesets without associated queues (synchronous operation), it has zero overhead (really!). omruleset always needs to duplicate messages, which usually means at least ~250 bytes of memory writes, some allocs and frees - and even more performance-intense operations.q^q_}q`(h"h[h#hYubaubh)qa}qb(h"Uh#h h$h%h&h'h(}qc(h*]h+]h,]h-]qdhah/]qeh auh1Kh2hh]qf(h4)qg}qh(h"Xsyntaxqih#hah$h%h&h8h(}qj(h*]h+]h,]h-]h/]uh1Kh2hh]qkh;Xsyntaxqlqm}qn(h"hih#hgubaubh?)qo}qp(h"X``call rulesetname``qqh#hah$h%h&hCh(}qr(h*]h+]h,]h-]h/]uh1Kh2hh]qscdocutils.nodes literal qt)qu}qv(h"hqh(}qw(h*]h+]h,]h-]h/]uh#hoh]qxh;Xcall rulesetnameqyqz}q{(h"Uh#huubah&Uliteralq|ubaubh?)q}}q~(h"XWhere "rulesetname" is the name of a ruleset that is defined elsewhere inside the configration. If the call is synchronous or asynchronous depends on the ruleset parameters. This cannot be overriden by the "call" statement.qh#hah$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1K!h2hh]qh;XWhere "rulesetname" is the name of a ruleset that is defined elsewhere inside the configration. If the call is synchronous or asynchronous depends on the ruleset parameters. This cannot be overriden by the "call" statement.qq}q(h"hh#h}ubaubeubh)q}q(h"Uh#h h$h%h&h'h(}q(h*]h+]h,]h-]qhah/]qh auh1K'h2hh]q(h4)q}q(h"X related linksqh#hh$h%h&h8h(}q(h*]h+]h,]h-]h/]uh1K'h2hh]qh;X related linksqq}q(h"hh#hubaubcdocutils.nodes bullet_list q)q}q(h"Uh#hh$h%h&U bullet_listqh(}q(UbulletqX-h-]h,]h*]h+]h/]uh1K)h2hh]qcdocutils.nodes list_item q)q}q(h"X`Blog posting announcing "call" statement (with sample) `_ h#hh$h%h&U list_itemqh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qh?)q}q(h"X`Blog posting announcing "call" statement (with sample) `_qh#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1K)h]q(cdocutils.nodes reference q)q}q(h"hh(}q(UnameX6Blog posting announcing "call" statement (with sample)UrefuriqXJhttp://blog.gerhards.net/2012/10/how-to-use-rsyslogs-ruleset-and-call.htmlqh-]h,]h*]h+]h/]uh#hh]qh;X6Blog posting announcing "call" statement (with sample)qq}q(h"Uh#hubah&U referencequbcdocutils.nodes target q)q}q(h"XM U referencedqKh#hh&Utargetqh(}q(Urefurihh-]qhah,]h*]h+]h/]qhauh]ubeubaubaubh?)q}q(h"XThis documentation is part of the `rsyslog `_ project. Copyright © 2013-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1K,h2hh]q(h;X"This documentation is part of the qq}q(h"X"This documentation is part of the h#hubh)q}q(h"X$`rsyslog `_h(}q(Unameh hXhttp://www.rsyslog.com/qh-]h,]h*]h+]h/]uh#hh]qh;Xrsyslogqąq}q(h"Uh#hubah&hubh)q}q(h"X hKh#hh&hh(}q(Urefurihh-]qhah,]h*]h+]h/]qh auh]ubh;X$ project. Copyright © 2013-2014 by q̅q}q(h"X$ project. Copyright © 2013-2014 by h#hubh)q}q(h"X3`Rainer Gerhards `_h(}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh-]h,]h*]h+]h/]uh#hh]qh;XRainer Gerhardsqԅq}q(h"Uh#hubah&hubh)q}q(h"X! hKh#hh&hh(}q(Urefurihh-]qhah,]h*]h+]h/]qhauh]ubh;X and q܅q}q(h"X and h#hubh)q}q(h"X$`Adiscon `_h(}q(UnameXAdisconhXhttp://www.adiscon.com/qh-]h,]h*]h+]h/]uh#hh]qh;XAdisconq䅁q}q(h"Uh#hubah&hubh)q}q(h"X hKh#hh&hh(}q(Urefurihh-]qhah,]h*]h+]h/]qh auh]ubh;X1. Released under the GNU GPL version 2 or higher.q셁q}q(h"X1. Released under the GNU GPL version 2 or higher.h#hubeubeubeubah"UU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh2hU current_lineqNUtransform_messagesq]qUreporterqNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror }r (Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlr Uhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictr U sectnum_xformr!KUdump_transformsr"NU docinfo_xformr#KUwarning_streamr$NUpep_file_url_templater%Upep-%04dr&Uexit_status_levelr'KUconfigr(NUstrict_visitorr)NUcloak_email_addressesr*Utrim_footnote_reference_spacer+Uenvr,NUdump_pseudo_xmlr-NUexpose_internalsr.NUsectsubtitle_xformr/U source_linkr0NUrfc_referencesr1NUoutput_encodingr2Uutf-8r3U source_urlr4NUinput_encodingr5U utf-8-sigr6U_disable_configr7NU id_prefixr8UU tab_widthr9KUerror_encodingr:UUTF-8r;U_sourcer<h%Ugettext_compactr=U generatorr>NUdump_internalsr?NU smart_quotesr@U pep_base_urlrAU https://www.python.org/dev/peps/rBUsyntax_highlightrCUlongrDUinput_encoding_error_handlerrEj Uauto_id_prefixrFUidrGUdoctitle_xformrHUstrip_elements_with_classesrINU _config_filesrJ]rKUfile_insertion_enabledrLU raw_enabledrMKU dump_settingsrNNubUsymbol_footnote_startrOKUidsrP}rQ(hhhhhh hhhhahhhhuUsubstitution_namesrR}rSh&h2h(}rT(h*]h-]h,]Usourceh%h+]h/]uU footnotesrU]rVUrefidsrW}rXub.build/.doctrees/rainerscript/queue_parameters.doctree0000664000175000017500000013415113035122644022155 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXgeneral queue parametersqNX*rsyslog faq: "lower bound for queue sizes"qXadisconq Xrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUgeneral-queue-parametersqhU'rsyslog-faq-lower-bound-for-queue-sizesqh Uadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XD/home/rger/proj/rsyslog-doc/source/rainerscript/queue_parameters.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hXGeneral Queue Parametersq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7XGeneral Queue Parametersq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hXDQueue parameters can be used together with the following statements:q>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qAh7XDQueue parameters can be used together with the following statements:qBqC}qD(hh>hh`qOhhFh h!h"U list_itemqPh$}qQ(h&]h']h(]h)]h+]uh-Nh.hh]qRh;)qS}qT(hhOhhMh h!h"h?h$}qU(h&]h']h(]h)]h+]uh-Kh]qVcsphinx.addnodes pending_xref qW)qX}qY(hhOhhSh h!h"U pending_xrefqZh$}q[(UreftypeXdocq\Urefwarnq]U reftargetq^X../configuration/actionsU refdomainUh)]h(]U refexplicith&]h']h+]Urefdocq_Xrainerscript/queue_parametersq`uh-Kh]qacdocutils.nodes literal qb)qc}qd(hhOh$}qe(h&]h']qf(Uxrefqgh\eh(]h)]h+]uhhXh]qhh7Xaction()qiqj}qk(hUhhcubah"UliteralqlubaubaubaubhL)qm}qn(hX ruleset()qohhFh h!h"hPh$}qp(h&]h']h(]h)]h+]uh-Nh.hh]qqh;)qr}qs(hhohhmh h!h"h?h$}qt(h&]h']h(]h)]h+]uh-Kh]quh7X ruleset()qvqw}qx(hhohhrubaubaubhL)qy}qz(hXmain\_queue() hhFh h!h"hPh$}q{(h&]h']h(]h)]h+]uh-Nh.hh]q|h;)q}}q~(hX main\_queue()hhyh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh]qh7X main_queue()qq}q(hX main\_queue()hh}ubaubaubeubh;)q}q(hXQueues need to be configured in the action or ruleset it should affect. If nothing is configured, default values will be used. Thus, the default ruleset has only the default main queue. Specific Action queues are not set up by default.qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K h.hh]qh7XQueues need to be configured in the action or ruleset it should affect. If nothing is configured, default values will be used. Thus, the default ruleset has only the default main queue. Specific Action queues are not set up by default.qq}q(hhhhubaubh;)q}q(hXTo fully understand queue parameters and how they interact, be sure to read the :doc:`queues <../concepts/queues>` documentation.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7XPTo fully understand queue parameters and how they interact, be sure to read the qq}q(hXPTo fully understand queue parameters and how they interact, be sure to read the hhubhW)q}q(hX":doc:`queues <../concepts/queues>`qhhh h!h"hZh$}q(UreftypeXdocqh]h^X../concepts/queuesU refdomainUh)]h(]U refexplicith&]h']h+]h_h`uh-Kh]qhb)q}q(hhh$}q(h&]h']q(hgheh(]h)]h+]uhhh]qh7Xqueuesqq}q(hUhhubah"hlubaubh7X documentation.qq}q(hX documentation.hhubeubhE)q}q(hUhhh h!h"hHh$}q(hJX-h)]h(]h&]h']h+]uh-Kh.hh]q(hL)q}q(hXI**queue.filename** name File name to be used for the queue files. Please note that this is actually just the file name. A directory can NOT be specified in this parameter. If the files shall be created in a specific directory, specify queue.spoolDirectory for this. The filename is used to build to complete path for queue files.hhh h!h"hPh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hXI**queue.filename** name File name to be used for the queue files. Please note that this is actually just the file name. A directory can NOT be specified in this parameter. If the files shall be created in a specific directory, specify queue.spoolDirectory for this. The filename is used to build to complete path for queue files.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh]q(cdocutils.nodes strong q)q}q(hX**queue.filename**h$}q(h&]h']h(]h)]h+]uhhh]qh7Xqueue.filenameqq}q(hUhhubah"Ustrongqubh7X7 name File name to be used for the queue files. Please note that this is actually just the file name. A directory can NOT be specified in this parameter. If the files shall be created in a specific directory, specify queue.spoolDirectory for this. The filename is used to build to complete path for queue files.qq}q(hX7 name File name to be used for the queue files. Please note that this is actually just the file name. A directory can NOT be specified in this parameter. If the files shall be created in a specific directory, specify queue.spoolDirectory for this. The filename is used to build to complete path for queue files.hhubeubaubhL)q}q(hX**queue.spoolDirectory** name This is the directory into which queue files will be stored. Note that the directory must exist, it is NOT automatically created by rsyslog. If no spoolDirectory is specified, the work directory is used.hhh h!h"hPh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX**queue.spoolDirectory** name This is the directory into which queue files will be stored. Note that the directory must exist, it is NOT automatically created by rsyslog. If no spoolDirectory is specified, the work directory is used.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh]q(h)q}q(hX**queue.spoolDirectory**h$}q(h&]h']h(]h)]h+]uhhh]qh7Xqueue.spoolDirectoryqȅq}q(hUhhubah"hubh7X name This is the directory into which queue files will be stored. Note that the directory must exist, it is NOT automatically created by rsyslog. If no spoolDirectory is specified, the work directory is used.q˅q}q(hX name This is the directory into which queue files will be stored. Note that the directory must exist, it is NOT automatically created by rsyslog. If no spoolDirectory is specified, the work directory is used.hhubeubaubhL)q}q(hX**queue.size** number This is the maximum size of the queue in number of messages. Note that setting the queue size to very small values (roughly below 100 messages) is not supported and can lead to unpredictable results. For more information on the current status of this restriction see the `rsyslog FAQ: "lower bound for queue sizes" `_.hhh h!h"hPh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX**queue.size** number This is the maximum size of the queue in number of messages. Note that setting the queue size to very small values (roughly below 100 messages) is not supported and can lead to unpredictable results. For more information on the current status of this restriction see the `rsyslog FAQ: "lower bound for queue sizes" `_.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh]q(h)q}q(hX**queue.size**h$}q(h&]h']h(]h)]h+]uhhh]qh7X queue.sizeqڅq}q(hUhhubah"hubh7X number This is the maximum size of the queue in number of messages. Note that setting the queue size to very small values (roughly below 100 messages) is not supported and can lead to unpredictable results. For more information on the current status of this restriction see the q݅q}q(hX number This is the maximum size of the queue in number of messages. Note that setting the queue size to very small values (roughly below 100 messages) is not supported and can lead to unpredictable results. For more information on the current status of this restriction see the hhubcdocutils.nodes reference q)q}q(hXc`rsyslog FAQ: "lower bound for queue sizes" `_h$}q(UnameX*rsyslog FAQ: "lower bound for queue sizes"UrefuriqX3http://www.rsyslog.com/lower-bound-for-queue-sizes/qh)]h(]h&]h']h+]uhhh]qh7X*rsyslog FAQ: "lower bound for queue sizes"q煁q}q(hUhhubah"U referencequbcdocutils.nodes target q)q}q(hX6 U referencedqKhhh"Utargetqh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X.q}q(hX.hhubeubaubhL)q}q(hX,**queue.dequeuebatchsize** number default 16hhh h!h"hPh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX,**queue.dequeuebatchsize** number default 16hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K$h]q(h)q}q(hX**queue.dequeuebatchsize**h$}q(h&]h']h(]h)]h+]uhhh]rh7Xqueue.dequeuebatchsizerr}r(hUhhubah"hubh7X number default 16rr}r(hX number default 16hhubeubaubhL)r}r(hX**queue.maxdiskspace** number The maximum size that all queue files together will use on disk. Note that the actual size may be slightly larger than the configured max, as rsyslog never writes partial queue records.hhh h!h"hPh$}r (h&]h']h(]h)]h+]uh-Nh.hh]r h;)r }r (hX**queue.maxdiskspace** number The maximum size that all queue files together will use on disk. Note that the actual size may be slightly larger than the configured max, as rsyslog never writes partial queue records.hjh h!h"h?h$}r (h&]h']h(]h)]h+]uh-K&h]r(h)r}r(hX**queue.maxdiskspace**h$}r(h&]h']h(]h)]h+]uhj h]rh7Xqueue.maxdiskspacerr}r(hUhjubah"hubh7X number The maximum size that all queue files together will use on disk. Note that the actual size may be slightly larger than the configured max, as rsyslog never writes partial queue records.rr}r(hX number The maximum size that all queue files together will use on disk. Note that the actual size may be slightly larger than the configured max, as rsyslog never writes partial queue records.hj ubeubaubhL)r}r(hX**queue.highwatermark** number This applies to disk-assisted queues, only. When the queue fills up to this number of messages, the queue begins to spool messages to disk. Please note that this should not happen as part of usual processing, because disk queue mode is very considerably slower than in-memory queue mode. Going to disk should be reserved for cases where an output action destination is offline for some period.hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hX**queue.highwatermark** number This applies to disk-assisted queues, only. When the queue fills up to this number of messages, the queue begins to spool messages to disk. Please note that this should not happen as part of usual processing, because disk queue mode is very considerably slower than in-memory queue mode. Going to disk should be reserved for cases where an output action destination is offline for some period.hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-K*h]r (h)r!}r"(hX**queue.highwatermark**h$}r#(h&]h']h(]h)]h+]uhjh]r$h7Xqueue.highwatermarkr%r&}r'(hUhj!ubah"hubh7X number This applies to disk-assisted queues, only. When the queue fills up to this number of messages, the queue begins to spool messages to disk. Please note that this should not happen as part of usual processing, because disk queue mode is very considerably slower than in-memory queue mode. Going to disk should be reserved for cases where an output action destination is offline for some period.r(r)}r*(hX number This applies to disk-assisted queues, only. When the queue fills up to this number of messages, the queue begins to spool messages to disk. Please note that this should not happen as part of usual processing, because disk queue mode is very considerably slower than in-memory queue mode. Going to disk should be reserved for cases where an output action destination is offline for some period.hjubeubaubhL)r+}r,(hX***queue.lowwatermark** number default 2000hhh h!h"hPh$}r-(h&]h']h(]h)]h+]uh-Nh.hh]r.h;)r/}r0(hX***queue.lowwatermark** number default 2000hj+h h!h"h?h$}r1(h&]h']h(]h)]h+]uh-K1h]r2(h)r3}r4(hX**queue.lowwatermark**h$}r5(h&]h']h(]h)]h+]uhj/h]r6h7Xqueue.lowwatermarkr7r8}r9(hUhj3ubah"hubh7X number default 2000r:r;}r<(hX number default 2000hj/ubeubaubhL)r=}r>(hX**queue.fulldelaymark** number Number of messages when the queue should block delayable messages. Messages are NO LONGER PROCESSED until the queue has sufficient space again. If a message is delayable depends on the input. For example, messages received via imtcp are delayable (because TCP can push back), but those received via imudp are not (as UDP does not permit a push back). The intent behind this setting is to leave some space in an almost-full queue for non-delayable messages, which would be lost if the queue runs out of space. Please note that if you use a DA queue, setting the fulldelaymark BELOW the highwatermark makes the queue never activate disk mode for delayable inputs. So this is probably not what you want.hhh h!h"hPh$}r?(h&]h']h(]h)]h+]uh-Nh.hh]r@h;)rA}rB(hX**queue.fulldelaymark** number Number of messages when the queue should block delayable messages. Messages are NO LONGER PROCESSED until the queue has sufficient space again. If a message is delayable depends on the input. For example, messages received via imtcp are delayable (because TCP can push back), but those received via imudp are not (as UDP does not permit a push back). The intent behind this setting is to leave some space in an almost-full queue for non-delayable messages, which would be lost if the queue runs out of space. Please note that if you use a DA queue, setting the fulldelaymark BELOW the highwatermark makes the queue never activate disk mode for delayable inputs. So this is probably not what you want.hj=h h!h"h?h$}rC(h&]h']h(]h)]h+]uh-K3h]rD(h)rE}rF(hX**queue.fulldelaymark**h$}rG(h&]h']h(]h)]h+]uhjAh]rHh7Xqueue.fulldelaymarkrIrJ}rK(hUhjEubah"hubh7X number Number of messages when the queue should block delayable messages. Messages are NO LONGER PROCESSED until the queue has sufficient space again. If a message is delayable depends on the input. For example, messages received via imtcp are delayable (because TCP can push back), but those received via imudp are not (as UDP does not permit a push back). The intent behind this setting is to leave some space in an almost-full queue for non-delayable messages, which would be lost if the queue runs out of space. Please note that if you use a DA queue, setting the fulldelaymark BELOW the highwatermark makes the queue never activate disk mode for delayable inputs. So this is probably not what you want.rLrM}rN(hX number Number of messages when the queue should block delayable messages. Messages are NO LONGER PROCESSED until the queue has sufficient space again. If a message is delayable depends on the input. For example, messages received via imtcp are delayable (because TCP can push back), but those received via imudp are not (as UDP does not permit a push back). The intent behind this setting is to leave some space in an almost-full queue for non-delayable messages, which would be lost if the queue runs out of space. Please note that if you use a DA queue, setting the fulldelaymark BELOW the highwatermark makes the queue never activate disk mode for delayable inputs. So this is probably not what you want.hjAubeubaubhL)rO}rP(hX**queue.lightdelaymark** numberrQhhh h!h"hPh$}rR(h&]h']h(]h)]h+]uh-Nh.hh]rSh;)rT}rU(hjQhjOh h!h"h?h$}rV(h&]h']h(]h)]h+]uh-K>h]rW(h)rX}rY(hX**queue.lightdelaymark**h$}rZ(h&]h']h(]h)]h+]uhjTh]r[h7Xqueue.lightdelaymarkr\r]}r^(hUhjXubah"hubh7X numberr_r`}ra(hX numberhjTubeubaubhL)rb}rc(hX)**queue.discardmark** number default 9750hhh h!h"hPh$}rd(h&]h']h(]h)]h+]uh-Nh.hh]reh;)rf}rg(hX)**queue.discardmark** number default 9750hjbh h!h"h?h$}rh(h&]h']h(]h)]h+]uh-K?h]ri(h)rj}rk(hX**queue.discardmark**h$}rl(h&]h']h(]h)]h+]uhjfh]rmh7Xqueue.discardmarkrnro}rp(hUhjjubah"hubh7X number default 9750rqrr}rs(hX number default 9750hjfubeubaubhL)rt}ru(hXV**queue.discardseverity** number \*numerical\* severity! default 8 (nothing discarded)hhh h!h"hPh$}rv(h&]h']h(]h)]h+]uh-Nh.hh]rwh;)rx}ry(hXV**queue.discardseverity** number \*numerical\* severity! default 8 (nothing discarded)hjth h!h"h?h$}rz(h&]h']h(]h)]h+]uh-KAh]r{(h)r|}r}(hX**queue.discardseverity**h$}r~(h&]h']h(]h)]h+]uhjxh]rh7Xqueue.discardseverityrr}r(hUhj|ubah"hubh7X; number *numerical* severity! default 8 (nothing discarded)rr}r(hX= number \*numerical\* severity! default 8 (nothing discarded)hjxubeubaubhL)r}r(hX**queue.checkpointinterval** number Disk queues by default do not update housekeeping structures every time the queue writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when data is mangled via the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hX**queue.checkpointinterval** number Disk queues by default do not update housekeeping structures every time the queue writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when data is mangled via the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KCh]r(h)r}r(hX**queue.checkpointinterval**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.checkpointintervalrr}r(hUhjubah"hubh7X number Disk queues by default do not update housekeeping structures every time the queue writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when data is mangled via the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.rr}r(hX number Disk queues by default do not update housekeeping structures every time the queue writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when data is mangled via the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.hjubeubaubhL)r}r(hXr**queue.syncqueuefiles** on/off (default "off") Disk-based queues can be made very reliable by issuing a (f)sync after each write operation. This happens when you set the parameter to "on". Activating this option has a performance penalty, so it should not be turned on without a good reason. Note that the penalty also depends on *queue.checkpointInterval* frequency. hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]r(h;)r}r(hX/**queue.syncqueuefiles** on/off (default "off")hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KKh]r(h)r}r(hX**queue.syncqueuefiles**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.syncqueuefilesrr}r(hUhjubah"hubh7X on/off (default "off")rr}r(hX on/off (default "off")hjubeubh;)r}r(hX@Disk-based queues can be made very reliable by issuing a (f)sync after each write operation. This happens when you set the parameter to "on". Activating this option has a performance penalty, so it should not be turned on without a good reason. Note that the penalty also depends on *queue.checkpointInterval* frequency.hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KMh]r(h7XDisk-based queues can be made very reliable by issuing a (f)sync after each write operation. This happens when you set the parameter to "on". Activating this option has a performance penalty, so it should not be turned on without a good reason. Note that the penalty also depends on rr}r(hXDisk-based queues can be made very reliable by issuing a (f)sync after each write operation. This happens when you set the parameter to "on". Activating this option has a performance penalty, so it should not be turned on without a good reason. Note that the penalty also depends on hjubcdocutils.nodes emphasis r)r}r(hX*queue.checkpointInterval*h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.checkpointIntervalrr}r(hUhjubah"Uemphasisrubh7X frequency.rr}r(hX frequency.hjubeubeubhL)r}r(hX1**queue.samplinginterval** number This option allows queues to be populated by events produced at a specific interval. It provides a way to sample data each N events, instead of processing all, in order to reduce resources usage (disk, bandwidth...) This feature is available for version 8.23 and above. hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]r(h;)r}r(hX!**queue.samplinginterval** numberhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KSh]r(h)r}r(hX**queue.samplinginterval**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.samplingintervalrr}r(hUhjubah"hubh7X numberrr}r(hX numberhjubeubh;)r}r(hX This option allows queues to be populated by events produced at a specific interval. It provides a way to sample data each N events, instead of processing all, in order to reduce resources usage (disk, bandwidth...) This feature is available for version 8.23 and above.rhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KUh]rh7X This option allows queues to be populated by events produced at a specific interval. It provides a way to sample data each N events, instead of processing all, in order to reduce resources usage (disk, bandwidth...) This feature is available for version 8.23 and above.rr}r(hjhjubaubeubhL)r}r(hX6**queue.type** [FixedArray/LinkedList/**Direct**/Disk]rhhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hjhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KYh]r(h)r}r(hX**queue.type**h$}r(h&]h']h(]h)]h+]uhjh]rh7X queue.typerr}r(hUhjubah"hubh7X [FixedArray/LinkedList/rr}r(hX [FixedArray/LinkedList/hjubh)r}r(hX **Direct**h$}r(h&]h']h(]h)]h+]uhjh]rh7XDirectrr}r(hUhjubah"hubh7X/Disk]rr}r(hX/Disk]hjubeubaubhL)r}r(hXQ**queue.workerthreads** number number of worker threads, default 1, recommended 1hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hXQ**queue.workerthreads** number number of worker threads, default 1, recommended 1hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KZh]r(h)r}r(hX**queue.workerthreads**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.workerthreadsrr}r(hUhjubah"hubh7X: number number of worker threads, default 1, recommended 1rr}r(hX: number number of worker threads, default 1, recommended 1hjubeubaubhL)r}r(hXb**queue.timeoutshutdown** number number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]r h;)r }r (hXb**queue.timeoutshutdown** number number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)hjh h!h"h?h$}r (h&]h']h(]h)]h+]uh-K\h]r (h)r}r(hX**queue.timeoutshutdown**h$}r(h&]h']h(]h)]h+]uhj h]rh7Xqueue.timeoutshutdownrr}r(hUhjubah"hubh7XI number number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)rr}r(hXI number number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)hj ubeubaubhL)r}r(hXt**queue.timeoutactioncompletion** number number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hXt**queue.timeoutactioncompletion** number number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-K^h]r(h)r }r!(hX!**queue.timeoutactioncompletion**h$}r"(h&]h']h(]h)]h+]uhjh]r#h7Xqueue.timeoutactioncompletionr$r%}r&(hUhj ubah"hubh7XS number number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!r'r(}r)(hXS number number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!hjubeubaubhL)r*}r+(hX **queue.timeoutenqueue** number number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediate. This timeout value is used when the queue is full. If rsyslog cannot enqueue a message within the timeout period, the message is discarded. Note that this is setting of last resort (assuming defaults are used for the queue settings or proper parameters are set): all delayable inputs (like imtcp or imfile) have already been pushed back at this stage. Also, discarding of lower priority messages (if configured) has already happened. So we run into one of these situations if we do not timeout quickly enough: * if using imuxsock and no systemd journal is involved, the system would become unresponsive and most probably a hard reset would be required. * if using imuxsock with imjournal forwarding is active, messages are lost because the journal discards them (more agressive than rsyslog does) * if using imjournal, the journal will buffer messages. If journal runs out of configured space, messages will be discarded. So in this mode discarding is moved to a bit later place. * other non-delayable sources like imudp will also loose messages So this setting is provided in order to guard against problematic situations, which always will result either in message loss or system hang. For action queues, one may debate if it would be better to overflow rapidly to the main queue. If so desired, this is easy to acomplish by setting a very large timeout value. The same, of course, is true for the main queue, but you have been warned if you do so! In some other words, you can consider this scenario, using default values. With all progress blocked (unable to deliver a message): * all delayable inputs (tcp, relp, imfile, imjournal, etc) will block indefinantly (assuming queue.lightdelaymark and queue.fulldelaymark are set sensible, which they are by default). * imudp will be loosing messages because the OS will be dropping them * messages arriving via UDP or imuxsock that do make it to rsyslog, and that are a severity high enough to not be filtered by discardseverity, will block for 2 seconds trying to put the message in the queue (in the hope that something happens to make space in the queue) and then be dropped to avoid blocking the machine permanently. Then the next message to be processed will also be tried for 2 seconds, etc. * If this is going into an action queue, the log message will remain in the main queue during these 2 seconds, and additional logs that arrive will accumulate behind this in the main queue.hhh Nh"hPh$}r,(h&]h']h(]h)]h+]uh-Nh.hh]r-(h;)r.}r/(hXs**queue.timeoutenqueue** number number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediate.hj*h h!h"h?h$}r0(h&]h']h(]h)]h+]uh-Kah]r1(h)r2}r3(hX**queue.timeoutenqueue**h$}r4(h&]h']h(]h)]h+]uhj.h]r5h7Xqueue.timeoutenqueuer6r7}r8(hUhj2ubah"hubh7X[ number number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediate.r9r:}r;(hX[ number number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediate.hj.ubeubh;)r<}r=(hXThis timeout value is used when the queue is full. If rsyslog cannot enqueue a message within the timeout period, the message is discarded. Note that this is setting of last resort (assuming defaults are used for the queue settings or proper parameters are set): all delayable inputs (like imtcp or imfile) have already been pushed back at this stage. Also, discarding of lower priority messages (if configured) has already happened. So we run into one of these situations if we do not timeout quickly enough:r>hj*h h!h"h?h$}r?(h&]h']h(]h)]h+]uh-Keh]r@h7XThis timeout value is used when the queue is full. If rsyslog cannot enqueue a message within the timeout period, the message is discarded. Note that this is setting of last resort (assuming defaults are used for the queue settings or proper parameters are set): all delayable inputs (like imtcp or imfile) have already been pushed back at this stage. Also, discarding of lower priority messages (if configured) has already happened. So we run into one of these situations if we do not timeout quickly enough:rArB}rC(hj>hj<ubaubhE)rD}rE(hUh$}rF(hJX*h)]h(]h&]h']h+]uhj*h]rG(hL)rH}rI(hXif using imuxsock and no systemd journal is involved, the system would become unresponsive and most probably a hard reset would be required.h$}rJ(h&]h']h(]h)]h+]uhjDh]rKh;)rL}rM(hXif using imuxsock and no systemd journal is involved, the system would become unresponsive and most probably a hard reset would be required.rNhjHh h!h"h?h$}rO(h&]h']h(]h)]h+]uh-Knh]rPh7Xif using imuxsock and no systemd journal is involved, the system would become unresponsive and most probably a hard reset would be required.rQrR}rS(hjNhjLubaubah"hPubhL)rT}rU(hXif using imuxsock with imjournal forwarding is active, messages are lost because the journal discards them (more agressive than rsyslog does)h$}rV(h&]h']h(]h)]h+]uhjDh]rWh;)rX}rY(hXif using imuxsock with imjournal forwarding is active, messages are lost because the journal discards them (more agressive than rsyslog does)rZhjTh h!h"h?h$}r[(h&]h']h(]h)]h+]uh-Kqh]r\h7Xif using imuxsock with imjournal forwarding is active, messages are lost because the journal discards them (more agressive than rsyslog does)r]r^}r_(hjZhjXubaubah"hPubhL)r`}ra(hXif using imjournal, the journal will buffer messages. If journal runs out of configured space, messages will be discarded. So in this mode discarding is moved to a bit later place.h$}rb(h&]h']h(]h)]h+]uhjDh]rch;)rd}re(hXif using imjournal, the journal will buffer messages. If journal runs out of configured space, messages will be discarded. So in this mode discarding is moved to a bit later place.rfhj`h h!h"h?h$}rg(h&]h']h(]h)]h+]uh-Ksh]rhh7Xif using imjournal, the journal will buffer messages. If journal runs out of configured space, messages will be discarded. So in this mode discarding is moved to a bit later place.rirj}rk(hjfhjdubaubah"hPubhL)rl}rm(hX@other non-delayable sources like imudp will also loose messages h$}rn(h&]h']h(]h)]h+]uhjDh]roh;)rp}rq(hX?other non-delayable sources like imudp will also loose messagesrrhjlh h!h"h?h$}rs(h&]h']h(]h)]h+]uh-Kvh]rth7X?other non-delayable sources like imudp will also loose messagesrurv}rw(hjrhjpubaubah"hPubeh"hHubh;)rx}ry(hXSo this setting is provided in order to guard against problematic situations, which always will result either in message loss or system hang. For action queues, one may debate if it would be better to overflow rapidly to the main queue. If so desired, this is easy to acomplish by setting a very large timeout value. The same, of course, is true for the main queue, but you have been warned if you do so!rzhj*h h!h"h?h$}r{(h&]h']h(]h)]h+]uh-Kxh]r|h7XSo this setting is provided in order to guard against problematic situations, which always will result either in message loss or system hang. For action queues, one may debate if it would be better to overflow rapidly to the main queue. If so desired, this is easy to acomplish by setting a very large timeout value. The same, of course, is true for the main queue, but you have been warned if you do so!r}r~}r(hjzhjxubaubh;)r}r(hXIn some other words, you can consider this scenario, using default values. With all progress blocked (unable to deliver a message):rhj*h h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7XIn some other words, you can consider this scenario, using default values. With all progress blocked (unable to deliver a message):rr}r(hjhjubaubhE)r}r(hUh$}r(hJX*h)]h(]h&]h']h+]uhj*h]r(hL)r}r(hXall delayable inputs (tcp, relp, imfile, imjournal, etc) will block indefinantly (assuming queue.lightdelaymark and queue.fulldelaymark are set sensible, which they are by default).h$}r(h&]h']h(]h)]h+]uhjh]rh;)r}r(hXall delayable inputs (tcp, relp, imfile, imjournal, etc) will block indefinantly (assuming queue.lightdelaymark and queue.fulldelaymark are set sensible, which they are by default).rhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7Xall delayable inputs (tcp, relp, imfile, imjournal, etc) will block indefinantly (assuming queue.lightdelaymark and queue.fulldelaymark are set sensible, which they are by default).rr}r(hjhjubaubah"hPubhL)r}r(hXCimudp will be loosing messages because the OS will be dropping themrh$}r(h&]h']h(]h)]h+]uhjh]rh;)r}r(hjhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7XCimudp will be loosing messages because the OS will be dropping themrr}r(hjhjubaubah"hPubhL)r}r(hXmessages arriving via UDP or imuxsock that do make it to rsyslog, and that are a severity high enough to not be filtered by discardseverity, will block for 2 seconds trying to put the message in the queue (in the hope that something happens to make space in the queue) and then be dropped to avoid blocking the machine permanently. Then the next message to be processed will also be tried for 2 seconds, etc. h$}r(h&]h']h(]h)]h+]uhjh]r(h;)r}r(hXKmessages arriving via UDP or imuxsock that do make it to rsyslog, and that are a severity high enough to not be filtered by discardseverity, will block for 2 seconds trying to put the message in the queue (in the hope that something happens to make space in the queue) and then be dropped to avoid blocking the machine permanently.rhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7XKmessages arriving via UDP or imuxsock that do make it to rsyslog, and that are a severity high enough to not be filtered by discardseverity, will block for 2 seconds trying to put the message in the queue (in the hope that something happens to make space in the queue) and then be dropped to avoid blocking the machine permanently.rr}r(hjhjubaubh;)r}r(hXLThen the next message to be processed will also be tried for 2 seconds, etc.rhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7XLThen the next message to be processed will also be tried for 2 seconds, etc.rr}r(hjhjubaubeh"hPubhL)r}r(hXIf this is going into an action queue, the log message will remain in the main queue during these 2 seconds, and additional logs that arrive will accumulate behind this in the main queue.h$}r(h&]h']h(]h)]h+]uhjh]rh;)r}r(hXIf this is going into an action queue, the log message will remain in the main queue during these 2 seconds, and additional logs that arrive will accumulate behind this in the main queue.rhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]rh7XIf this is going into an action queue, the log message will remain in the main queue during these 2 seconds, and additional logs that arrive will accumulate behind this in the main queue.rr}r(hjhjubaubah"hPubeh"hHubeubhL)r}r(hXp**queue.timeoutworkerthreadshutdown** number number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hXp**queue.timeoutworkerthreadshutdown** number number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]r(h)r}r(hX%**queue.timeoutworkerthreadshutdown**h$}r(h&]h']h(]h)]h+]uhjh]rh7X!queue.timeoutworkerthreadshutdownrr}r(hUhjubah"hubh7XK number number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)rr}r(hXK number number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)hjubeubaubhL)r}r(hX8**queue.workerthreadminimummessages** number default 100hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hX8**queue.workerthreadminimummessages** number default 100hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]r(h)r}r(hX%**queue.workerthreadminimummessages**h$}r(h&]h']h(]h)]h+]uhjh]rh7X!queue.workerthreadminimummessagesrr}r(hUhjubah"hubh7X number default 100rr}r(hX number default 100hjubeubaubhL)r}r(hX***queue.maxfilesize** size\_nbr default 1mhhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hX***queue.maxfilesize** size\_nbr default 1mhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]r(h)r}r(hX**queue.maxfilesize**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.maxfilesizerr}r(hUhjubah"hubh7X size_nbr default 1mrr}r(hX size\_nbr default 1mhjubeubaubhL)r}r(hX%**queue.saveonshutdown** on/\ **off**rhhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hjhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]r(h)r}r(hX**queue.saveonshutdown**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.saveonshutdownrr}r (hUhjubah"hubh7X on/r r }r (hX on/\ hjubh)r }r(hX**off**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xoffrr}r(hUhj ubah"hubeubaubhL)r}r(hX**queue.dequeueslowdown** number number is timeout in microseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!hhh h!h"hPh$}r(h&]h']h(]h)]h+]uh-Nh.hh]rh;)r}r(hX**queue.dequeueslowdown** number number is timeout in microseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!hjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh]r(h)r}r(hX**queue.dequeueslowdown**h$}r(h&]h']h(]h)]h+]uhjh]rh7Xqueue.dequeueslowdownr r!}r"(hUhjubah"hubh7Xk number number is timeout in microseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!r#r$}r%(hXk number number is timeout in microseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!hjubeubaubhL)r&}r'(hX!**queue.dequeuetimebegin** numberr(hhh h!h"hPh$}r)(h&]h']h(]h)]h+]uh-Nh.hh]r*h;)r+}r,(hj(hj&h h!h"h?h$}r-(h&]h']h(]h)]h+]uh-Kh]r.(h)r/}r0(hX**queue.dequeuetimebegin**h$}r1(h&]h']h(]h)]h+]uhj+h]r2h7Xqueue.dequeuetimebeginr3r4}r5(hUhj/ubah"hubh7X numberr6r7}r8(hX numberhj+ubeubaubhL)r9}r:(hX**queue.dequeuetimeend** numberr;hhh h!h"hPh$}r<(h&]h']h(]h)]h+]uh-Nh.hh]r=h;)r>}r?(hj;hj9h h!h"h?h$}r@(h&]h']h(]h)]h+]uh-Kh]rA(h)rB}rC(hX**queue.dequeuetimeend**h$}rD(h&]h']h(]h)]h+]uhj>h]rEh7Xqueue.dequeuetimeendrFrG}rH(hUhjBubah"hubh7X numberrIrJ}rK(hX numberhj>ubeubaubhL)rL}rM(hX**queue.samplinginterval** number Sampling interval for action queue. This parameter specifies how many line of logs will be dropped before one enqueued. default 0. hhh h!h"hPh$}rN(h&]h']h(]h)]h+]uh-Nh.hh]rOh;)rP}rQ(hX**queue.samplinginterval** number Sampling interval for action queue. This parameter specifies how many line of logs will be dropped before one enqueued. default 0.hjLh h!h"h?h$}rR(h&]h']h(]h)]h+]uh-Kh]rS(h)rT}rU(hX**queue.samplinginterval**h$}rV(h&]h']h(]h)]h+]uhjPh]rWh7Xqueue.samplingintervalrXrY}rZ(hUhjTubah"hubh7X number Sampling interval for action queue. This parameter specifies how many line of logs will be dropped before one enqueued. default 0.r[r\}r](hX number Sampling interval for action queue. This parameter specifies how many line of logs will be dropped before one enqueued. default 0.hjPubeubaubeubh;)r^}r_(hX **Sample:**r`hhh h!h"h?h$}ra(h&]h']h(]h)]h+]uh-Kh.hh]rbh)rc}rd(hj`h$}re(h&]h']h(]h)]h+]uhj^h]rfh7XSample:rgrh}ri(hUhjcubah"hubaubh;)rj}rk(hXHThe following is a sample of a TCP forwarding action with its own queue.rlhhh h!h"h?h$}rm(h&]h']h(]h)]h+]uh-Kh.hh]rnh7XHThe following is a sample of a TCP forwarding action with its own queue.rorp}rq(hjlhjjubaubcdocutils.nodes literal_block rr)rs}rt(hXaction(type="omfwd" target="192.168.2.11" port="10514" protocol="tcp" queue.filename="forwarding" queue.size="1000000" queue.type="LinkedList" )hhh h!h"U literal_blockruh$}rv(U xml:spacerwUpreserverxh)]h(]h&]h']h+]uh-Kh.hh]ryh7Xaction(type="omfwd" target="192.168.2.11" port="10514" protocol="tcp" queue.filename="forwarding" queue.size="1000000" queue.type="LinkedList" )rzr{}r|(hUhjsubaubh;)r}}r~(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2013-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hhh h!h"h?h$}r(h&]h']h(]h)]h+]uh-Kh.hh]r(h7X"This documentation is part of the rr}r(hX"This documentation is part of the hj}ubh)r}r(hX$`rsyslog `_h$}r(Unameh hXhttp://www.rsyslog.com/rh)]h(]h&]h']h+]uhj}h]rh7Xrsyslogrr}r(hUhjubah"hubh)r}r(hX hKhj}h"hh$}r(Urefurijh)]rhah(]h&]h']h+]rh auh]ubh7X$ project. Copyright © 2013-2014 by rr}r(hX$ project. Copyright © 2013-2014 by hj}ubh)r}r(hX3`Rainer Gerhards `_h$}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrh)]h(]h&]h']h+]uhj}h]rh7XRainer Gerhardsrr}r(hUhjubah"hubh)r}r(hX! hKhj}h"hh$}r(Urefurijh)]rhah(]h&]h']h+]rhauh]ubh7X and rr}r(hX and hj}ubh)r}r(hX$`Adiscon `_h$}r(UnameXAdisconhXhttp://www.adiscon.com/rh)]h(]h&]h']h+]uhj}h]rh7XAdisconrr}r(hUhjubah"hubh)r}r(hX hKhj}h"hh$}r(Urefurijh)]rhah(]h&]h']h+]rh auh]ubh7X1. Released under the GNU GPL version 3 or higher.rr}r(hX1. Released under the GNU GPL version 3 or higher.hj}ubeubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh.hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh!Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongr Uinput_encoding_error_handlerr jUauto_id_prefixr Uidr Udoctitle_xformr Ustrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hjhhhjhjhhuUsubstitution_namesr}rh"h.h$}r(h&]h)]h(]Usourceh!h']h+]uU footnotesr]rUrefidsr}rub.build/.doctrees/rainerscript/global.doctree0000664000175000017500000015451413035122644020053 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xglobal_janitorintervalqX tls syslogqXglobal() configuration objectqNuUsubstitution_defsq }q Uparse_messagesq ]q cdocutils.nodes system_message q )q}q(U rawsourceqUU attributesq}q(Udupnamesq]UlevelKUidsq]Ubackrefsq]qUid1qaUsourceX:/home/rger/proj/rsyslog-doc/source/rainerscript/global.rstqUclassesq]Unamesq]UlineKUtypeUINFOquUparentqcdocutils.nodes list_item q)q}q(hX**defaultNetstreamDriver** Set it to "gtls" to enable TLS for `TLS syslog `_ hcdocutils.nodes bullet_list q )q!}q"(hUhcdocutils.nodes section q#)q$}q%(hUhhUsourceq&hUtagnameq'Usectionq(h}q)(h]h]h]h]q*Uglobal-configuration-objectq+ah]q,hauUlineq-KUdocumentq.hUchildrenq/]q0(cdocutils.nodes title q1)q2}q3(hXglobal() configuration objectq4hh$h&hh'Utitleq5h}q6(h]h]h]h]h]uh-Kh.hh/]q7cdocutils.nodes Text q8Xglobal() configuration objectq9q:}q;(hh4hh2ubaubcdocutils.nodes paragraph q<)q=}q>(hXThe global configuration object permits to set global parameters. Note that each parameter can only be set once and cannot be re-set thereafter. If a parameter is set multiple times, the behaviour is unpredictable.q?hh$h&hh'U paragraphq@h}qA(h]h]h]h]h]uh-Kh.hh/]qBh8XThe global configuration object permits to set global parameters. Note that each parameter can only be set once and cannot be re-set thereafter. If a parameter is set multiple times, the behaviour is unpredictable.qCqD}qE(hh?hh=ubaubh<)qF}qG(hX$The following parameters can be set:qHhh$h&hh'h@h}qI(h]h]h]h]h]uh-K h.hh/]qJh8X$The following parameters can be set:qKqL}qM(hhHhhFubaubh!cdocutils.nodes target qN)qO}qP(hX.. _global_janitorInterval:hh$h&hh'UtargetqQh}qR(h]h]h]h]h]UrefidqSUglobal-janitorintervalqTuh-KSh.hh/]ubh )qU}qV(hUhh$h&hUexpect_referenced_by_nameqW}qXhhOsh'U bullet_listqYh}qZ(Ubulletq[X-h]q\hTah]h]h]h]q]hauh-KUh.hUexpect_referenced_by_idq^}q_hThOsh/]q`(h)qa}qb(hX**janitorInterval** [minutes], available since 8.3.3 Sets the interval at which the :doc:`janitor process <../concepts/janitor>` runs. hhUh&hh'U list_itemqch}qd(h]h]h]h]h]uh-Nh.hh/]qe(h<)qf}qg(hX4**janitorInterval** [minutes], available since 8.3.3hhah&hh'h@h}qh(h]h]h]h]h]uh-KUh/]qi(cdocutils.nodes strong qj)qk}ql(hX**janitorInterval**h}qm(h]h]h]h]h]uhhfh/]qnh8XjanitorIntervalqoqp}qq(hUhhkubah'Ustrongqrubh8X! [minutes], available since 8.3.3qsqt}qu(hX! [minutes], available since 8.3.3hhfubeubh<)qv}qw(hXQSets the interval at which the :doc:`janitor process <../concepts/janitor>` runs.hhah&hh'h@h}qx(h]h]h]h]h]uh-KWh/]qy(h8XSets the interval at which the qzq{}q|(hXSets the interval at which the hhvubcsphinx.addnodes pending_xref q})q~}q(hX,:doc:`janitor process <../concepts/janitor>`qhhvh&hh'U pending_xrefqh}q(UreftypeXdocqUrefwarnqU reftargetqX../concepts/janitorU refdomainUh]h]U refexplicith]h]h]UrefdocqXrainerscript/globalquh-KWh/]qcdocutils.nodes literal q)q}q(hhh}q(h]h]q(Uxrefqheh]h]h]uhh~h/]qh8Xjanitor processqq}q(hUhhubah'Uliteralqubaubh8X runs.qq}q(hX runs.hhvubeubeubh)q}q(hX**debug.onShutdown** available in 7.5.8+ If enabled ("on"), rsyslog will log debug messages when a system shutdown is requested. This can be used to track issues that happen only during shutdown. During normal operations, system performance is NOT affected. Note that for this option to be useful, the debug.logFile parameter must also be set (or the respective environment variable). hhUh&hh'hch}q(h]h]h]h]h]uh-Nh.hh/]q(h<)q}q(hX(**debug.onShutdown** available in 7.5.8+hhh&hh'h@h}q(h]h]h]h]h]uh-K[h/]q(hj)q}q(hX**debug.onShutdown**h}q(h]h]h]h]h]uhhh/]qh8Xdebug.onShutdownqq}q(hUhhubah'hrubh8X available in 7.5.8+qq}q(hX available in 7.5.8+hhubeubh<)q}q(hXWIf enabled ("on"), rsyslog will log debug messages when a system shutdown is requested. This can be used to track issues that happen only during shutdown. During normal operations, system performance is NOT affected. Note that for this option to be useful, the debug.logFile parameter must also be set (or the respective environment variable).qhhh&hh'h@h}q(h]h]h]h]h]uh-K]h/]qh8XWIf enabled ("on"), rsyslog will log debug messages when a system shutdown is requested. This can be used to track issues that happen only during shutdown. During normal operations, system performance is NOT affected. Note that for this option to be useful, the debug.logFile parameter must also be set (or the respective environment variable).qq}q(hhhhubaubeubh)q}q(hX**debug.logFile** available in 7.5.8+ This is used to specify the debug log file name. It is used for all debug output. Please note that the RSYSLOG\_DEBUGLOG environment variable always **overrides** the value of debug.logFile. hhUh&hh'hch}q(h]h]h]h]h]uh-Nh.hh/]q(h<)q}q(hX%**debug.logFile** available in 7.5.8+hhh&hh'h@h}q(h]h]h]h]h]uh-Kdh/]q(hj)q}q(hX**debug.logFile**h}q(h]h]h]h]h]uhhh/]qh8X debug.logFileqq}q(hUhhubah'hrubh8X available in 7.5.8+qq}q(hX available in 7.5.8+hhubeubh<)q}q(hXThis is used to specify the debug log file name. It is used for all debug output. Please note that the RSYSLOG\_DEBUGLOG environment variable always **overrides** the value of debug.logFile.hhh&hh'h@h}q(h]h]h]h]h]uh-Kfh/]q(h8XThis is used to specify the debug log file name. It is used for all debug output. Please note that the RSYSLOG_DEBUGLOG environment variable always qDžq}q(hXThis is used to specify the debug log file name. It is used for all debug output. Please note that the RSYSLOG\_DEBUGLOG environment variable always hhubhj)q}q(hX **overrides**h}q(h]h]h]h]h]uhhh/]qh8X overridesq΅q}q(hUhhubah'hrubh8X the value of debug.logFile.qхq}q(hX the value of debug.logFile.hhubeubeubh)q}q(hXf**net.ipprotocol** available in 8.6.0+ This permits to instruct rsyslog to use IPv4 or IPv6 only. Possible values are "unspecified", in which case both protocols are used, "ipv4-only", and "ipv6-only", which restrict usage to the specified protocol. The default is "unspecified". Note: this replaces the former *-4* and *-6* rsyslogd command line options. hhUh&hh'hch}q(h]h]h]h]h]uh-Nh.hh/]q(h<)q}q(hX&**net.ipprotocol** available in 8.6.0+hhh&hh'h@h}q(h]h]h]h]h]uh-Kjh/]q(hj)q}q(hX**net.ipprotocol**h}q(h]h]h]h]h]uhhh/]qh8Xnet.ipprotocolqq}q(hUhhubah'hrubh8X available in 8.6.0+qㅁq}q(hX available in 8.6.0+hhubeubh<)q}q(hXThis permits to instruct rsyslog to use IPv4 or IPv6 only. Possible values are "unspecified", in which case both protocols are used, "ipv4-only", and "ipv6-only", which restrict usage to the specified protocol. The default is "unspecified".qhhh&hh'h@h}q(h]h]h]h]h]uh-Klh/]qh8XThis permits to instruct rsyslog to use IPv4 or IPv6 only. Possible values are "unspecified", in which case both protocols are used, "ipv4-only", and "ipv6-only", which restrict usage to the specified protocol. The default is "unspecified".q녁q}q(hhhhubaubh<)q}q(hXKNote: this replaces the former *-4* and *-6* rsyslogd command line options.hhh&hh'h@h}q(h]h]h]h]h]uh-Kqh/]q(h8XNote: this replaces the former qq}q(hXNote: this replaces the former hhubcdocutils.nodes emphasis q)q}q(hX*-4*h}q(h]h]h]h]h]uhhh/]qh8X-4qq}q(hUhhubah'Uemphasisqubh8X and qq}r(hX and hhubh)r}r(hX*-6*h}r(h]h]h]h]h]uhhh/]rh8X-6rr}r(hUhjubah'hubh8X rsyslogd command line options.rr }r (hX rsyslogd command line options.hhubeubeubh)r }r (hX@**net.aclAddHostnameOnFail** available in 8.6.0+ If "on", during ACL processing, hostnames are resolved to IP addresses for performance reasons. If DNS fails during that process, the hostname is added as wildcard text, which results in proper, but somewhat slower operation once DNS is up again. The default is "off". hhUh&hh'hch}r (h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX0**net.aclAddHostnameOnFail** available in 8.6.0+hj h&hh'h@h}r(h]h]h]h]h]uh-Kth/]r(hj)r}r(hX**net.aclAddHostnameOnFail**h}r(h]h]h]h]h]uhjh/]rh8Xnet.aclAddHostnameOnFailrr}r(hUhjubah'hrubh8X available in 8.6.0+rr}r(hX available in 8.6.0+hjubeubh<)r}r(hXIf "on", during ACL processing, hostnames are resolved to IP addresses for performance reasons. If DNS fails during that process, the hostname is added as wildcard text, which results in proper, but somewhat slower operation once DNS is up again.rhj h&hh'h@h}r (h]h]h]h]h]uh-Kvh/]r!h8XIf "on", during ACL processing, hostnames are resolved to IP addresses for performance reasons. If DNS fails during that process, the hostname is added as wildcard text, which results in proper, but somewhat slower operation once DNS is up again.r"r#}r$(hjhjubaubh<)r%}r&(hXThe default is "off".r'hj h&hh'h@h}r((h]h]h]h]h]uh-K{h/]r)h8XThe default is "off".r*r+}r,(hj'hj%ubaubeubh)r-}r.(hX**net.aclResolveHostname** available in 8.6.0+ If "off", do not resolve hostnames to IP addresses during ACL processing. The default is "on". hhUh&hh'hch}r/(h]h]h]h]h]uh-Nh.hh/]r0(h<)r1}r2(hX.**net.aclResolveHostname** available in 8.6.0+hj-h&hh'h@h}r3(h]h]h]h]h]uh-K}h/]r4(hj)r5}r6(hX**net.aclResolveHostname**h}r7(h]h]h]h]h]uhj1h/]r8h8Xnet.aclResolveHostnamer9r:}r;(hUhj5ubah'hrubh8X available in 8.6.0+r<r=}r>(hX available in 8.6.0+hj1ubeubh<)r?}r@(hXIIf "off", do not resolve hostnames to IP addresses during ACL processing.rAhj-h&hh'h@h}rB(h]h]h]h]h]uh-Kh/]rCh8XIIf "off", do not resolve hostnames to IP addresses during ACL processing.rDrE}rF(hjAhj?ubaubh<)rG}rH(hXThe default is "on".rIhj-h&hh'h@h}rJ(h]h]h]h]h]uh-Kh/]rKh8XThe default is "on".rLrM}rN(hjIhjGubaubeubh)rO}rP(hXt**net.enableDNS** [on/off] available in 8.6.0+ **Default:** on Can be used to turn DNS name resolution on or off. hhUh&hh'hch}rQ(h]h]h]h]h]uh-Nh.hh/]rR(h<)rS}rT(hX.**net.enableDNS** [on/off] available in 8.6.0+hjOh&hh'h@h}rU(h]h]h]h]h]uh-Kh/]rV(hj)rW}rX(hX**net.enableDNS**h}rY(h]h]h]h]h]uhjSh/]rZh8X net.enableDNSr[r\}r](hUhjWubah'hrubh8X [on/off] available in 8.6.0+r^r_}r`(hX [on/off] available in 8.6.0+hjSubeubh<)ra}rb(hX**Default:** onhjOh&hh'h@h}rc(h]h]h]h]h]uh-Kh/]rd(hj)re}rf(hX **Default:**h}rg(h]h]h]h]h]uhjah/]rhh8XDefault:rirj}rk(hUhjeubah'hrubh8X onrlrm}rn(hX onhjaubeubh<)ro}rp(hX2Can be used to turn DNS name resolution on or off.rqhjOh&hh'h@h}rr(h]h]h]h]h]uh-Kh/]rsh8X2Can be used to turn DNS name resolution on or off.rtru}rv(hjqhjoubaubeubh)rw}rx(hX**net.permitACLWarning** [on/off] available in 8.6.0+ **Default:** on If "off", suppress warnings issued when messages are received from non-authorized machines (those, that are in no AllowedSender list). hhUh&hh'hch}ry(h]h]h]h]h]uh-Nh.hh/]rz(h<)r{}r|(hX5**net.permitACLWarning** [on/off] available in 8.6.0+hjwh&hh'h@h}r}(h]h]h]h]h]uh-Kh/]r~(hj)r}r(hX**net.permitACLWarning**h}r(h]h]h]h]h]uhj{h/]rh8Xnet.permitACLWarningrr}r(hUhjubah'hrubh8X [on/off] available in 8.6.0+rr}r(hX [on/off] available in 8.6.0+hj{ubeubh<)r}r(hX**Default:** onhjwh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X onrr}r(hX onhjubeubh<)r}r(hXIf "off", suppress warnings issued when messages are received from non-authorized machines (those, that are in no AllowedSender list).rhjwh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XIf "off", suppress warnings issued when messages are received from non-authorized machines (those, that are in no AllowedSender list).rr}r(hjhjubaubeubh)r}r(hX**parser.parseHostnameAndTag** [on/off] available in 8.6.0+ **Default:** on This controls wheter the parsers try to parse HOSTNAME and TAG fields from messages. The default is "on", in which case parsing occurs. If set to "off", the fields are not parsed. Note that this usually is **not** what you want to have. It is highly suggested to change this setting to "off" only if you know exactly why you are doing this. hhUh&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX;**parser.parseHostnameAndTag** [on/off] available in 8.6.0+hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX**parser.parseHostnameAndTag**h}r(h]h]h]h]h]uhjh/]rh8Xparser.parseHostnameAndTagrr}r(hUhjubah'hrubh8X [on/off] available in 8.6.0+rr}r(hX [on/off] available in 8.6.0+hjubeubh<)r}r(hX**Default:** onhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X onrr}r(hX onhjubeubh<)r}r(hXThis controls wheter the parsers try to parse HOSTNAME and TAG fields from messages. The default is "on", in which case parsing occurs. If set to "off", the fields are not parsed. Note that this usually is **not** what you want to have.hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(h8XThis controls wheter the parsers try to parse HOSTNAME and TAG fields from messages. The default is "on", in which case parsing occurs. If set to "off", the fields are not parsed. Note that this usually is rr}r(hXThis controls wheter the parsers try to parse HOSTNAME and TAG fields from messages. The default is "on", in which case parsing occurs. If set to "off", the fields are not parsed. Note that this usually is hjubhj)r}r(hX**not**h}r(h]h]h]h]h]uhjh/]rh8Xnotrr}r(hUhjubah'hrubh8X what you want to have.rr}r(hX what you want to have.hjubeubh<)r}r(hXgIt is highly suggested to change this setting to "off" only if you know exactly why you are doing this.rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XgIt is highly suggested to change this setting to "off" only if you know exactly why you are doing this.rr}r(hjhjubaubeubh)r}r(hXE**senders.keepTrack** [on/off] available 8.17.0+ **Default:** off If turned on, rsyslog keeps track of known senders and also reports statistical data for them via the impstats mechanism. A list of active senders is kept. When a new sender is detected, an informational message is emitted. Senders are purged from the list only after a timeout (see *senders.timoutAfter* parameter). Note that we do not intentionally remove a sender when a connection is closed. The whole point of this sender-tracking is to have the ability to provide longer-duration data. As such, we would not like to drop information just because the sender has disconnected for a short period of time (e.g. for a reboot). Senders are tracked by their hostname (taken at connection establishment). Note: currently only imptcp and imtcp support sender tracking. hhUh&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX0**senders.keepTrack** [on/off] available 8.17.0+hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX**senders.keepTrack**h}r(h]h]h]h]h]uhjh/]rh8Xsenders.keepTrackrr}r(hUhjubah'hrubh8X [on/off] available 8.17.0+rr}r(hX [on/off] available 8.17.0+hjubeubh<)r}r(hX**Default:** offhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X offrr}r(hX offhjubeubh<)r}r(hXyIf turned on, rsyslog keeps track of known senders and also reports statistical data for them via the impstats mechanism.rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XyIf turned on, rsyslog keeps track of known senders and also reports statistical data for them via the impstats mechanism.rr}r(hjhjubaubh<)r}r(hXA list of active senders is kept. When a new sender is detected, an informational message is emitted. Senders are purged from the list only after a timeout (see *senders.timoutAfter* parameter). Note that we do not intentionally remove a sender when a connection is closed. The whole point of this sender-tracking is to have the ability to provide longer-duration data. As such, we would not like to drop information just because the sender has disconnected for a short period of time (e.g. for a reboot).hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(h8XA list of active senders is kept. When a new sender is detected, an informational message is emitted. Senders are purged from the list only after a timeout (see rr}r(hXA list of active senders is kept. When a new sender is detected, an informational message is emitted. Senders are purged from the list only after a timeout (see hjubh)r}r(hX*senders.timoutAfter*h}r (h]h]h]h]h]uhjh/]r h8Xsenders.timoutAfterr r }r (hUhjubah'hubh8XC parameter). Note that we do not intentionally remove a sender when a connection is closed. The whole point of this sender-tracking is to have the ability to provide longer-duration data. As such, we would not like to drop information just because the sender has disconnected for a short period of time (e.g. for a reboot).rr}r(hXC parameter). Note that we do not intentionally remove a sender when a connection is closed. The whole point of this sender-tracking is to have the ability to provide longer-duration data. As such, we would not like to drop information just because the sender has disconnected for a short period of time (e.g. for a reboot).hjubeubh<)r}r(hXJSenders are tracked by their hostname (taken at connection establishment).rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XJSenders are tracked by their hostname (taken at connection establishment).rr}r(hjhjubaubh<)r}r(hX>Note: currently only imptcp and imtcp support sender tracking.rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8X>Note: currently only imptcp and imtcp support sender tracking.rr}r (hjhjubaubeubh)r!}r"(hX)**senders.timeoutAfter** [seconds] available 8.17.0+ **Default:** 12 hours (12*60*60 seconds) Specifies after which period a sender is considered to "have gone away". For each sender, rsyslog keeps track of the time it least received messages from it. When it has not received a message during that interval, rsyslog considers the sender to be no longer present. It will then a) emit a warning message (if configured) and b) purge it from the active senders list. As such, the sender will no longer be reported in impstats data once it has timed out. hhUh&hh'hch}r#(h]h]h]h]h]uh-Nh.hh/]r$(h<)r%}r&(hX4**senders.timeoutAfter** [seconds] available 8.17.0+hj!h&hh'h@h}r'(h]h]h]h]h]uh-Kh/]r((hj)r)}r*(hX**senders.timeoutAfter**h}r+(h]h]h]h]h]uhj%h/]r,h8Xsenders.timeoutAfterr-r.}r/(hUhj)ubah'hrubh8X [seconds] available 8.17.0+r0r1}r2(hX [seconds] available 8.17.0+hj%ubeubh<)r3}r4(hX(**Default:** 12 hours (12*60*60 seconds)hj!h&hh'h@h}r5(h]h]h]h]h]uh-Kh/]r6(hj)r7}r8(hX **Default:**h}r9(h]h]h]h]h]uhj3h/]r:h8XDefault:r;r<}r=(hUhj7ubah'hrubh8X 12 hours (12*60*60 seconds)r>r?}r@(hX 12 hours (12*60*60 seconds)hj3ubeubh<)rA}rB(hXSpecifies after which period a sender is considered to "have gone away". For each sender, rsyslog keeps track of the time it least received messages from it. When it has not received a message during that interval, rsyslog considers the sender to be no longer present. It will then a) emit a warning message (if configured) and b) purge it from the active senders list. As such, the sender will no longer be reported in impstats data once it has timed out.rChj!h&hh'h@h}rD(h]h]h]h]h]uh-Kh/]rEh8XSpecifies after which period a sender is considered to "have gone away". For each sender, rsyslog keeps track of the time it least received messages from it. When it has not received a message during that interval, rsyslog considers the sender to be no longer present. It will then a) emit a warning message (if configured) and b) purge it from the active senders list. As such, the sender will no longer be reported in impstats data once it has timed out.rFrG}rH(hjChjAubaubeubh)rI}rJ(hX**senders.reportGoneAway** [on/off] available 8.17.0+ **Default:** off Emit a warning message when now data has been received from a sender within the *senders.timeoutAfter* interval. hhUh&hh'hch}rK(h]h]h]h]h]uh-Nh.hh/]rL(h<)rM}rN(hX5**senders.reportGoneAway** [on/off] available 8.17.0+hjIh&hh'h@h}rO(h]h]h]h]h]uh-Kh/]rP(hj)rQ}rR(hX**senders.reportGoneAway**h}rS(h]h]h]h]h]uhjMh/]rTh8Xsenders.reportGoneAwayrUrV}rW(hUhjQubah'hrubh8X [on/off] available 8.17.0+rXrY}rZ(hX [on/off] available 8.17.0+hjMubeubh<)r[}r\(hX**Default:** offhjIh&hh'h@h}r](h]h]h]h]h]uh-Kh/]r^(hj)r_}r`(hX **Default:**h}ra(h]h]h]h]h]uhj[h/]rbh8XDefault:rcrd}re(hUhj_ubah'hrubh8X offrfrg}rh(hX offhj[ubeubh<)ri}rj(hXpEmit a warning message when now data has been received from a sender within the *senders.timeoutAfter* interval.hjIh&hh'h@h}rk(h]h]h]h]h]uh-Kh/]rl(h8XPEmit a warning message when now data has been received from a sender within the rmrn}ro(hXPEmit a warning message when now data has been received from a sender within the hjiubh)rp}rq(hX*senders.timeoutAfter*h}rr(h]h]h]h]h]uhjih/]rsh8Xsenders.timeoutAfterrtru}rv(hUhjpubah'hubh8X interval.rwrx}ry(hX interval.hjiubeubeubh)rz}r{(hX**senders.reportNew** [on/off] available 8.17.0+ **Default:** off If sender tracking is active, report a sender that is not yet inside the cache. Note that this means that senders which have been timed out due to prolonged inactivity are also reported once they connect again. hhUh&hh'hch}r|(h]h]h]h]h]uh-Nh.hh/]r}(h<)r~}r(hX0**senders.reportNew** [on/off] available 8.17.0+hjzh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX**senders.reportNew**h}r(h]h]h]h]h]uhj~h/]rh8Xsenders.reportNewrr}r(hUhjubah'hrubh8X [on/off] available 8.17.0+rr}r(hX [on/off] available 8.17.0+hj~ubeubh<)r}r(hX**Default:** offhjzh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X offrr}r(hX offhjubeubh<)r}r(hXIf sender tracking is active, report a sender that is not yet inside the cache. Note that this means that senders which have been timed out due to prolonged inactivity are also reported once they connect again.rhjzh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XIf sender tracking is active, report a sender that is not yet inside the cache. Note that this means that senders which have been timed out due to prolonged inactivity are also reported once they connect again.rr}r(hjhjubaubeubh)r}r(hX**debug.unloadModules** [on/off] available 8.17.0+ **Default:** on This is primarily a debug setting. If set to "off", rsyslog will never unload any modules (including plugins). This usually causes no operational problems, but may in extreme cases. The core benefit of this setting is that it makes valgrind stack traces readable. In previous versions, the same functionality was only available via a special build option. hhUh&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX2**debug.unloadModules** [on/off] available 8.17.0+hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX**debug.unloadModules**h}r(h]h]h]h]h]uhjh/]rh8Xdebug.unloadModulesrr}r(hUhjubah'hrubh8X [on/off] available 8.17.0+rr}r(hX [on/off] available 8.17.0+hjubeubh<)r}r(hX**Default:** onhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X onrr}r(hX onhjubeubh<)r}r(hXcThis is primarily a debug setting. If set to "off", rsyslog will never unload any modules (including plugins). This usually causes no operational problems, but may in extreme cases. The core benefit of this setting is that it makes valgrind stack traces readable. In previous versions, the same functionality was only available via a special build option.rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XcThis is primarily a debug setting. If set to "off", rsyslog will never unload any modules (including plugins). This usually causes no operational problems, but may in extreme cases. The core benefit of this setting is that it makes valgrind stack traces readable. In previous versions, the same functionality was only available via a special build option.rr}r(hjhjubaubeubh)r}r(hX**environment** [ARRAY of environment variable=value strings] available 8.23.0+ **Default:** none This permits to set environment variables via rsyslog.conf. The prime motivation for having this is that for many libraries, defaults can be set via environment variables, **but** setting them via operating system service startup files is cumbersome and different on different platforms. So the *environment* parameter provides a handy way to set those variables. A common example is to set the *http_proxy* variable, e.g. for use with KSI signing or ElasticSearch. This can be done as follows:: global(environment="http_proxy=http://myproxy.example.net") Note that an environment variable set this way must contain an equal sign, and the variable name must not be longer than 127 characters. It is possible to set multiple environment variables in a single global statement. This is done in regular array syntax as follows:: global(environment=["http_proxy=http://myproxy.example.net", "another_one=this string is=ok!" ) As usual, whitespace is irrelevant in regard to parameter placing. So the above sample could also have been written on a single line. **Caution:** Environment variables are set immediately when the corresponding statement is encountered. Likewise, modules are loaded when the module load statement is encountered. This may create **sequence dependencies** inside rsyslog.conf. To avoid this, it is highly suggested that environment variables are set **right at the top of rsyslog.conf**. Also, rsyslog-related environment variables may not apply even when set right at the top. It is safest to still set them in operating system start files. Note that rsyslog environment variables are usually intended only for developers so there should hardly be a need to set them for a regular user. Also, many settings (e.g. debug) are also available as configuration objects.hhUh&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hXO**environment** [ARRAY of environment variable=value strings] available 8.23.0+rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX**environment**h}r(h]h]h]h]h]uhjh/]rh8X environmentrr}r(hUhjubah'hrubh8X@ [ARRAY of environment variable=value strings] available 8.23.0+rr}r(hX@ [ARRAY of environment variable=value strings] available 8.23.0+hjubeubh<)r}r(hX**Default:** nonerhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX **Default:**h}r(h]h]h]h]h]uhjh/]rh8XDefault:rr}r(hUhjubah'hrubh8X nonerr}r(hX nonehjubeubh<)r}r(hXkThis permits to set environment variables via rsyslog.conf. The prime motivation for having this is that for many libraries, defaults can be set via environment variables, **but** setting them via operating system service startup files is cumbersome and different on different platforms. So the *environment* parameter provides a handy way to set those variables.hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(h8XThis permits to set environment variables via rsyslog.conf. The prime motivation for having this is that for many libraries, defaults can be set via environment variables, rr}r(hXThis permits to set environment variables via rsyslog.conf. The prime motivation for having this is that for many libraries, defaults can be set via environment variables, hjubhj)r}r(hX**but**h}r(h]h]h]h]h]uhjh/]rh8Xbutrr}r(hUhjubah'hrubh8Xt setting them via operating system service startup files is cumbersome and different on different platforms. So the rr}r(hXt setting them via operating system service startup files is cumbersome and different on different platforms. So the hjubh)r}r(hX *environment*h}r(h]h]h]h]h]uhjh/]rh8X environmentrr}r(hUhjubah'hubh8X7 parameter provides a handy way to set those variables.rr}r(hX7 parameter provides a handy way to set those variables.hjubeubh<)r}r(hXA common example is to set the *http_proxy* variable, e.g. for use with KSI signing or ElasticSearch. This can be done as follows::hjh&hh'h@h}r (h]h]h]h]h]uh-Kh/]r (h8XA common example is to set the r r }r (hXA common example is to set the hjubh)r}r(hX *http_proxy*h}r(h]h]h]h]h]uhjh/]rh8X http_proxyrr}r(hUhjubah'hubh8XW variable, e.g. for use with KSI signing or ElasticSearch. This can be done as follows:rr}r(hXW variable, e.g. for use with KSI signing or ElasticSearch. This can be done as follows:hjubeubcdocutils.nodes literal_block r)r}r(hX;global(environment="http_proxy=http://myproxy.example.net")hjh'U literal_blockrh}r(U xml:spacerUpreserverh]h]h]h]h]uh-Kh/]rh8X;global(environment="http_proxy=http://myproxy.example.net")r r!}r"(hUhjubaubh<)r#}r$(hXNote that an environment variable set this way must contain an equal sign, and the variable name must not be longer than 127 characters.r%hjh&hh'h@h}r&(h]h]h]h]h]uh-Kh/]r'h8XNote that an environment variable set this way must contain an equal sign, and the variable name must not be longer than 127 characters.r(r)}r*(hj%hj#ubaubh<)r+}r,(hXIt is possible to set multiple environment variables in a single global statement. This is done in regular array syntax as follows::hjh&hh'h@h}r-(h]h]h]h]h]uh-Kh/]r.h8XIt is possible to set multiple environment variables in a single global statement. This is done in regular array syntax as follows:r/r0}r1(hXIt is possible to set multiple environment variables in a single global statement. This is done in regular array syntax as follows:hj+ubaubj)r2}r3(hXyglobal(environment=["http_proxy=http://myproxy.example.net", "another_one=this string is=ok!" )hjh'jh}r4(jjh]h]h]h]h]uh-Kh/]r5h8Xyglobal(environment=["http_proxy=http://myproxy.example.net", "another_one=this string is=ok!" )r6r7}r8(hUhj2ubaubh<)r9}r:(hXAs usual, whitespace is irrelevant in regard to parameter placing. So the above sample could also have been written on a single line.r;hjh&hh'h@h}r<(h]h]h]h]h]uh-Kh/]r=h8XAs usual, whitespace is irrelevant in regard to parameter placing. So the above sample could also have been written on a single line.r>r?}r@(hj;hj9ubaubh<)rA}rB(hX**Caution:** Environment variables are set immediately when the corresponding statement is encountered. Likewise, modules are loaded when the module load statement is encountered. This may create **sequence dependencies** inside rsyslog.conf. To avoid this, it is highly suggested that environment variables are set **right at the top of rsyslog.conf**. Also, rsyslog-related environment variables may not apply even when set right at the top. It is safest to still set them in operating system start files. Note that rsyslog environment variables are usually intended only for developers so there should hardly be a need to set them for a regular user. Also, many settings (e.g. debug) are also available as configuration objects.hjh&hh'h@h}rC(h]h]h]h]h]uh-Kh/]rD(hj)rE}rF(hX **Caution:**h}rG(h]h]h]h]h]uhjAh/]rHh8XCaution:rIrJ}rK(hUhjEubah'hrubh8X Environment variables are set immediately when the corresponding statement is encountered. Likewise, modules are loaded when the module load statement is encountered. This may create rLrM}rN(hX Environment variables are set immediately when the corresponding statement is encountered. Likewise, modules are loaded when the module load statement is encountered. This may create hjAubhj)rO}rP(hX**sequence dependencies**h}rQ(h]h]h]h]h]uhjAh/]rRh8Xsequence dependenciesrSrT}rU(hUhjOubah'hrubh8X_ inside rsyslog.conf. To avoid this, it is highly suggested that environment variables are set rVrW}rX(hX_ inside rsyslog.conf. To avoid this, it is highly suggested that environment variables are set hjAubhj)rY}rZ(hX$**right at the top of rsyslog.conf**h}r[(h]h]h]h]h]uhjAh/]r\h8X right at the top of rsyslog.confr]r^}r_(hUhjYubah'hrubh8X{. Also, rsyslog-related environment variables may not apply even when set right at the top. It is safest to still set them in operating system start files. Note that rsyslog environment variables are usually intended only for developers so there should hardly be a need to set them for a regular user. Also, many settings (e.g. debug) are also available as configuration objects.r`ra}rb(hX{. Also, rsyslog-related environment variables may not apply even when set right at the top. It is safest to still set them in operating system start files. Note that rsyslog environment variables are usually intended only for developers so there should hardly be a need to set them for a regular user. Also, many settings (e.g. debug) are also available as configuration objects.hjAubeubeubeubeubh&hh'hYh}rc(h[X-h]h]h]h]h]uh-K h.hh/]rd(h)re}rf(hX**action.reportSuspension** - binary, default "on", v7.5.8+ If enabled ("on") action will log message under *syslog.\** when an action suspends or resumes itself. This usually happens when there are problems connecting to backend systems. If disabled ("off"), these messages are not generated. These messages can be useful in detecting problems with backend systems. Most importantly, frequent suspension and resumption points to a problem area. hh!h&hh'hch}rg(h]h]h]h]h]uh-Nh.hh/]rh(h<)ri}rj(hX;**action.reportSuspension** - binary, default "on", v7.5.8+hjeh&hh'h@h}rk(h]h]h]h]h]uh-K h/]rl(hj)rm}rn(hX**action.reportSuspension**h}ro(h]h]h]h]h]uhjih/]rph8Xaction.reportSuspensionrqrr}rs(hUhjmubah'hrubh8X - binary, default "on", v7.5.8+rtru}rv(hX - binary, default "on", v7.5.8+hjiubeubh<)rw}rx(hXIf enabled ("on") action will log message under *syslog.\** when an action suspends or resumes itself. This usually happens when there are problems connecting to backend systems. If disabled ("off"), these messages are not generated. These messages can be useful in detecting problems with backend systems. Most importantly, frequent suspension and resumption points to a problem area.hjeh&hh'h@h}ry(h]h]h]h]h]uh-K h/]rz(h8X0If enabled ("on") action will log message under r{r|}r}(hX0If enabled ("on") action will log message under hjwubh)r~}r(hX *syslog.\**h}r(h]h]h]h]h]uhjwh/]rh8Xsyslog.*rr}r(hUhj~ubah'hubh8XF when an action suspends or resumes itself. This usually happens when there are problems connecting to backend systems. If disabled ("off"), these messages are not generated. These messages can be useful in detecting problems with backend systems. Most importantly, frequent suspension and resumption points to a problem area.rr}r(hXF when an action suspends or resumes itself. This usually happens when there are problems connecting to backend systems. If disabled ("off"), these messages are not generated. These messages can be useful in detecting problems with backend systems. Most importantly, frequent suspension and resumption points to a problem area.hjwubeubeubh)r}r(hXQ**action.reportSuspensionContinuation** - binary, default "off", v7.6.1+, v8.2.0+ If enabled ("on") the action will not only report the first suspension but each time the suspension is prolonged. Otherwise, the follow-up messages are not logged. If this setting is set to "on", action.reportSuspension is also automaticaly turned "on". hh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hXQ**action.reportSuspensionContinuation** - binary, default "off", v7.6.1+, v8.2.0+hjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]r(hj)r}r(hX'**action.reportSuspensionContinuation**h}r(h]h]h]h]h]uhjh/]rh8X#action.reportSuspensionContinuationrr}r(hUhjubah'hrubh8X* - binary, default "off", v7.6.1+, v8.2.0+rr}r(hX* - binary, default "off", v7.6.1+, v8.2.0+hjubeubh<)r}r(hXIf enabled ("on") the action will not only report the first suspension but each time the suspension is prolonged. Otherwise, the follow-up messages are not logged. If this setting is set to "on", action.reportSuspension is also automaticaly turned "on".rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rh8XIf enabled ("on") the action will not only report the first suspension but each time the suspension is prolonged. Otherwise, the follow-up messages are not logged. If this setting is set to "on", action.reportSuspension is also automaticaly turned "on".rr}r(hjhjubaubeubh)r}r(hX**workDirectory**rhh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]rh<)r}r(hjhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8X workDirectoryrr}r(hUhjubah'hrubaubaubh)r}r(hX&**dropMsgsWithMaliciousDNSPtrRecords**rhh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]rh<)r}r(hjhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8X"dropMsgsWithMaliciousDNSPtrRecordsrr}r(hUhjubah'hrubaubaubh)r}r(hX**localHostname**rhh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]rh<)r}r(hjhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8X localHostnamerr}r(hUhjubah'hrubaubaubh)r}r(hX**preserveFQDN**rhh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]rh<)r}r(hjhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8X preserveFQDNrr}r(hUhjubah'hrubaubaubh)r}r(hX**defaultNetstreamDriverCAFile** For `TLS syslog `_, the CA certificate that can verify the machine keys and certs (see below) hh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX **defaultNetstreamDriverCAFile**rhjh&hh'h@h}r(h]h]h]h]h]uh-Kh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8XdefaultNetstreamDriverCAFilerr}r(hUhjubah'hrubaubh<)r}r(hXFor `TLS syslog `_, the CA certificate that can verify the machine keys and certs (see below)hjh&hh'h@h}r(h]h]h]h]h]uh-K!h/]r(h8XFor rr}r(hXFor hjubcdocutils.nodes reference r)r}r(hXB`TLS syslog `_h}r(UnameX TLS syslogUrefurirX2http://www.rsyslog.com/doc/rsyslog_secure_tls.htmlrh]h]h]h]h]uhjh/]rh8X TLS syslogrr}r(hUhjubah'U referencerubhN)r}r(hX5 U referencedrKhjh'hQh}r(Urefurijh]rU tls-syslogr ah]h]h]h]r hauh/]ubh8XK, the CA certificate that can verify the machine keys and certs (see below)r r }r (hXK, the CA certificate that can verify the machine keys and certs (see below)hjubeubeubh)r}r(hX7**defaultNetstreamDriverKeyFile** Machine private key hh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX!**defaultNetstreamDriverKeyFile**rhjh&hh'h@h}r(h]h]h]h]h]uh-K$h/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8XdefaultNetstreamDriverKeyFilerr}r(hUhjubah'hrubaubh<)r}r(hXMachine private keyr hjh&hh'h@h}r!(h]h]h]h]h]uh-K&h/]r"h8XMachine private keyr#r$}r%(hj hjubaubeubh)r&}r'(hXE**defaultNetstreamDriverCertFile** Machine public key (certificate) hh!h&hh'hch}r((h]h]h]h]h]uh-Nh.hh/]r)(h<)r*}r+(hX"**defaultNetstreamDriverCertFile**r,hj&h&hh'h@h}r-(h]h]h]h]h]uh-K(h/]r.hj)r/}r0(hj,h}r1(h]h]h]h]h]uhj*h/]r2h8XdefaultNetstreamDriverCertFiler3r4}r5(hUhj/ubah'hrubaubh<)r6}r7(hX Machine public key (certificate)r8hj&h&hh'h@h}r9(h]h]h]h]h]uh-K*h/]r:h8X Machine public key (certificate)r;r<}r=(hj8hj6ubaubeubh)r>}r?(hX**debug.gnutls** (0-10; default:0) Any other parameter than 0 enables the debug messages of GnuTLS. the amount of messages given depends on the height of the parameter, 0 being nothing and 10 being very much. Caution! higher parameters may give out way more information than needed. We advise you to first use small parameters to prevent that from happening. **This parameter only has an effect if general debugging is enabled.** hh!h&hh'hch}r@(h]h]h]h]h]uh-Nh.hh/]rA(h<)rB}rC(hX"**debug.gnutls** (0-10; default:0)hj>h&hh'h@h}rD(h]h]h]h]h]uh-K,h/]rE(hj)rF}rG(hX**debug.gnutls**h}rH(h]h]h]h]h]uhjBh/]rIh8X debug.gnutlsrJrK}rL(hUhjFubah'hrubh8X (0-10; default:0)rMrN}rO(hX (0-10; default:0)hjBubeubh<)rP}rQ(hXAny other parameter than 0 enables the debug messages of GnuTLS. the amount of messages given depends on the height of the parameter, 0 being nothing and 10 being very much. Caution! higher parameters may give out way more information than needed. We advise you to first use small parameters to prevent that from happening. **This parameter only has an effect if general debugging is enabled.**hj>h&hh'h@h}rR(h]h]h]h]h]uh-K.h/]rS(h8XDAny other parameter than 0 enables the debug messages of GnuTLS. the amount of messages given depends on the height of the parameter, 0 being nothing and 10 being very much. Caution! higher parameters may give out way more information than needed. We advise you to first use small parameters to prevent that from happening. rTrU}rV(hXDAny other parameter than 0 enables the debug messages of GnuTLS. the amount of messages given depends on the height of the parameter, 0 being nothing and 10 being very much. Caution! higher parameters may give out way more information than needed. We advise you to first use small parameters to prevent that from happening. hjPubhj)rW}rX(hXF**This parameter only has an effect if general debugging is enabled.**h}rY(h]h]h]h]h]uhjPh/]rZh8XBThis parameter only has an effect if general debugging is enabled.r[r\}r](hUhjWubah'hrubeubeubh)r^}r_(hX**processInternalMessages** binary (on/off) This tell rsyslog if it shall process internal messages itself. This is the default mode of operations ("on") and usually the best. However, if this (instance) of rsyslog is not the main instance and there is another main logging system, rsyslog internal messages will not be inserted into the main instance's syslog stream. To do this, set the parameter to "off", in which case rsyslog will send messages to the system log sink (and if it is the only instance, receive them back from there). This also works with systemd journal and will make rsyslog messages show up in the systemd status control information. hh!h&hh'hch}r`(h]h]h]h]h]uh-Nh.hh/]ra(h<)rb}rc(hX+**processInternalMessages** binary (on/off)hj^h&hh'h@h}rd(h]h]h]h]h]uh-K5h/]re(hj)rf}rg(hX**processInternalMessages**h}rh(h]h]h]h]h]uhjbh/]rih8XprocessInternalMessagesrjrk}rl(hUhjfubah'hrubh8X binary (on/off)rmrn}ro(hX binary (on/off)hjbubeubh<)rp}rq(hXcThis tell rsyslog if it shall process internal messages itself. This is the default mode of operations ("on") and usually the best. However, if this (instance) of rsyslog is not the main instance and there is another main logging system, rsyslog internal messages will not be inserted into the main instance's syslog stream. To do this, set the parameter to "off", in which case rsyslog will send messages to the system log sink (and if it is the only instance, receive them back from there). This also works with systemd journal and will make rsyslog messages show up in the systemd status control information.rrhj^h&hh'h@h}rs(h]h]h]h]h]uh-K7h/]rth8XcThis tell rsyslog if it shall process internal messages itself. This is the default mode of operations ("on") and usually the best. However, if this (instance) of rsyslog is not the main instance and there is another main logging system, rsyslog internal messages will not be inserted into the main instance's syslog stream. To do this, set the parameter to "off", in which case rsyslog will send messages to the system log sink (and if it is the only instance, receive them back from there). This also works with systemd journal and will make rsyslog messages show up in the systemd status control information.rurv}rw(hjrhjpubaubeubh)rx}ry(hX7**stdlog.channelspec** Permits to set the liblogging-stdlog channel specifier string. This in turn permits to send rsyslog log messages to a destination different from the system default. Note that this parameter has only effect if *processInternalMessages* is set to "off". Otherwise it is silently ignored. hh!h&hh'hch}rz(h]h]h]h]h]uh-Nh.hh/]r{(h<)r|}r}(hX**stdlog.channelspec**r~hjxh&hh'h@h}r(h]h]h]h]h]uh-KAh/]rhj)r}r(hj~h}r(h]h]h]h]h]uhj|h/]rh8Xstdlog.channelspecrr}r(hUhjubah'hrubaubh<)r}r(hXPermits to set the liblogging-stdlog channel specifier string. This in turn permits to send rsyslog log messages to a destination different from the system default. Note that this parameter has only effect if *processInternalMessages* is set to "off". Otherwise it is silently ignored.hjxh&hh'h@h}r(h]h]h]h]h]uh-KCh/]r(h8XPermits to set the liblogging-stdlog channel specifier string. This in turn permits to send rsyslog log messages to a destination different from the system default. Note that this parameter has only effect if rr}r(hXPermits to set the liblogging-stdlog channel specifier string. This in turn permits to send rsyslog log messages to a destination different from the system default. Note that this parameter has only effect if hjubh)r}r(hX*processInternalMessages*h}r(h]h]h]h]h]uhjh/]rh8XprocessInternalMessagesrr}r(hUhjubah'hubh8X3 is set to "off". Otherwise it is silently ignored.rr}r(hX3 is set to "off". Otherwise it is silently ignored.hjubeubeubhh)r}r(hX**maxMessageSize** The maximum message size rsyslog can process. Default is 8K. Anything above the maximum size will be truncated. hh!h&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX**maxMessageSize**rhjh&hh'h@h}r(h]h]h]h]h]uh-KNh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8XmaxMessageSizerr}r(hUhjubah'hrubaubh<)r}r(hXoThe maximum message size rsyslog can process. Default is 8K. Anything above the maximum size will be truncated.rhjh&hh'h@h}r(h]h]h]h]h]uh-KPh/]rh8XoThe maximum message size rsyslog can process. Default is 8K. Anything above the maximum size will be truncated.rr}r(hjhjubaubeubeubh&hh'hch}r(h]h]h]h]h]uh-Nh.hh/]r(h<)r}r(hX**defaultNetstreamDriver**rhhh&hh'h@h}r(h]h]h]h]h]uh-KJh/]rhj)r}r(hjh}r(h]h]h]h]h]uhjh/]rh8XdefaultNetstreamDriverrr}r(hUhjubah'hrubaubh<)r}r(hXeSet it to "gtls" to enable TLS for `TLS syslog `_hhh&hh'h@h}r(h]h]h]h]h]uh-KLh/]r(h8X#Set it to "gtls" to enable TLS for rr}r(hX#Set it to "gtls" to enable TLS for hjubj)r}r(hXB`TLS syslog `_h}r(UnameX TLS syslogjX2http://www.rsyslog.com/doc/rsyslog_secure_tls.htmlrh]h]h]h]h]uhjh/]rh8X TLS syslogrr}r(hUhjubah'jubhN)r}r(hX5 jKhjh'hQh}r(Urefurijh]rhah]h]rX tls syslograh]h]uh/]ubeubeubh/]rh<)r}r(hX-Duplicate explicit target name: "tls syslog".h}r(h]h]h]h]h]uhhh/]rh8X-Duplicate explicit target name: "tls syslog".rr}r(hUhjubah'h@ubah'Usystem_messagerubaUcurrent_sourcerNU decorationrNUautofootnote_startrKUnameidsr}r(hhThj hh+uh/]rh$ahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh.hU current_linerNUtransform_messagesr]rh )r}r(hUh}r(h]UlevelKh]h]Usourcehh]h]UlineKSUtypehuh/]rh<)r}r(hUh}r(h]h]h]h]h]uhjh/]rh8X<Hyperlink target "global-janitorinterval" is not referenced.rr}r(hUhjubah'h@ubah'jubaUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r (Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlr Uhttps://tools.ietf.org/html/r U tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh5NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformr KUdump_transformsr!NU docinfo_xformr"KUwarning_streamr#NUpep_file_url_templater$Upep-%04dr%Uexit_status_levelr&KUconfigr'NUstrict_visitorr(NUcloak_email_addressesr)Utrim_footnote_reference_spacer*Uenvr+NUdump_pseudo_xmlr,NUexpose_internalsr-NUsectsubtitle_xformr.U source_linkr/NUrfc_referencesr0NUoutput_encodingr1Uutf-8r2U source_urlr3NUinput_encodingr4U utf-8-sigr5U_disable_configr6NU id_prefixr7UU tab_widthr8KUerror_encodingr9UUTF-8r:U_sourcer;hUgettext_compactr<U generatorr=NUdump_internalsr>NU smart_quotesr?U pep_base_urlr@U https://www.python.org/dev/peps/rAUsyntax_highlightrBUlongrCUinput_encoding_error_handlerrDjUauto_id_prefixrEUidrFUdoctitle_xformrGUstrip_elements_with_classesrHNU _config_filesrI]rJUfile_insertion_enabledrKU raw_enabledrLKU dump_settingsrMNubUsymbol_footnote_startrNKUidsrO}rP(hThUj jh+h$hjuUsubstitution_namesrQ}rRh'h.h}rS(h]h]h]Usourcehh]h]uU footnotesrT]rUUrefidsrV}rWhT]rXhOasub.build/.doctrees/rainerscript/configuration_objects.doctree0000664000175000017500000001773413035122643023174 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X#rsyslog global configuration objectqXparser()qNXglobal()qNXmodule()q NX timezone()q NXconfiguration objectsq NXaction()q NXinput()q NuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU#rsyslog-global-configuration-objectqhUparserqhUglobalqh Umoduleqh Utimezoneqh Uconfiguration-objectsqh Uactionqh UinputquUchildrenq]q cdocutils.nodes section q!)q"}q#(U rawsourceq$UUparentq%hUsourceq&XI/home/rger/proj/rsyslog-doc/source/rainerscript/configuration_objects.rstq'Utagnameq(Usectionq)U attributesq*}q+(Udupnamesq,]Uclassesq-]Ubackrefsq.]Uidsq/]q0haUnamesq1]q2h auUlineq3KUdocumentq4hh]q5(cdocutils.nodes title q6)q7}q8(h$Xconfiguration objectsq9h%h"h&h'h(Utitleq:h*}q;(h,]h-]h.]h/]h1]uh3Kh4hh]qq?}q@(h$h9h%h7ubaubh!)qA}qB(h$Uh%h"h&h'h(h)h*}qC(h,]h-]h.]h/]qDhah1]qEh auh3Kh4hh]qF(h6)qG}qH(h$Xaction()qIh%hAh&h'h(h:h*}qJ(h,]h-]h.]h/]h1]uh3Kh4hh]qKh=Xaction()qLqM}qN(h$hIh%hGubaubcdocutils.nodes paragraph qO)qP}qQ(h$XrThe :doc:`action <../configuration/actions>` object is the primary means of describing actions to be carried out.h%hAh&h'h(U paragraphqRh*}qS(h,]h-]h.]h/]h1]uh3Kh4hh]qT(h=XThe qUqV}qW(h$XThe h%hPubcsphinx.addnodes pending_xref qX)qY}qZ(h$X(:doc:`action <../configuration/actions>`q[h%hPh&h'h(U pending_xrefq\h*}q](UreftypeXdocq^Urefwarnq_U reftargetq`X../configuration/actionsU refdomainUh/]h.]U refexplicith,]h-]h1]UrefdocqaX"rainerscript/configuration_objectsqbuh3Kh]qccdocutils.nodes literal qd)qe}qf(h$h[h*}qg(h,]h-]qh(Uxrefqih^eh.]h/]h1]uh%hYh]qjh=Xactionqkql}qm(h$Uh%heubah(Uliteralqnubaubh=XF object is the primary means of describing actions to be carried out.qoqp}qq(h$XF object is the primary means of describing actions to be carried out.h%hPubeubeubh!)qr}qs(h$Uh%h"h&h'h(h)h*}qt(h,]h-]h.]h/]quhah1]qvhauh3K h4hh]qw(h6)qx}qy(h$Xglobal()qzh%hrh&h'h(h:h*}q{(h,]h-]h.]h/]h1]uh3K h4hh]q|h=Xglobal()q}q~}q(h$hzh%hxubaubhO)q}q(h$XThis is used to set global configuration parameters. For details, please see the `rsyslog global configuration object `_.h%hrh&h'h(hRh*}q(h,]h-]h.]h/]h1]uh3K h4hh]q(h=XQThis is used to set global configuration parameters. For details, please see the qq}q(h$XQThis is used to set global configuration parameters. For details, please see the h%hubcdocutils.nodes reference q)q}q(h$X4`rsyslog global configuration object `_h*}q(UnameX#rsyslog global configuration objectUrefuriqX global.htmlqh/]h.]h,]h-]h1]uh%hh]qh=X#rsyslog global configuration objectqq}q(h$Uh%hubah(U referencequbcdocutils.nodes target q)q}q(h$X U referencedqKh%hh(Utargetqh*}q(Urefurihh/]qhah.]h,]h-]h1]qhauh]ubh=X.q}q(h$X.h%hubeubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qh auh3Kh4hh]q(h6)q}q(h$Xinput()qh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=Xinput()qq}q(h$hh%hubaubhO)q}q(h$XThe :doc:`input <../configuration/input>` object is the primary means of describing inputs, which are used to gather messages for rsyslog processing.h%hh&h'h(hRh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]q(h=XThe qq}q(h$XThe h%hubhX)q}q(h$X%:doc:`input <../configuration/input>`qh%hh&h'h(h\h*}q(UreftypeXdocqh_h`X../configuration/inputU refdomainUh/]h.]U refexplicith,]h-]h1]hahbuh3Kh]qhd)q}q(h$hh*}q(h,]h-]q(hiheh.]h/]h1]uh%hh]qh=Xinputqq}q(h$Uh%hubah(hnubaubh=Xl object is the primary means of describing inputs, which are used to gather messages for rsyslog processing.qq}q(h$Xl object is the primary means of describing inputs, which are used to gather messages for rsyslog processing.h%hubeubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qh auh3Kh4hh]q(h6)q}q(h$Xmodule()qh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=Xmodule()qͅq}q(h$hh%hubaubhO)q}q(h$X*The module object is used to load plugins.qh%hh&h'h(hRh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=X*The module object is used to load plugins.qՅq}q(h$hh%hubaubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qhauh3Kh4hh]q(h6)q}q(h$Xparser()qh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=Xparser()qㅁq}q(h$hh%hubaubhO)q}q(h$X[The :doc:`parser <../configuration/parser>` object is used to define custom parser objects.h%hh&h'h(hRh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]q(h=XThe qꅁq}q(h$XThe h%hubhX)q}q(h$X':doc:`parser <../configuration/parser>`qh%hh&h'h(h\h*}q(UreftypeXdocqh_h`X../configuration/parserU refdomainUh/]h.]U refexplicith,]h-]h1]hahbuh3Kh]qhd)q}q(h$hh*}q(h,]h-]q(hiheh.]h/]h1]uh%hh]qh=Xparserqq}q(h$Uh%hubah(hnubaubh=X0 object is used to define custom parser objects.qq}q(h$X0 object is used to define custom parser objects.h%hubeubeubh!)q}q(h$Uh%h"h&h'h(h)h*}r(h,]h-]h.]h/]rhah1]rh auh3K"h4hh]r(h6)r}r(h$X timezone()rh%hh&h'h(h:h*}r(h,]h-]h.]h/]h1]uh3K"h4hh]rh=X timezone()r r }r (h$jh%jubaubhO)r }r (h$X[The :doc:`timezone <../configuration/timezone>` object is used to define timezone settings.h%hh&h'h(hRh*}r(h,]h-]h.]h/]h1]uh3K$h4hh]r(h=XThe rr}r(h$XThe h%j ubhX)r}r(h$X+:doc:`timezone <../configuration/timezone>`rh%j h&h'h(h\h*}r(UreftypeXdocrh_h`X../configuration/timezoneU refdomainUh/]h.]U refexplicith,]h-]h1]hahbuh3K$h]rhd)r}r(h$jh*}r(h,]h-]r(hijeh.]h/]h1]uh%jh]rh=Xtimezonerr}r (h$Uh%jubah(hnubaubh=X, object is used to define timezone settings.r!r"}r#(h$X, object is used to define timezone settings.h%j ubeubeubeubah$UU transformerr$NU footnote_refsr%}r&Urefnamesr'}r(Usymbol_footnotesr)]r*Uautofootnote_refsr+]r,Usymbol_footnote_refsr-]r.U citationsr/]r0h4hU current_liner1NUtransform_messagesr2]r3Ureporterr4NUid_startr5KU autofootnotesr6]r7U citation_refsr8}r9Uindirect_targetsr:]r;Usettingsr<(cdocutils.frontend Values r=or>}r?(Ufootnote_backlinksr@KUrecord_dependenciesrANU rfc_base_urlrBUhttps://tools.ietf.org/html/rCU tracebackrDUpep_referencesrENUstrip_commentsrFNU toc_backlinksrGUentryrHU language_coderIUenrJU datestamprKNU report_levelrLKU _destinationrMNU halt_levelrNKU strip_classesrONh:NUerror_encoding_error_handlerrPUbackslashreplacerQUdebugrRNUembed_stylesheetrSUoutput_encoding_error_handlerrTUstrictrUU sectnum_xformrVKUdump_transformsrWNU docinfo_xformrXKUwarning_streamrYNUpep_file_url_templaterZUpep-%04dr[Uexit_status_levelr\KUconfigr]NUstrict_visitorr^NUcloak_email_addressesr_Utrim_footnote_reference_spacer`UenvraNUdump_pseudo_xmlrbNUexpose_internalsrcNUsectsubtitle_xformrdU source_linkreNUrfc_referencesrfNUoutput_encodingrgUutf-8rhU source_urlriNUinput_encodingrjU utf-8-sigrkU_disable_configrlNU id_prefixrmUU tab_widthrnKUerror_encodingroUUTF-8rpU_sourcerqh'Ugettext_compactrrU generatorrsNUdump_internalsrtNU smart_quotesruU pep_base_urlrvU https://www.python.org/dev/peps/rwUsyntax_highlightrxUlongryUinput_encoding_error_handlerrzjUUauto_id_prefixr{Uidr|Udoctitle_xformr}Ustrip_elements_with_classesr~NU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhrhhhh"hhhhAhhhhuUsubstitution_namesr}rh(h4h*}r(h,]h/]h.]Usourceh'h-]h1]uU footnotesr]rUrefidsr}rub.build/.doctrees/rainerscript/index.doctree0000664000175000017500000001145013035122644017711 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX rainerscriptqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU rainerscriptqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX9/home/rger/proj/rsyslog-doc/source/rainerscript/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX RainerScriptq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X RainerScriptq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX1**RainerScript is a scripting language specifically designed and well-suited for processing network events and configuring event processors.** It is the prime configuration language used for rsyslog. Please note that RainerScript may not be abreviated as rscript, because that's somebody else's trademark.hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(cdocutils.nodes strong q9)q:}q;(hX**RainerScript is a scripting language specifically designed and well-suited for processing network events and configuring event processors.**h}q<(h]h]h ]h!]h#]uhh4h]q=h/XRainerScript is a scripting language specifically designed and well-suited for processing network events and configuring event processors.q>q?}q@(hUhh:ubahUstrongqAubh/X It is the prime configuration language used for rsyslog. Please note that RainerScript may not be abreviated as rscript, because that's somebody else's trademark.qBqC}qD(hX It is the prime configuration language used for rsyslog. Please note that RainerScript may not be abreviated as rscript, because that's somebody else's trademark.hh4ubeubh3)qE}qF(hXSome limited RainerScript support is available since rsyslog 3.12.0 (for expression support). In v5, "if .. then" statements are supported. The first full implementation is available since rsyslog v6.qGhhhhhh6h}qH(h]h]h ]h!]h#]uh%K h&hh]qIh/XSome limited RainerScript support is available since rsyslog 3.12.0 (for expression support). In v5, "if .. then" statements are supported. The first full implementation is available since rsyslog v6.qJqK}qL(hhGhhEubaubcdocutils.nodes compound qM)qN}qO(hUhhhhhUcompoundqPh}qQ(h]h]qRUtoctree-wrapperqSah ]h!]h#]uh%Nh&hh]qTcsphinx.addnodes toctree qU)qV}qW(hUhhNhhhUtoctreeqXh}qY(UnumberedqZKU includehiddenq[hXrainerscript/indexq\Ucaptionq]NUglobq^h!]h ]U titlesonlyq_h]h]h#]Uentriesq`]qa(NXrainerscript/data_typesqbqcNXrainerscript/expressionsqdqeNXrainerscript/functionsqfqgNXrainerscript/control_structuresqhqiNX"rainerscript/configuration_objectsqjqkNXrainerscript/constant_stringsqlqmNX$rainerscript/variable_property_typesqnqoNXrainerscript/lookup_tablesqpqqNXrainerscript/queue_parametersqrqsNXrainerscript/rainerscript_callqtquNX'rainerscript/rainerscript_call_indirectqvqwNXrainerscript/globalqxqyeUhiddenqzU includefilesq{]q|(hbhdhfhhhjhlhnhphrhthvhxeUmaxdepthq}Kuh%Kh]ubaubeubahUU transformerq~NU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactq̈U generatorqNUdump_internalsqNU smart_quotesqωU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformq׉Ustrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqڈU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/rainerscript/lookup_tables.doctree0000664000175000017500000000664413035122644021456 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX lookup tablesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU lookup-tablesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXA/home/rger/proj/rsyslog-doc/source/rainerscript/lookup_tables.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Lookup Tablesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Lookup Tablesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX:doc:`Lookup tables ` are a powerful construct to obtain "class" information based on message content (e.g. to build log file names for different server types, departments or remote offices).hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(csphinx.addnodes pending_xref q9)q:}q;(hX$:doc:`Lookup tables `q(UreftypeXdocq?Urefwarnq@U reftargetqAX lookup_tablesU refdomainUh!]h ]U refexplicith]h]h#]UrefdocqBXrainerscript/lookup_tablesqCuh%Kh]qDcdocutils.nodes literal qE)qF}qG(hh` except that the name of the to be called ruleset is not constant but an expression and so can be computed at runtime.hhhhh U paragraphq(h5X7The rsyslog "call_indirect" statement is equivalent to q?q@}qA(hX7The rsyslog "call_indirect" statement is equivalent to hh:ubcsphinx.addnodes pending_xref qB)qC}qD(hX+:doc:`"call" statement `qEhh:hhh U pending_xrefqFh"}qG(UreftypeXdocqHUrefwarnqIU reftargetqJXrainerscript_callU refdomainUh']h&]U refexplicith$]h%]h)]UrefdocqKX'rainerscript/rainerscript_call_indirectqLuh+Kh]qMcdocutils.nodes literal qN)qO}qP(hhEh"}qQ(h$]h%]qR(UxrefqShHeh&]h']h)]uhhCh]qTh5X"call" statementqUqV}qW(hUhhOubah UliteralqXubaubh5Xv except that the name of the to be called ruleset is not constant but an expression and so can be computed at runtime.qYqZ}q[(hXv except that the name of the to be called ruleset is not constant but an expression and so can be computed at runtime.hh:ubeubh9)q\}q](hXIf the ruleset name cannot be found when call_indirect is used, an error message as emitted and the call_indirect statement is ignored. Execution continues with the next statement.q^hhhhh h` for more information. Note that the trailing semicolon is needed to indicate the end of expression. If it is not given, config load will fail with a syntax error message.hhdhhh h`qhh~hhh hFh"}q(UreftypeXdocqhIhJX expressionsU refdomainUh']h&]U refexplicith$]h%]h)]hKhLuh+Kh]qhN)q}q(hhh"}q(h$]h%]q(hSheh&]h']h)]uhhh]qh5X expressionsqq}q(hUhhubah hXubaubh5X for more information. Note that the trailing semicolon is needed to indicate the end of expression. If it is not given, config load will fail with a syntax error message.qq}q(hX for more information. Note that the trailing semicolon is needed to indicate the end of expression. If it is not given, config load will fail with a syntax error message.hh~ubeubeubh)q}q(hUhhhhh h!h"}q(h$]h%]h&]h']qhah)]qhauh+Kh,hh]q(h.)q}q(hXexamplesqhhhhh h2h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5Xexamplesqq}q(hhhhubaubh9)q}q(hXThe potentially most useful use-case for "call_indirect" is calling a ruleset based on a message variable. Let us assume that you have named your rulesets according to syslog tags expected. Then you can useqhhhhh h(cdocutils.frontend Values r?or@}rA(Ufootnote_backlinksrBKUrecord_dependenciesrCNU rfc_base_urlrDUhttps://tools.ietf.org/html/rEU tracebackrFUpep_referencesrGNUstrip_commentsrHNU toc_backlinksrIUentryrJU language_coderKUenrLU datestamprMNU report_levelrNKU _destinationrONU halt_levelrPKU strip_classesrQNh2NUerror_encoding_error_handlerrRUbackslashreplacerSUdebugrTNUembed_stylesheetrUUoutput_encoding_error_handlerrVUstrictrWU sectnum_xformrXKUdump_transformsrYNU docinfo_xformrZKUwarning_streamr[NUpep_file_url_templater\Upep-%04dr]Uexit_status_levelr^KUconfigr_NUstrict_visitorr`NUcloak_email_addressesraUtrim_footnote_reference_spacerbUenvrcNUdump_pseudo_xmlrdNUexpose_internalsreNUsectsubtitle_xformrfU source_linkrgNUrfc_referencesrhNUoutput_encodingriUutf-8rjU source_urlrkNUinput_encodingrlU utf-8-sigrmU_disable_configrnNU id_prefixroUU tab_widthrpKUerror_encodingrqUUTF-8rrU_sourcershUgettext_compactrtU generatorruNUdump_internalsrvNU smart_quotesrwU pep_base_urlrxU https://www.python.org/dev/peps/ryUsyntax_highlightrzUlongr{Uinput_encoding_error_handlerr|jWUauto_id_prefixr}Uidr~Udoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhhhduUsubstitution_namesr}rh h,h"}r(h$]h']h&]Usourcehh%]h)]uU footnotesr]rUrefidsr}rub.build/.doctrees/rainerscript/variable_property_types.doctree0000664000175000017500000003353513035122644023567 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XresetqNXvariable (property) typesqNXsetqNXunsetq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUresetqhUvariable-property-typesqhUsetqh UunsetquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXK/home/rger/proj/rsyslog-doc/source/rainerscript/variable_property_types.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hXVariable (Property) typesq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5XVariable (Property) typesq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hXDAll rsyslog properties (see the :doc:`property replacer <../configuration/property_replacer>` page for a list) can be used in RainerScript. In addition, it also supports local variables. Local variables are local to the current message, but are NOT message properties (e.g. the "$!" all JSON property does not contain them).hhhhh U paragraphq(h5X All rsyslog properties (see the q?q@}qA(hX All rsyslog properties (see the hh:ubcsphinx.addnodes pending_xref qB)qC}qD(hX=:doc:`property replacer <../configuration/property_replacer>`qEhh:hhh U pending_xrefqFh"}qG(UreftypeXdocqHUrefwarnqIU reftargetqJX"../configuration/property_replacerU refdomainUh']h&]U refexplicith$]h%]h)]UrefdocqKX$rainerscript/variable_property_typesqLuh+Kh]qMcdocutils.nodes literal qN)qO}qP(hhEh"}qQ(h$]h%]qR(UxrefqShHeh&]h']h)]uhhCh]qTh5Xproperty replacerqUqV}qW(hUhhOubah UliteralqXubaubh5X page for a list) can be used in RainerScript. In addition, it also supports local variables. Local variables are local to the current message, but are NOT message properties (e.g. the "$!" all JSON property does not contain them).qYqZ}q[(hX page for a list) can be used in RainerScript. In addition, it also supports local variables. Local variables are local to the current message, but are NOT message properties (e.g. the "$!" all JSON property does not contain them).hh:ubeubh9)q\}q](hXOnly message json (CEE/Lumberjack) properties can be modified by the **set**, **unset** and **reset** statements, not any other message property. Obviously, local variables are also modifieable.hhhhh hr?}r@(hUhj:ubah hkubaubh9)rA}rB(hXhforce sets the new value regardless of what the variable originally contained or if it was even set. Eg.rChj/hhh h(hh8hh6ubaubcdocutils.nodes bullet_list q?)q@}qA(hUhhhhhU bullet_listqBh}qC(UbulletqDX*h#]h"]h ]h!]h%]uh'Kh(hh]qEcdocutils.nodes list_item qF)qG}qH(hXIdo you want the application to stop because it can't write a log message hh@hhhU list_itemqIh}qJ(h ]h!]h"]h#]h%]uh'Nh(hh]qKh5)qL}qM(hXHdo you want the application to stop because it can't write a log messageqNhhGhhhh9h}qO(h ]h!]h"]h#]h%]uh'Kh]qPh1XHdo you want the application to stop because it can't write a log messageqQqR}qS(hhNhhLubaubaubaubh5)qT}qU(hXorqVhhhhhh9h}qW(h ]h!]h"]h#]h%]uh'Kh(hh]qXh1XorqYqZ}q[(hhVhhTubaubh?)q\}q](hUhhhhhhBh}q^(hDX*h#]h"]h ]h!]h%]uh'K h(hh]q_hF)q`}qa(hXGdo you want the application to continue, but not write the log message hh\hhhhIh}qb(h ]h!]h"]h#]h%]uh'Nh(hh]qch5)qd}qe(hXFdo you want the application to continue, but not write the log messageqfhh`hhhh9h}qg(h ]h!]h"]h#]h%]uh'K h]qhh1XFdo you want the application to continue, but not write the log messageqiqj}qk(hhfhhdubaubaubaubh5)ql}qm(hXNote that this decision is still there even if you are not logging remotely, your local disk partition where you are writing logs can fill up, become read-only, or have other problems.qnhhhhhh9h}qo(h ]h!]h"]h#]h%]uh'K h(hh]qph1XNote that this decision is still there even if you are not logging remotely, your local disk partition where you are writing logs can fill up, become read-only, or have other problems.qqqr}qs(hhnhhlubaubh5)qt}qu(hXThe RFC for syslog (dating back a couple of decades, well before rsyslog started) specify that the application writing the log message should block and wait for the log message to be processed. Rsyslog (like every other modern syslog daemon) fudges this a bit and buffers the log data in RAM rather than following the original behavior of writing the data to disk and doing a fsync before acknowledging the log message.qvhhhhhh9h}qw(h ]h!]h"]h#]h%]uh'Kh(hh]qxh1XThe RFC for syslog (dating back a couple of decades, well before rsyslog started) specify that the application writing the log message should block and wait for the log message to be processed. Rsyslog (like every other modern syslog daemon) fudges this a bit and buffers the log data in RAM rather than following the original behavior of writing the data to disk and doing a fsync before acknowledging the log message.qyqz}q{(hhvhhtubaubh5)q|}q}(hXIf you have a problem with your output from rsyslog, your application will keep running until rsyslog fills it's queues, and then it will stop.q~hhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]qh1XIf you have a problem with your output from rsyslog, your application will keep running until rsyslog fills it's queues, and then it will stop.qq}q(hh~hh|ubaubh5)q}q(hXWhen you configure rsyslog to send the logs to another machine (either to rsyslog on another machine or to some sort of database), you introduce a significant new set of failure modes for the output from rsyslog.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]qh1XWhen you configure rsyslog to send the logs to another machine (either to rsyslog on another machine or to some sort of database), you introduce a significant new set of failure modes for the output from rsyslog.qq}q(hhhhubaubh5)q}q(hXYou can configure the size of the rsyslog memory queues (I had one machine dedicated to running rsyslog where I created queues large enough to use >100G of ram for logs)qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]qh1XYou can configure the size of the rsyslog memory queues (I had one machine dedicated to running rsyslog where I created queues large enough to use >100G of ram for logs)qq}q(hhhhubaubh5)q}q(hXYou can configure rsyslog to spill from it's memory queues to disk queues (disk assisted queue mode) when it fills it's memory queues.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K"h(hh]qh1XYou can configure rsyslog to spill from it's memory queues to disk queues (disk assisted queue mode) when it fills it's memory queues.qq}q(hhhhubaubh5)q}q(hXYou can create a separate set of queues for the action that has a high probability of failing (sending to a remote machine via TCP in this case), but this doesn't buy you more time, it just means that other logs can continue to be written when the remote system is down.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K%h(hh]qh1XYou can create a separate set of queues for the action that has a high probability of failing (sending to a remote machine via TCP in this case), but this doesn't buy you more time, it just means that other logs can continue to be written when the remote system is down.qq}q(hhhhubaubh5)q}q(hXYou can configure rsyslog to have high/low watermark levels, when the queue fills past the high watermark, rsyslog will start discarding logs below a specified severity, and stop doing so when it drops below the low watermark levelqhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K*h(hh]qh1XYou can configure rsyslog to have high/low watermark levels, when the queue fills past the high watermark, rsyslog will start discarding logs below a specified severity, and stop doing so when it drops below the low watermark levelqq}q(hhhhubaubh5)q}q(hXFor rsyslog -> \*syslog, you can use UDP for your transport so that the logs will get dropped at the network layer if the remote system is unresponsive.hhhhhh9h}q(h ]h!]h"]h#]h%]uh'K/h(hh]qh1XFor rsyslog -> *syslog, you can use UDP for your transport so that the logs will get dropped at the network layer if the remote system is unresponsive.qq}q(hXFor rsyslog -> \*syslog, you can use UDP for your transport so that the logs will get dropped at the network layer if the remote system is unresponsive.hhubaubh5)q}q(hXYou have lots of options.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K2h(hh]qh1XYou have lots of options.qq}q(hhhhubaubh5)q}q(hXIf you are really concerned with reliability, I should point out that using TCP does not eliminate the possibility of loosing logs when a remote system goes down. When you send a message via TCP, the sender considers it sent when it's handed to the OS to send it. The OS has a window of how much data it allows to be outstanding (sent without acknowledgement from the remote system), and when the TCP connection fails (due to a firewall or a remote machine going down), the sending OS has no way to tell the application what data what data is outstanding, so the outstanding data will be lost. This is a smaller window of loss than UDP, which will happily keep sending your data forever, but it's still a potential for loss. Rsyslog offers the RELP (Reliable Event Logging Protocol), which addresses this problem by using application level acknowledgements so no messages can get lost due to network issues. That just leaves memory buffering (both in rsyslog and in the OS after rsyslog tells the OS to write the logs) as potential data loss points. Those failures will only trigger if the system crashes or rsyslog is shutdown (and yes, there are ways to address these as well)qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K4h(hh]qh1XIf you are really concerned with reliability, I should point out that using TCP does not eliminate the possibility of loosing logs when a remote system goes down. When you send a message via TCP, the sender considers it sent when it's handed to the OS to send it. The OS has a window of how much data it allows to be outstanding (sent without acknowledgement from the remote system), and when the TCP connection fails (due to a firewall or a remote machine going down), the sending OS has no way to tell the application what data what data is outstanding, so the outstanding data will be lost. This is a smaller window of loss than UDP, which will happily keep sending your data forever, but it's still a potential for loss. Rsyslog offers the RELP (Reliable Event Logging Protocol), which addresses this problem by using application level acknowledgements so no messages can get lost due to network issues. That just leaves memory buffering (both in rsyslog and in the OS after rsyslog tells the OS to write the logs) as potential data loss points. Those failures will only trigger if the system crashes or rsyslog is shutdown (and yes, there are ways to address these as well)qq}q(hhhhubaubh5)q}q(hXThe reason why nothing today operates without the possibility of loosing log messages is that making the logs completely reliable absolutely kills performance. With buffering, rsyslog can handle 400,000 logs/sec on a low-mid range machine. With utterly reliable logs and spinning disks, this rate drops to <100 logs/sec. With a $5K PCI SSD card, you can get up to ~4,000 logs/sec (in both cases, at the cost of not being able to use the disk for anything else on the system (so if you do use the disk for anything else, performance drops from there, and pretty rapidly). This is why traditional syslog had a reputation for being very slow.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'KEh(hh]qh1XThe reason why nothing today operates without the possibility of loosing log messages is that making the logs completely reliable absolutely kills performance. With buffering, rsyslog can handle 400,000 logs/sec on a low-mid range machine. With utterly reliable logs and spinning disks, this rate drops to <100 logs/sec. With a $5K PCI SSD card, you can get up to ~4,000 logs/sec (in both cases, at the cost of not being able to use the disk for anything else on the system (so if you do use the disk for anything else, performance drops from there, and pretty rapidly). This is why traditional syslog had a reputation for being very slow.qȅq}q(hhhhubaubh)q}q(hUhhhhhhh}q(h ]h!]h"]h#]qhah%]qhauh'KPh(hh]q(h*)q}q(hXSee Alsoqhhhhhh.h}q(h ]h!]h"]h#]h%]uh'KPh(hh]qh1XSee Alsoqօq}q(hhhhubaubh?)q}q(hUhhhhhhBh}q(hDX*h#]h"]h ]h!]h%]uh'KQh(hh]qhF)q}q(hXJhttp://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.htmlqhhhhhhIh}q(h ]h!]h"]h#]h%]uh'Nh(hh]qh5)q}q(hhhhhhhh9h}q(h ]h!]h"]h#]h%]uh'KQh]qcdocutils.nodes reference q)q}q(hhh}q(Urefurihh#]h"]h ]h!]h%]uhhh]qh1XJhttp://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.htmlq녁q}q(hUhhubahU referencequbaubaubaubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh(hU current_lineqNUtransform_messagesq]qUreporterqNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror }r (Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlr Uhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh.NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictr U sectnum_xformr!KUdump_transformsr"NU docinfo_xformr#KUwarning_streamr$NUpep_file_url_templater%Upep-%04dr&Uexit_status_levelr'KUconfigr(NUstrict_visitorr)NUcloak_email_addressesr*Utrim_footnote_reference_spacer+Uenvr,NUdump_pseudo_xmlr-NUexpose_internalsr.NUsectsubtitle_xformr/U source_linkr0NUrfc_referencesr1NUoutput_encodingr2Uutf-8r3U source_urlr4NUinput_encodingr5U utf-8-sigr6U_disable_configr7NU id_prefixr8UU tab_widthr9KUerror_encodingr:UUTF-8r;U_sourcer<hUgettext_compactr=U generatorr>NUdump_internalsr?NU smart_quotesr@U pep_base_urlrAU https://www.python.org/dev/peps/rBUsyntax_highlightrCUlongrDUinput_encoding_error_handlerrEj Uauto_id_prefixrFUidrGUdoctitle_xformrHUstrip_elements_with_classesrINU _config_filesrJ]Ufile_insertion_enabledrKU raw_enabledrLKU dump_settingsrMNubUsymbol_footnote_startrNKUidsrO}rP(hhhhuUsubstitution_namesrQ}rRhh(h}rS(h ]h#]h"]Usourcehh!]h%]uU footnotesrT]rUUrefidsrV}rWub.build/.doctrees/whitepapers/queues_analogy.doctree0000664000175000017500000017320713035122644021462 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrsyslog queuesqX turning lanes and rsyslog queuesqNXrsyslog queue user's guide,qXvideo tutorialq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrsyslog-queuesqhU turning-lanes-and-rsyslog-queuesqhUrsyslog-queue-user-s-guideqh Uvideo-tutorialquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXA/home/rger/proj/rsyslog-doc/source/whitepapers/queues_analogy.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX Turning Lanes and Rsyslog Queuesq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X Turning Lanes and Rsyslog Queuesq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hXIf there is a single object absolutely vital to understanding the way rsyslog works, this object is queues. Queues offer a variety of services, including support for multithreading. While there is elaborate in-depth documentation on the ins and outs of `rsyslog queues `_, some of the concepts are hard to grasp even for experienced people. I think this is because rsyslog uses a very high layer of abstraction which includes things that look quite unnatural, like queues that do **not** actually queue...hhhhh U paragraphq(h5XIf there is a single object absolutely vital to understanding the way rsyslog works, this object is queues. Queues offer a variety of services, including support for multithreading. While there is elaborate in-depth documentation on the ins and outs of q?q@}qA(hXIf there is a single object absolutely vital to understanding the way rsyslog works, this object is queues. Queues offer a variety of services, including support for multithreading. While there is elaborate in-depth documentation on the ins and outs of hh:ubcdocutils.nodes reference qB)qC}qD(hX`rsyslog queues `_h"}qE(UnameXrsyslog queuesUrefuriqFX queues.htmlqGh']h&]h$]h%]h)]uhh:h]qHh5Xrsyslog queuesqIqJ}qK(hUhhCubah U referenceqLubcdocutils.nodes target qM)qN}qO(hX U referencedqPKhh:h UtargetqQh"}qR(UrefurihGh']qShah&]h$]h%]h)]qThauh]ubh5X, some of the concepts are hard to grasp even for experienced people. I think this is because rsyslog uses a very high layer of abstraction which includes things that look quite unnatural, like queues that do qUqV}qW(hX, some of the concepts are hard to grasp even for experienced people. I think this is because rsyslog uses a very high layer of abstraction which includes things that look quite unnatural, like queues that do hh:ubcdocutils.nodes strong qX)qY}qZ(hX**not**h"}q[(h$]h%]h&]h']h)]uhh:h]q\h5Xnotq]q^}q_(hUhhYubah Ustrongq`ubh5X actually queue...qaqb}qc(hX actually queue...hh:ubeubh9)qd}qe(hX)With this document, I take a different approach: I will not describe every specific detail of queue operation but hope to be able to provide the core idea of how queues are used in rsyslog by using an analogy. I will compare the rsyslog data flow with real-life traffic flowing at an intersection.qfhhhhh h`_ available on the data flow. It is not perfect, but may aid in understanding this picture.hhhhh h`_h"}q(UnameXvideo tutorialhFX'http://www.rsyslog.com/Article350.phtmlqh']h&]h$]h%]h)]uhhh]qh5Xvideo tutorialqq}q(hUhhubah hLubhM)q}q(hX* hPKhhh hQh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5XZ available on the data flow. It is not perfect, but may aid in understanding this picture.qq}q(hXZ available on the data flow. It is not perfect, but may aid in understanding this picture.hhubeubh9)q}q(hXFor our needs, the important fact to know is that messages enter rsyslog on "the left side" (for example, via UDP), are being preprocessed, put into the so-called main queue, taken off that queue, be filtered and be placed into one or several action queues (depending on filter results). They leave rsyslog on "the right side" where output modules (like the file or database writer) consume them.qhhhhh h(UuriXwhitepapers/direct_queue0.pngr?h']h&]h$]h%]h}r@U*j?sh)]UaltXuhj8h]h hubaubh9)rA}rB(hXThis is a very simple real-life traffic case: one road joins another. We look at traffic on the straight road, here shown by blue and green arrows. Traffic in the opposing direction is shown in blue. Traffic flows without any delays as long as nobody takes turns. To be more precise, if the opposing traffic takes a (right) turn, traffic still continues to flow without delay. However, if a car in the red traffic flow intends to do a (left, then) turn, the situation changes:rChhhhh h}r?(hj:hj8ubaubh9)r@}rA(hXTLet us first use our car analogy: Assume we are in a car on the main lane that wants to take turn into the "action 4" road. We pass action 1, where a number of cars wait in the turning lane and we pass action 2, which has a slightly smaller, but still not filled up turning lane. So we pass that without delay, too. Then we come to "action 3", which has no turning lane. Unfortunately, the car in front of us wants to turn left into that road, so it blocks the main lane. So, this time we need to wait. An observer standing on the sidewalk may see that while we need to wait, there are still some cars in the "action 4" turning lane. As such, even though no new cars can arrive on the main lane, cars still turn into the "action 4" lane. In other words, an observer standing in "action 4" road is unable to see that traffic on the main lane is blocked.rBhhhhh hI have said this is "the lower bound for the number of threads...". This is with good reason: the main queue may have more than one worker thread (individual action queues currently do not support this, but could do in the future - there are good reasons for that, too but exploring why would finally take us away from what we intend to see). Note that you configure an upper bound for the number of main message queue worker threads. The actual number varies depending on a lot of operational variables, most importantly the number of messages inside the queue. The number rr}r(hX>I have said this is "the lower bound for the number of threads...". This is with good reason: the main queue may have more than one worker thread (individual action queues currently do not support this, but could do in the future - there are good reasons for that, too but exploring why would finally take us away from what we intend to see). Note that you configure an upper bound for the number of main message queue worker threads. The actual number varies depending on a lot of operational variables, most importantly the number of messages inside the queue. The number hjubh)r}r(hX*t\_m*h"}r(h$]h%]h&]h']h)]uhjh]rh5Xt_mrr}r(hUhjubah hubh5X of actually running threads is within the integer-interval [0,confLimit] (with confLimit being the operator configured limit, which defaults to 5). Output plugins may have more than one thread created by themselves. It is quite unusual for an output plugin to create such threads and so I assume we do not have any of these. Then, the overall number of threads in rsyslog's filtering and output system is rr}r(hX of actually running threads is within the integer-interval [0,confLimit] (with confLimit being the operator configured limit, which defaults to 5). Output plugins may have more than one thread created by themselves. It is quite unusual for an output plugin to create such threads and so I assume we do not have any of these. Then, the overall number of threads in rsyslog's filtering and output system is hjubh)r}r(hX9*t\_total = t\_m + number of actions in non-direct modes*h"}r(h$]h%]h&]h']h)]uhjh]rh5X5t_total = t_m + number of actions in non-direct modesrr}r(hUhjubah hubh5X. Add the number of inputs configured to that and you have the total number of threads running in rsyslog at a given time (assuming again that inputs utilize only one thread per plugin, a not-so-safe assumption).rr}r(hX. Add the number of inputs configured to that and you have the total number of threads running in rsyslog at a given time (assuming again that inputs utilize only one thread per plugin, a not-so-safe assumption).hjubeubh9)r}r(hX#A quick side-note: I gave the lower bound for *t\_m* as zero, which is somewhat in contrast to what I wrote at the begin of the last paragraph. Zero is actually correct, because rsyslog stops all worker threads when there is no work to do. This is also true for the action queues. So the ultimate lower bound for a rsyslog output system without any work to carry out actually is zero. But this bound will never be reached when there is continuous flow of activity. And, if you are curios: if the number of workers is zero, the worker wakeup process is actually handled within the threading context of the "left-hand-side" (or producer) of the queue. After being started, the worker begins to play the active queue component again. All of this, of course, can be overridden with configuration directives.hhhhh h`_ which most importantly lists all the knobs you can turn to tweak queue operation.hhhhh h`_h"}r+(UnameXrsyslog queue user's guide,hFX queues.htmlr,h']h&]h$]h%]h)]uhj"h]r-h5Xrsyslog queue user's guide,r.r/}r0(hUhj)ubah hLubhM)r1}r2(hX hPKhj"h hQh"}r3(Urefurij,h']r4hah&]h$]h%]h)]r5hauh]ubh5XR which most importantly lists all the knobs you can turn to tweak queue operation.r6r7}r8(hXR which most importantly lists all the knobs you can turn to tweak queue operation.hj"ubeubeubahUU transformerr9NU footnote_refsr:}r;Urefnamesr<}r=Usymbol_footnotesr>]r?Uautofootnote_refsr@]rAUsymbol_footnote_refsrB]rCU citationsrD]rEh,hU current_linerFNUtransform_messagesrG]rHUreporterrINUid_startrJKU autofootnotesrK]rLU citation_refsrM}rNUindirect_targetsrO]rPUsettingsrQ(cdocutils.frontend Values rRorS}rT(Ufootnote_backlinksrUKUrecord_dependenciesrVNU rfc_base_urlrWUhttps://tools.ietf.org/html/rXU tracebackrYUpep_referencesrZNUstrip_commentsr[NU toc_backlinksr\Uentryr]U language_coder^Uenr_U datestampr`NU report_levelraKU _destinationrbNU halt_levelrcKU strip_classesrdNh2NUerror_encoding_error_handlerreUbackslashreplacerfUdebugrgNUembed_stylesheetrhUoutput_encoding_error_handlerriUstrictrjU sectnum_xformrkKUdump_transformsrlNU docinfo_xformrmKUwarning_streamrnNUpep_file_url_templateroUpep-%04drpUexit_status_levelrqKUconfigrrNUstrict_visitorrsNUcloak_email_addressesrtUtrim_footnote_reference_spaceruUenvrvNUdump_pseudo_xmlrwNUexpose_internalsrxNUsectsubtitle_xformryU source_linkrzNUrfc_referencesr{NUoutput_encodingr|Uutf-8r}U source_urlr~NUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhNjjhhj\jXh{huhhhj1uUsubstitution_namesr}rh h,h"}r(h$]h']h&]Usourcehh%]h)]uU footnotesr]rUrefidsr}rub.build/.doctrees/whitepapers/syslog_protocol.doctree0000664000175000017500000014153213035122644021676 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XfindingsqNXcapabilities implementedqNX"syslog-protocol support in rsyslogqNXrsyslogq X5http://www.unicode.org/versions/unicode4.0.0/ch15.pdfq Xsyslog-protocolq X"currently supported message formatq NXconlusions/suggestionsq NuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUfindingsqhUcapabilities-implementedqhU"syslog-protocol-support-in-rsyslogqh Ursyslogqh U3http-www-unicode-org-versions-unicode4-0-0-ch15-pdfqh Usyslog-protocolqh U"currently-supported-message-formatqh Uconlusions-suggestionsquUchildrenq]q cdocutils.nodes section q!)q"}q#(U rawsourceq$UUparentq%hUsourceq&XB/home/rger/proj/rsyslog-doc/source/whitepapers/syslog_protocol.rstq'Utagnameq(Usectionq)U attributesq*}q+(Udupnamesq,]Uclassesq-]Ubackrefsq.]Uidsq/]q0haUnamesq1]q2hauUlineq3KUdocumentq4hh]q5(cdocutils.nodes title q6)q7}q8(h$X"syslog-protocol support in rsyslogq9h%h"h&h'h(Utitleq:h*}q;(h,]h-]h.]h/]h1]uh3Kh4hh]qq?}q@(h$h9h%h7ubaubcdocutils.nodes paragraph qA)qB}qC(h$X`rsyslog `_ **provides a trial implementation of the proposed** `syslog-protocol `_ **standard.** The intention of this implementation is to find out what inside syslog-protocol is causing problems during implementation. As syslog-protocol is a standard under development, its support in rsyslog is highly volatile. It may change from release to release. So while it provides some advantages in the real world, users are cautioned against using it right now. If you do, be prepared that you will probably need to update all of your rsyslogds with each new release. If you try it anyhow, please provide feedback as that would be most beneficial for us.h%h"h&h'h(U paragraphqDh*}qE(h,]h-]h.]h/]h1]uh3Kh4hh]qF(cdocutils.nodes reference qG)qH}qI(h$X$`rsyslog `_h*}qJ(Unameh UrefuriqKXhttp://www.rsyslog.com/qLh/]h.]h,]h-]h1]uh%hBh]qMh=XrsyslogqNqO}qP(h$Uh%hHubah(U referenceqQubcdocutils.nodes target qR)qS}qT(h$X U referencedqUKh%hBh(UtargetqVh*}qW(UrefurihLh/]qXhah.]h,]h-]h1]qYh auh]ubh=X qZ}q[(h$X h%hBubcdocutils.nodes strong q\)q]}q^(h$X3**provides a trial implementation of the proposed**h*}q_(h,]h-]h.]h/]h1]uh%hBh]q`h=X/provides a trial implementation of the proposedqaqb}qc(h$Uh%h]ubah(Ustrongqdubh=X qe}qf(h$X h%hBubhG)qg}qh(h$XV`syslog-protocol `_h*}qi(Unameh hKXAhttp://www.monitorware.com/Common/en/glossary/syslog-protocol.phpqjh/]h.]h,]h-]h1]uh%hBh]qkh=Xsyslog-protocolqlqm}qn(h$Uh%hgubah(hQubhR)qo}qp(h$XD hUKh%hBh(hVh*}qq(Urefurihjh/]qrhah.]h,]h-]h1]qsh auh]ubh=X qt}qu(h$X h%hBubh\)qv}qw(h$X **standard.**h*}qx(h,]h-]h.]h/]h1]uh%hBh]qyh=X standard.qzq{}q|(h$Uh%hvubah(hdubh=X* The intention of this implementation is to find out what inside syslog-protocol is causing problems during implementation. As syslog-protocol is a standard under development, its support in rsyslog is highly volatile. It may change from release to release. So while it provides some advantages in the real world, users are cautioned against using it right now. If you do, be prepared that you will probably need to update all of your rsyslogds with each new release. If you try it anyhow, please provide feedback as that would be most beneficial for us.q}q~}q(h$X* The intention of this implementation is to find out what inside syslog-protocol is causing problems during implementation. As syslog-protocol is a standard under development, its support in rsyslog is highly volatile. It may change from release to release. So while it provides some advantages in the real world, users are cautioned against using it right now. If you do, be prepared that you will probably need to update all of your rsyslogds with each new release. If you try it anyhow, please provide feedback as that would be most beneficial for us.h%hBubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qh auh3Kh4hh]q(h6)q}q(h$X"Currently supported message formatqh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=X"Currently supported message formatqq}q(h$hh%hubaubhA)q}q(h$XDue to recent discussion on syslog-protocol, we do not follow any specific revision of the draft but rather the candidate ideas. The format supported currently is:qh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=XDue to recent discussion on syslog-protocol, we do not follow any specific revision of the draft but rather the candidate ideas. The format supported currently is:qq}q(h$hh%hubaubhA)q}q(h$X`**``VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID SP [SD-ID]s SP MSG``**qh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh\)q}q(h$hh*}q(h,]h-]h.]h/]h1]uh%hh]qh=X\``VERSION SP TIMESTAMP SP HOSTNAME SP APP-NAME SP PROCID SP MSGID SP [SD-ID]s SP MSG``qq}q(h$Uh%hubah(hdubaubhA)q}q(h$XIField syntax and semantics are as defined in IETF I-D syslog-protocol-15.qh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=XIField syntax and semantics are as defined in IETF I-D syslog-protocol-15.qq}q(h$hh%hubaubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qhauh3Kh4hh]q(h6)q}q(h$XCapabilities Implementedqh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=XCapabilities Implementedqq}q(h$hh%hubaubcdocutils.nodes bullet_list q)q}q(h$Uh%hh&h'h(U bullet_listqh*}q(UbulletqX-h/]h.]h,]h-]h1]uh3Kh4hh]q(cdocutils.nodes list_item q)q}q(h$X5receiving message in the supported format (see above)qh%hh&h'h(U list_itemqh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$hh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3Kh]qh=X5receiving message in the supported format (see above)qʅq}q(h$hh%hubaubaubh)q}q(h$X(sending messages in the supported formatqh%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$hh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3K h]qh=X(sending messages in the supported formatqօq}q(h$hh%hubaubaubh)q}q(h$Xrelaying messagesqh%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$hh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3K!h]qh=Xrelaying messagesq⅁q}q(h$hh%hubaubaubh)q}q(h$X`receiving messages in either legacy or -protocol format and transforming them into the other oneh%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$X`receiving messages in either legacy or -protocol format and transforming them into the other oneqh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3K"h]qh=X`receiving messages in either legacy or -protocol format and transforming them into the other oneqq}q(h$hh%hubaubaubh)q}q(h$Xvirtual availability of TAG, PROCID, APP-NAME, MSGID, SD-ID no matter if the message was received via legacy format, API or syslog-protocol format (non-present fields are being emulated with great success)h%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$Xvirtual availability of TAG, PROCID, APP-NAME, MSGID, SD-ID no matter if the message was received via legacy format, API or syslog-protocol format (non-present fields are being emulated with great success)qh%hh&h'h(hDh*}q(h,]h-]h.]h/]h1]uh3K$h]qh=Xvirtual availability of TAG, PROCID, APP-NAME, MSGID, SD-ID no matter if the message was received via legacy format, API or syslog-protocol format (non-present fields are being emulated with great success)qq}q(h$hh%hubaubaubh)q}q(h$X4maximum message size is set via preprocessor #defineqh%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$hh%hh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3K'h]rh=X4maximum message size is set via preprocessor #definerr}r(h$hh%jubaubaubh)r }r (h$Xsyslog-protocol messages can be transmitted both over UDP and plain TCP with some restrictions on compliance in the case of TCP h%hh&h'h(hh*}r (h,]h-]h.]h/]h1]uh3Nh4hh]r hA)r }r(h$Xsyslog-protocol messages can be transmitted both over UDP and plain TCP with some restrictions on compliance in the case of TCPrh%j h&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3K(h]rh=Xsyslog-protocol messages can be transmitted both over UDP and plain TCP with some restrictions on compliance in the case of TCPrr}r(h$jh%j ubaubaubeubeubh!)r}r(h$Uh%h"h&h'h(h)h*}r(h,]h-]h.]h/]rhah1]rhauh3K,h4hh]r(h6)r}r(h$XFindingsrh%jh&h'h(h:h*}r(h,]h-]h.]h/]h1]uh3K,h4hh]rh=XFindingsr r!}r"(h$jh%jubaubhA)r#}r$(h$X5This lists what has been found during implementation:r%h%jh&h'h(hDh*}r&(h,]h-]h.]h/]h1]uh3K.h4hh]r'h=X5This lists what has been found during implementation:r(r)}r*(h$j%h%j#ubaubh)r+}r,(h$Uh%jh&h'h(hh*}r-(hX-h/]h.]h,]h-]h1]uh3K0h4hh]r.(h)r/}r0(h$XThe same receiver must be able to support both legacy and syslog-protocol syslog messages. Anything else would be a big inconvenience to users and would make deployment much harder. The detection must be done automatically (see below on how easy that is).h%j+h&h'h(hh*}r1(h,]h-]h.]h/]h1]uh3Nh4hh]r2hA)r3}r4(h$XThe same receiver must be able to support both legacy and syslog-protocol syslog messages. Anything else would be a big inconvenience to users and would make deployment much harder. The detection must be done automatically (see below on how easy that is).r5h%j/h&h'h(hDh*}r6(h,]h-]h.]h/]h1]uh3K0h]r7h=XThe same receiver must be able to support both legacy and syslog-protocol syslog messages. Anything else would be a big inconvenience to users and would make deployment much harder. The detection must be done automatically (see below on how easy that is).r8r9}r:(h$j5h%j3ubaubaubh)r;}r<(h$Xz**NUL characters inside MSG** cause the message to be truncated at that point. This is probably a major point for many C-based implementations. No measures have yet been taken against this. Modifying the code to "cleanly" support NUL characters is non-trivial, even though rsyslogd already has some byte-counted string library (but this is new and not yet available everywhere).h%j+h&h'h(hh*}r=(h,]h-]h.]h/]h1]uh3Nh4hh]r>hA)r?}r@(h$Xz**NUL characters inside MSG** cause the message to be truncated at that point. This is probably a major point for many C-based implementations. No measures have yet been taken against this. Modifying the code to "cleanly" support NUL characters is non-trivial, even though rsyslogd already has some byte-counted string library (but this is new and not yet available everywhere).h%j;h&h'h(hDh*}rA(h,]h-]h.]h/]h1]uh3K4h]rB(h\)rC}rD(h$X**NUL characters inside MSG**h*}rE(h,]h-]h.]h/]h1]uh%j?h]rFh=XNUL characters inside MSGrGrH}rI(h$Uh%jCubah(hdubh=X] cause the message to be truncated at that point. This is probably a major point for many C-based implementations. No measures have yet been taken against this. Modifying the code to "cleanly" support NUL characters is non-trivial, even though rsyslogd already has some byte-counted string library (but this is new and not yet available everywhere).rJrK}rL(h$X] cause the message to be truncated at that point. This is probably a major point for many C-based implementations. No measures have yet been taken against this. Modifying the code to "cleanly" support NUL characters is non-trivial, even though rsyslogd already has some byte-counted string library (but this is new and not yet available everywhere).h%j?ubeubaubh)rM}rN(h$Xy**character encoding in MSG**: is is problematic to do the right UTF-8 encoding. The reason is that we pick up the MSG from the local domain socket (which got it from the syslog(3) API). The text obtained does not include any encoding information, but it does include non US-ASCII characters. It may also include any other encoding. Other than by guessing based on the provided text, I have no way to find out what it is. In order to make the syslogd do anything useful, I have now simply taken the message as is and stuffed it into the MSG part. Please note that I think this will be a route that other implementors would take, too.h%j+h&h'h(hh*}rO(h,]h-]h.]h/]h1]uh3Nh4hh]rPhA)rQ}rR(h$Xy**character encoding in MSG**: is is problematic to do the right UTF-8 encoding. The reason is that we pick up the MSG from the local domain socket (which got it from the syslog(3) API). The text obtained does not include any encoding information, but it does include non US-ASCII characters. It may also include any other encoding. Other than by guessing based on the provided text, I have no way to find out what it is. In order to make the syslogd do anything useful, I have now simply taken the message as is and stuffed it into the MSG part. Please note that I think this will be a route that other implementors would take, too.h%jMh&h'h(hDh*}rS(h,]h-]h.]h/]h1]uh3K:h]rT(h\)rU}rV(h$X**character encoding in MSG**h*}rW(h,]h-]h.]h/]h1]uh%jQh]rXh=Xcharacter encoding in MSGrYrZ}r[(h$Uh%jUubah(hdubh=X\: is is problematic to do the right UTF-8 encoding. The reason is that we pick up the MSG from the local domain socket (which got it from the syslog(3) API). The text obtained does not include any encoding information, but it does include non US-ASCII characters. It may also include any other encoding. Other than by guessing based on the provided text, I have no way to find out what it is. In order to make the syslogd do anything useful, I have now simply taken the message as is and stuffed it into the MSG part. Please note that I think this will be a route that other implementors would take, too.r\r]}r^(h$X\: is is problematic to do the right UTF-8 encoding. The reason is that we pick up the MSG from the local domain socket (which got it from the syslog(3) API). The text obtained does not include any encoding information, but it does include non US-ASCII characters. It may also include any other encoding. Other than by guessing based on the provided text, I have no way to find out what it is. In order to make the syslogd do anything useful, I have now simply taken the message as is and stuffed it into the MSG part. Please note that I think this will be a route that other implementors would take, too.h%jQubeubaubh)r_}r`(h$XA minimal parser is easy to implement. It took me roughly 2 hours to add it to rsyslogd. This includes the time for restructuring the code to be able to parse both legacy syslog as well as syslog-protocol. The parser has some restrictions, though - STRUCTURED-DATA field is extracted, but not validated. Structured data "[test ]]" is not caught as an error. Nor are any other errors caught. For my needs with this syslogd, that level of structured data processing is probably sufficient. I do not want to parse/validate it in all cases. This is also a performance issue. I think other implementors could have the same view. As such, we should not make validation a requirement. - MSG is not further processed (e.g. Unicode not being validated) - the other header fields are also extracted, but no validation is performed right now. At least some validation should be easy to add (not done this because it is a proof-of-concept and scheduled to change). h%j+h&Nh(hh*}ra(h,]h-]h.]h/]h1]uh3Nh4hh]rb(hA)rc}rd(h$XA minimal parser is easy to implement. It took me roughly 2 hours to add it to rsyslogd. This includes the time for restructuring the code to be able to parse both legacy syslog as well as syslog-protocol. The parser has some restrictions, thoughreh%j_h&h'h(hDh*}rf(h,]h-]h.]h/]h1]uh3KDh]rgh=XA minimal parser is easy to implement. It took me roughly 2 hours to add it to rsyslogd. This includes the time for restructuring the code to be able to parse both legacy syslog as well as syslog-protocol. The parser has some restrictions, thoughrhri}rj(h$jeh%jcubaubh)rk}rl(h$Uh*}rm(hX-h/]h.]h,]h-]h1]uh%j_h]rn(h)ro}rp(h$XSTRUCTURED-DATA field is extracted, but not validated. Structured data "[test ]]" is not caught as an error. Nor are any other errors caught. For my needs with this syslogd, that level of structured data processing is probably sufficient. I do not want to parse/validate it in all cases. This is also a performance issue. I think other implementors could have the same view. As such, we should not make validation a requirement.h*}rq(h,]h-]h.]h/]h1]uh%jkh]rrhA)rs}rt(h$XSTRUCTURED-DATA field is extracted, but not validated. Structured data "[test ]]" is not caught as an error. Nor are any other errors caught. For my needs with this syslogd, that level of structured data processing is probably sufficient. I do not want to parse/validate it in all cases. This is also a performance issue. I think other implementors could have the same view. As such, we should not make validation a requirement.ruh%joh&h'h(hDh*}rv(h,]h-]h.]h/]h1]uh3KIh]rwh=XSTRUCTURED-DATA field is extracted, but not validated. Structured data "[test ]]" is not caught as an error. Nor are any other errors caught. For my needs with this syslogd, that level of structured data processing is probably sufficient. I do not want to parse/validate it in all cases. This is also a performance issue. I think other implementors could have the same view. As such, we should not make validation a requirement.rxry}rz(h$juh%jsubaubah(hubh)r{}r|(h$X?MSG is not further processed (e.g. Unicode not being validated)r}h*}r~(h,]h-]h.]h/]h1]uh%jkh]rhA)r}r(h$j}h%j{h&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3KPh]rh=X?MSG is not further processed (e.g. Unicode not being validated)rr}r(h$j}h%jubaubah(hubh)r}r(h$Xthe other header fields are also extracted, but no validation is performed right now. At least some validation should be easy to add (not done this because it is a proof-of-concept and scheduled to change). h*}r(h,]h-]h.]h/]h1]uh%jkh]rhA)r}r(h$Xthe other header fields are also extracted, but no validation is performed right now. At least some validation should be easy to add (not done this because it is a proof-of-concept and scheduled to change).rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3KQh]rh=Xthe other header fields are also extracted, but no validation is performed right now. At least some validation should be easy to add (not done this because it is a proof-of-concept and scheduled to change).rr}r(h$jh%jubaubah(hubeh(hubeubh)r}r(h$XUniversal access to all syslog fields (missing ones being emulated) was also quite easy. It took me around another 2 hours to integrate emulation of non-present fields into the code base.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XUniversal access to all syslog fields (missing ones being emulated) was also quite easy. It took me around another 2 hours to integrate emulation of non-present fields into the code base.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3KVh]rh=XUniversal access to all syslog fields (missing ones being emulated) was also quite easy. It took me around another 2 hours to integrate emulation of non-present fields into the code base.rr}r(h$jh%jubaubaubh)r}r(h$XmThe version at the start of the message makes it easy to detect if we have legacy syslog or syslog-protocol. Do NOT move it to somewhere inside the middle of the message, that would complicate things. It might not be totally fail-safe to just rely on "1 " as the "cookie" for a syslog-protocol. Eventually, it would be good to add some more uniqueness, e.g. "@#1 ".h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XmThe version at the start of the message makes it easy to detect if we have legacy syslog or syslog-protocol. Do NOT move it to somewhere inside the middle of the message, that would complicate things. It might not be totally fail-safe to just rely on "1 " as the "cookie" for a syslog-protocol. Eventually, it would be good to add some more uniqueness, e.g. "@#1 ".rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3KYh]rh=XmThe version at the start of the message makes it easy to detect if we have legacy syslog or syslog-protocol. Do NOT move it to somewhere inside the middle of the message, that would complicate things. It might not be totally fail-safe to just rely on "1 " as the "cookie" for a syslog-protocol. Eventually, it would be good to add some more uniqueness, e.g. "@#1 ".rr}r(h$jh%jubaubaubh)r}r(h$XNI have no (easy) way to detect truncation if that happens on the UDP stack. All I see is that I receive e.g. a 4K message. If the message was e.g. 6K, I received two chunks. The first chunk (4K) is correctly detected as a syslog-protocol message, the second (2K) as legacy syslog. I do not see what we could do against this. This questions the usefulness of the TRUNCATE bit. Eventually, I could look at the UDP headers and see that it is a fragment. I have looked at a network sniffer log of the conversation. This looks like two totally-independent messages were sent by the sender stack.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XNI have no (easy) way to detect truncation if that happens on the UDP stack. All I see is that I receive e.g. a 4K message. If the message was e.g. 6K, I received two chunks. The first chunk (4K) is correctly detected as a syslog-protocol message, the second (2K) as legacy syslog. I do not see what we could do against this. This questions the usefulness of the TRUNCATE bit. Eventually, I could look at the UDP headers and see that it is a fragment. I have looked at a network sniffer log of the conversation. This looks like two totally-independent messages were sent by the sender stack.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3K_h]rh=XNI have no (easy) way to detect truncation if that happens on the UDP stack. All I see is that I receive e.g. a 4K message. If the message was e.g. 6K, I received two chunks. The first chunk (4K) is correctly detected as a syslog-protocol message, the second (2K) as legacy syslog. I do not see what we could do against this. This questions the usefulness of the TRUNCATE bit. Eventually, I could look at the UDP headers and see that it is a fragment. I have looked at a network sniffer log of the conversation. This looks like two totally-independent messages were sent by the sender stack.rr}r(h$jh%jubaubaubh)r}r(h$XThe maximum message size is currently being configured via a preprocessor #define. It can easily be set to 2K or 4K, but more than 4K is not possible because of UDP stack limitations. Eventually, this can be worked around, but I have not done this yet.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XThe maximum message size is currently being configured via a preprocessor #define. It can easily be set to 2K or 4K, but more than 4K is not possible because of UDP stack limitations. Eventually, this can be worked around, but I have not done this yet.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Khh]rh=XThe maximum message size is currently being configured via a preprocessor #define. It can easily be set to 2K or 4K, but more than 4K is not possible because of UDP stack limitations. Eventually, this can be worked around, but I have not done this yet.rr}r(h$jh%jubaubaubh)r}r(h$Xrsyslogd can accept syslog-protocol formatted messages but is able to relay them in legacy format. I find this a must in real-life deployments. For this, I needed to do some field mapping so that APP-NAME/PROCID are mapped into a TAG.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$Xrsyslogd can accept syslog-protocol formatted messages but is able to relay them in legacy format. I find this a must in real-life deployments. For this, I needed to do some field mapping so that APP-NAME/PROCID are mapped into a TAG.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Klh]rh=Xrsyslogd can accept syslog-protocol formatted messages but is able to relay them in legacy format. I find this a must in real-life deployments. For this, I needed to do some field mapping so that APP-NAME/PROCID are mapped into a TAG.rr}r(h$jh%jubaubaubh)r}r(h$Xrsyslogd can also accept legacy syslog message and relay them in syslog-protocol format. For this, I needed to apply some sub-parsing of the TAG, which on most occasions provides correct results. There might be some misinterpretations but I consider these to be mostly non-intrusive.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$Xrsyslogd can also accept legacy syslog message and relay them in syslog-protocol format. For this, I needed to apply some sub-parsing of the TAG, which on most occasions provides correct results. There might be some misinterpretations but I consider these to be mostly non-intrusive.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kph]rh=Xrsyslogd can also accept legacy syslog message and relay them in syslog-protocol format. For this, I needed to apply some sub-parsing of the TAG, which on most occasions provides correct results. There might be some misinterpretations but I consider these to be mostly non-intrusive.rr}r(h$jh%jubaubaubh)r}r(h$XMessages received from the syslog API (the normal case under \*nix) also do not have APP-NAME and PROCID and I must parse them out of TAG as described directly above. As such, this algorithm is absolutely vital to make things work on \*nix.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XMessages received from the syslog API (the normal case under \*nix) also do not have APP-NAME and PROCID and I must parse them out of TAG as described directly above. As such, this algorithm is absolutely vital to make things work on \*nix.h%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kuh]rh=XMessages received from the syslog API (the normal case under *nix) also do not have APP-NAME and PROCID and I must parse them out of TAG as described directly above. As such, this algorithm is absolutely vital to make things work on *nix.rr}r(h$XMessages received from the syslog API (the normal case under \*nix) also do not have APP-NAME and PROCID and I must parse them out of TAG as described directly above. As such, this algorithm is absolutely vital to make things work on \*nix.h%jubaubaubh)r}r(h$XI have an issue with messages received via the syslog(3) API (or, to be more precise, via the local domain socket this API writes to): These messages contain a timestamp, but that timestamp does neither have the year nor the high-resolution time. The year is no real issue, I just take the year of the reception of that message. There is a very small window of exposure for messages read from the log immediately after midnight Jan 1st. The message in the domain socket might have been written immediately before midnight in the old year. I think this is acceptable. However, I can not assign a high-precision timestamp, at least it is somewhat off if I take the timestamp from message reception on the local socket. An alternative might be to ignore the timestamp present and instead use that one when the message is pulled from the local socket (I am talking about IPC, not the network - just a reminder...). This is doable, but eventually not advisable. It looks like this needs to be resolved via a configuration option.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XI have an issue with messages received via the syslog(3) API (or, to be more precise, via the local domain socket this API writes to): These messages contain a timestamp, but that timestamp does neither have the year nor the high-resolution time. The year is no real issue, I just take the year of the reception of that message. There is a very small window of exposure for messages read from the log immediately after midnight Jan 1st. The message in the domain socket might have been written immediately before midnight in the old year. I think this is acceptable. However, I can not assign a high-precision timestamp, at least it is somewhat off if I take the timestamp from message reception on the local socket. An alternative might be to ignore the timestamp present and instead use that one when the message is pulled from the local socket (I am talking about IPC, not the network - just a reminder...). This is doable, but eventually not advisable. It looks like this needs to be resolved via a configuration option.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kyh]rh=XI have an issue with messages received via the syslog(3) API (or, to be more precise, via the local domain socket this API writes to): These messages contain a timestamp, but that timestamp does neither have the year nor the high-resolution time. The year is no real issue, I just take the year of the reception of that message. There is a very small window of exposure for messages read from the log immediately after midnight Jan 1st. The message in the domain socket might have been written immediately before midnight in the old year. I think this is acceptable. However, I can not assign a high-precision timestamp, at least it is somewhat off if I take the timestamp from message reception on the local socket. An alternative might be to ignore the timestamp present and instead use that one when the message is pulled from the local socket (I am talking about IPC, not the network - just a reminder...). This is doable, but eventually not advisable. It looks like this needs to be resolved via a configuration option.rr}r(h$jh%jubaubaubh)r}r(h$Xrsyslogd already advertised its origin information on application startup (in a syslog-protocol-14 compatible format). It is fairly easy to include that with any message if desired (not currently done).h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$Xrsyslogd already advertised its origin information on application startup (in a syslog-protocol-14 compatible format). It is fairly easy to include that with any message if desired (not currently done).rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=Xrsyslogd already advertised its origin information on application startup (in a syslog-protocol-14 compatible format). It is fairly easy to include that with any message if desired (not currently done).rr}r(h$jh%jubaubaubh)r}r(h$XCA big problem I noticed are malformed messages. In -syslog-protocol, we recommend/require to discard malformed messages. However, in practice users would like to see everything that the syslogd receives, even if it is in error. For the first version, I have not included any error handling at all. However, I think I would deliberately ignore any "discard" requirement. My current point of view is that in my code I would eventually flag a message as being invalid and allow the user to filter on this invalidness. So these invalid messages could be redirected into special bins.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XCA big problem I noticed are malformed messages. In -syslog-protocol, we recommend/require to discard malformed messages. However, in practice users would like to see everything that the syslogd receives, even if it is in error. For the first version, I have not included any error handling at all. However, I think I would deliberately ignore any "discard" requirement. My current point of view is that in my code I would eventually flag a message as being invalid and allow the user to filter on this invalidness. So these invalid messages could be redirected into special bins.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XCA big problem I noticed are malformed messages. In -syslog-protocol, we recommend/require to discard malformed messages. However, in practice users would like to see everything that the syslogd receives, even if it is in error. For the first version, I have not included any error handling at all. However, I think I would deliberately ignore any "discard" requirement. My current point of view is that in my code I would eventually flag a message as being invalid and allow the user to filter on this invalidness. So these invalid messages could be redirected into special bins.rr}r (h$jh%jubaubaubh)r }r (h$XThe error logging recommendations (those I insisted on;)) are not really practical. My application has its own error logging philosophy and I will not change this to follow a draft.h%j+h&h'h(hh*}r (h,]h-]h.]h/]h1]uh3Nh4hh]r hA)r}r(h$XThe error logging recommendations (those I insisted on;)) are not really practical. My application has its own error logging philosophy and I will not change this to follow a draft.rh%j h&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XThe error logging recommendations (those I insisted on;)) are not really practical. My application has its own error logging philosophy and I will not change this to follow a draft.rr}r(h$jh%jubaubaubh)r}r(h$XRelevance of support for leap seconds and senders without knowledge of time is questionable. I have not made any specific provisions in the code nor would I know how to handle that differently. I could, however, pull the local reception timestamp in this case, so it might be useful to have this feature. I do not think any more about this for the initial proof-of-concept. Note it as a potential problem area, especially when logging to databases.h%j+h&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XRelevance of support for leap seconds and senders without knowledge of time is questionable. I have not made any specific provisions in the code nor would I know how to handle that differently. I could, however, pull the local reception timestamp in this case, so it might be useful to have this feature. I do not think any more about this for the initial proof-of-concept. Note it as a potential problem area, especially when logging to databases.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XRelevance of support for leap seconds and senders without knowledge of time is questionable. I have not made any specific provisions in the code nor would I know how to handle that differently. I could, however, pull the local reception timestamp in this case, so it might be useful to have this feature. I do not think any more about this for the initial proof-of-concept. Note it as a potential problem area, especially when logging to databases.rr }r!(h$jh%jubaubaubh)r"}r#(h$XfThe HOSTNAME field for internally generated messages currently contains the hostname part only, not the FQDN. This can be changed inside the code base, but it requires some thinking so that thinks are kept compatible with legacy syslog. I have not done this for the proof-of-concept, but I think it is not really bad. Maybe an hour or half a day of thinking.h%j+h&h'h(hh*}r$(h,]h-]h.]h/]h1]uh3Nh4hh]r%hA)r&}r'(h$XfThe HOSTNAME field for internally generated messages currently contains the hostname part only, not the FQDN. This can be changed inside the code base, but it requires some thinking so that thinks are kept compatible with legacy syslog. I have not done this for the proof-of-concept, but I think it is not really bad. Maybe an hour or half a day of thinking.r(h%j"h&h'h(hDh*}r)(h,]h-]h.]h/]h1]uh3Kh]r*h=XfThe HOSTNAME field for internally generated messages currently contains the hostname part only, not the FQDN. This can be changed inside the code base, but it requires some thinking so that thinks are kept compatible with legacy syslog. I have not done this for the proof-of-concept, but I think it is not really bad. Maybe an hour or half a day of thinking.r+r,}r-(h$j(h%j&ubaubaubh)r.}r/(h$XIt is possible that I did not receive a TAG with legacy syslog or via the syslog API. In this case, I can not generate the APP-NAME. For consistency, I have used "-" in such cases (just like in PROCID, MSGID and STRUCTURED-DATA).h%j+h&h'h(hh*}r0(h,]h-]h.]h/]h1]uh3Nh4hh]r1hA)r2}r3(h$XIt is possible that I did not receive a TAG with legacy syslog or via the syslog API. In this case, I can not generate the APP-NAME. For consistency, I have used "-" in such cases (just like in PROCID, MSGID and STRUCTURED-DATA).r4h%j.h&h'h(hDh*}r5(h,]h-]h.]h/]h1]uh3Kh]r6h=XIt is possible that I did not receive a TAG with legacy syslog or via the syslog API. In this case, I can not generate the APP-NAME. For consistency, I have used "-" in such cases (just like in PROCID, MSGID and STRUCTURED-DATA).r7r8}r9(h$j4h%j2ubaubaubh)r:}r;(h$XAs an architectural side-effect, syslog-protocol formatted messages can also be transmitted over non-standard syslog/raw tcp. This implementation uses the industry-standard LF termination of tcp syslog records. As such, syslog-protocol messages containing a LF will be broken invalidly. There is nothing that can be done against this without specifying a TCP transport. This issue might be more important than one thinks on first thought. The reason is the wide deployment of syslog/tcp via industry standard. h%j+h&h'h(hh*}r<(h,]h-]h.]h/]h1]uh3Nh4hh]r=hA)r>}r?(h$XAs an architectural side-effect, syslog-protocol formatted messages can also be transmitted over non-standard syslog/raw tcp. This implementation uses the industry-standard LF termination of tcp syslog records. As such, syslog-protocol messages containing a LF will be broken invalidly. There is nothing that can be done against this without specifying a TCP transport. This issue might be more important than one thinks on first thought. The reason is the wide deployment of syslog/tcp via industry standard.r@h%j:h&h'h(hDh*}rA(h,]h-]h.]h/]h1]uh3Kh]rBh=XAs an architectural side-effect, syslog-protocol formatted messages can also be transmitted over non-standard syslog/raw tcp. This implementation uses the industry-standard LF termination of tcp syslog records. As such, syslog-protocol messages containing a LF will be broken invalidly. There is nothing that can be done against this without specifying a TCP transport. This issue might be more important than one thinks on first thought. The reason is the wide deployment of syslog/tcp via industry standard.rCrD}rE(h$j@h%j>ubaubaubeubhA)rF}rG(h$X)**Some notes on syslog-transport-udp-06**rHh%jh&h'h(hDh*}rI(h,]h-]h.]h/]h1]uh3Kh4hh]rJh\)rK}rL(h$jHh*}rM(h,]h-]h.]h/]h1]uh%jFh]rNh=X%Some notes on syslog-transport-udp-06rOrP}rQ(h$Uh%jKubah(hdubaubh)rR}rS(h$Uh%jh&h'h(hh*}rT(hX-h/]h.]h,]h-]h1]uh3Kh4hh]rU(h)rV}rW(h$XpI did not make any low-level modifications to the UDP code and think I am still basically covered with this I-D.h%jRh&h'h(hh*}rX(h,]h-]h.]h/]h1]uh3Nh4hh]rYhA)rZ}r[(h$XpI did not make any low-level modifications to the UDP code and think I am still basically covered with this I-D.r\h%jVh&h'h(hDh*}r](h,]h-]h.]h/]h1]uh3Kh]r^h=XpI did not make any low-level modifications to the UDP code and think I am still basically covered with this I-D.r_r`}ra(h$j\h%jZubaubaubh)rb}rc(h$XSI deliberately violate section 3.3 insofar as that I do not necessarily accept messages destined to port 514. This feature is user-required and a must. The same applies to the destination port. I am not sure if the "MUST" in section 3.3 was meant that this MUST be an option, but not necessarily be active. The wording should be clarified.h%jRh&h'h(hh*}rd(h,]h-]h.]h/]h1]uh3Nh4hh]rehA)rf}rg(h$XSI deliberately violate section 3.3 insofar as that I do not necessarily accept messages destined to port 514. This feature is user-required and a must. The same applies to the destination port. I am not sure if the "MUST" in section 3.3 was meant that this MUST be an option, but not necessarily be active. The wording should be clarified.rhh%jbh&h'h(hDh*}ri(h,]h-]h.]h/]h1]uh3Kh]rjh=XSI deliberately violate section 3.3 insofar as that I do not necessarily accept messages destined to port 514. This feature is user-required and a must. The same applies to the destination port. I am not sure if the "MUST" in section 3.3 was meant that this MUST be an option, but not necessarily be active. The wording should be clarified.rkrl}rm(h$jhh%jfubaubaubh)rn}ro(h$Xsection 3.6: I do not check checksums. See the issue with discarding messages above. The same solution will probably be applied in my code. h%jRh&h'h(hh*}rp(h,]h-]h.]h/]h1]uh3Nh4hh]rqhA)rr}rs(h$Xsection 3.6: I do not check checksums. See the issue with discarding messages above. The same solution will probably be applied in my code.rth%jnh&h'h(hDh*}ru(h,]h-]h.]h/]h1]uh3Kh]rvh=Xsection 3.6: I do not check checksums. See the issue with discarding messages above. The same solution will probably be applied in my code.rwrx}ry(h$jth%jrubaubaubeubeubh!)rz}r{(h$Uh%h"h&h'h(h)h*}r|(h,]h-]h.]h/]r}hah1]r~h auh3Kh4hh]r(h6)r}r(h$XConlusions/Suggestionsrh%jzh&h'h(h:h*}r(h,]h-]h.]h/]h1]uh3Kh4hh]rh=XConlusions/Suggestionsrr}r(h$jh%jubaubhA)r}r(h$XWThese are my personal conclusions and suggestions. Obviously, they must be discussed ;)rh%jzh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh4hh]rh=XWThese are my personal conclusions and suggestions. Obviously, they must be discussed ;)rr}r(h$jh%jubaubh)r}r(h$Uh%jzh&h'h(hh*}r(hX-h/]h.]h,]h-]h1]uh3Kh4hh]r(h)r}r(h$XNUL should be disallowed in MSGrh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XNUL should be disallowed in MSGrr}r(h$jh%jubaubaubh)r}r(h$XAs it is not possible to definitely know the character encoding of the application-provided message, MSG should **not** be specified to use UTF-8 exclusively. Instead, it is suggested that any encoding may be used but UTF-8 is preferred. To detect UTF-8, the MSG should start with the UTF-8 byte order mask of "EF BB BF" if it is UTF-8 encoded (see section 155.9 of `http://www.unicode.org/versions/Unicode4.0.0/ch15.pdf `_)h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XAs it is not possible to definitely know the character encoding of the application-provided message, MSG should **not** be specified to use UTF-8 exclusively. Instead, it is suggested that any encoding may be used but UTF-8 is preferred. To detect UTF-8, the MSG should start with the UTF-8 byte order mask of "EF BB BF" if it is UTF-8 encoded (see section 155.9 of `http://www.unicode.org/versions/Unicode4.0.0/ch15.pdf `_)h%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h=XpAs it is not possible to definitely know the character encoding of the application-provided message, MSG should rr}r(h$XpAs it is not possible to definitely know the character encoding of the application-provided message, MSG should h%jubh\)r}r(h$X**not**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xnotrr}r(h$Uh%jubah(hdubh=X be specified to use UTF-8 exclusively. Instead, it is suggested that any encoding may be used but UTF-8 is preferred. To detect UTF-8, the MSG should start with the UTF-8 byte order mask of "EF BB BF" if it is UTF-8 encoded (see section 155.9 of rr}r(h$X be specified to use UTF-8 exclusively. Instead, it is suggested that any encoding may be used but UTF-8 is preferred. To detect UTF-8, the MSG should start with the UTF-8 byte order mask of "EF BB BF" if it is UTF-8 encoded (see section 155.9 of h%jubhG)r}r(h$Xp`http://www.unicode.org/versions/Unicode4.0.0/ch15.pdf `_h*}r(UnameX5http://www.unicode.org/versions/Unicode4.0.0/ch15.pdfhKX5http://www.unicode.org/versions/Unicode4.0.0/ch15.pdfrh/]h.]h,]h-]h1]uh%jh]rh=X5http://www.unicode.org/versions/Unicode4.0.0/ch15.pdfrr}r(h$Uh%jubah(hQubhR)r}r(h$X8 hUKh%jh(hVh*}r(Urefurijh/]rhah.]h,]h-]h1]rh auh]ubh=X)r}r(h$X)h%jubeubaubh)r}r(h$XpRequirements to drop messages should be reconsidered. I guess I would not be the only implementor ignoring them.h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XpRequirements to drop messages should be reconsidered. I guess I would not be the only implementor ignoring them.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XpRequirements to drop messages should be reconsidered. I guess I would not be the only implementor ignoring them.rr}r(h$jh%jubaubaubh)r}r(h$XDLogging requirements should be reconsidered and probably be removed.rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XDLogging requirements should be reconsidered and probably be removed.rr}r(h$jh%jubaubaubh)r}r(h$XYIt would be advisable to specify "-" for APP-NAME is the name is not known to the sender.h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XYIt would be advisable to specify "-" for APP-NAME is the name is not known to the sender.rh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XYIt would be advisable to specify "-" for APP-NAME is the name is not known to the sender.rr}r(h$jh%jubaubaubh)r}r(h$XThe implications of the current syslog/tcp industry standard on syslog-protocol should be further evaluated and be fully understood h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XThe implications of the current syslog/tcp industry standard on syslog-protocol should be further evaluated and be fully understoodrh%jh&h'h(hDh*}r(h,]h-]h.]h/]h1]uh3Kh]rh=XThe implications of the current syslog/tcp industry standard on syslog-protocol should be further evaluated and be fully understoodrr}r(h$jh%jubaubaubeubeubeubah$UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh4hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}r Uindirect_targetsr ]r Usettingsr (cdocutils.frontend Values r or}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh:NUerror_encoding_error_handlerr Ubackslashreplacer!Udebugr"NUembed_stylesheetr#Uoutput_encoding_error_handlerr$Ustrictr%U sectnum_xformr&KUdump_transformsr'NU docinfo_xformr(KUwarning_streamr)NUpep_file_url_templater*Upep-%04dr+Uexit_status_levelr,KUconfigr-NUstrict_visitorr.NUcloak_email_addressesr/Utrim_footnote_reference_spacer0Uenvr1NUdump_pseudo_xmlr2NUexpose_internalsr3NUsectsubtitle_xformr4U source_linkr5NUrfc_referencesr6NUoutput_encodingr7Uutf-8r8U source_urlr9NUinput_encodingr:U utf-8-sigr;U_disable_configr<NU id_prefixr=UU tab_widthr>KUerror_encodingr?UUTF-8r@U_sourcerAh'Ugettext_compactrBU generatorrCNUdump_internalsrDNU smart_quotesrEU pep_base_urlrFU https://www.python.org/dev/peps/rGUsyntax_highlightrHUlongrIUinput_encoding_error_handlerrJj%Uauto_id_prefixrKUidrLUdoctitle_xformrMUstrip_elements_with_classesrNNU _config_filesrO]Ufile_insertion_enabledrPU raw_enabledrQKU dump_settingsrRNubUsymbol_footnote_startrSKUidsrT}rU(hjzhh"hjhjhhhhShhhhouUsubstitution_namesrV}rWh(h4h*}rX(h,]h/]h.]Usourceh'h-]h1]uU footnotesrY]rZUrefidsr[}r\ub.build/.doctrees/whitepapers/index.doctree0000664000175000017500000000737713035122644017554 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X white papersqNXrsyslog whitepapersqNuUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hU white-papersqhUrsyslog-whitepapersquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX8/home/rger/proj/rsyslog-doc/source/whitepapers/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hXRsyslog Whitepapersq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1XRsyslog Whitepapersq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hXThese are a collection of white papers written by Rainer Gerhards. They detail logging comparisons and realities based on his experience. They also cover observations regarding the development of rsyslog and the community around syslog messagingq8hhhhhU paragraphq9h}q:(h ]h!]h"]h#]h%]uh'Kh(hh]q;h1XThese are a collection of white papers written by Rainer Gerhards. They detail logging comparisons and realities based on his experience. They also cover observations regarding the development of rsyslog and the community around syslog messagingq(hh8hh6ubaubh)q?}q@(hUhhhhhhh}qA(h ]h!]h"]h#]qBhah%]qChauh'K h(hh]qD(h*)qE}qF(hX White PapersqGhh?hhhh.h}qH(h ]h!]h"]h#]h%]uh'K h(hh]qIh1X White PapersqJqK}qL(hhGhhEubaubcdocutils.nodes compound qM)qN}qO(hUhh?hhhUcompoundqPh}qQ(h ]h!]qRUtoctree-wrapperqSah"]h#]h%]uh'Nh(hh]qTcsphinx.addnodes toctree qU)qV}qW(hUhhNhhhUtoctreeqXh}qY(UnumberedqZKU includehiddenq[hXwhitepapers/indexq\Ucaptionq]NUglobq^h#]h"]U titlesonlyq_h ]h!]h%]Uentriesq`]qa(NXwhitepapers/syslog_parsingqbqcNXwhitepapers/syslog_protocolqdqeNXwhitepapers/queues_analogyqfqgNXwhitepapers/preserve_in_natqhqiNXwhitepapers/reliable_loggingqjqkeUhiddenqlU includefilesqm]qn(hbhdhfhhhjeUmaxdepthqoKuh'K h]ubaubeubeubahUU transformerqpNU footnote_refsqq}qrUrefnamesqs}qtUsymbol_footnotesqu]qvUautofootnote_refsqw]qxUsymbol_footnote_refsqy]qzU citationsq{]q|h(hU current_lineq}NUtransform_messagesq~]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh.NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqɉUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledq̈U raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}q(hhhh?uUsubstitution_namesq}qhh(h}q(h ]h#]h"]Usourcehh!]h%]uU footnotesq]qUrefidsq}qub.build/.doctrees/whitepapers/syslog_parsing.doctree0000664000175000017500000013272013035122644021477 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XietfqXrainer gerhardsqXthe ultimate solution...qNXsyslog parsing in rsyslogq NXwrap-upq NX work-aroundq NX&rsyslog professional services offeringq Xpractical format requirementsq NXsyslog standardizationqNXrsyslogqXbound to specific rule setsqXrsyslog troubleshooting guideqXon the nature of syslog dataquUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUietfqhUrainer-gerhardsqhUthe-ultimate-solutionqh Usyslog-parsing-in-rsyslogqh Uwrap-upq h U work-aroundq!h U&rsyslog-professional-services-offeringq"h Upractical-format-requirementsq#hUsyslog-standardizationq$hUrsyslogq%hUbound-to-specific-rule-setsq&hUrsyslog-troubleshooting-guideq'hUon-the-nature-of-syslog-dataq(uUchildrenq)]q*cdocutils.nodes section q+)q,}q-(U rawsourceq.UUparentq/hUsourceq0XA/home/rger/proj/rsyslog-doc/source/whitepapers/syslog_parsing.rstq1Utagnameq2Usectionq3U attributesq4}q5(Udupnamesq6]Uclassesq7]Ubackrefsq8]Uidsq9]q:haUnamesq;]qhh)]q?(cdocutils.nodes title q@)qA}qB(h.Xsyslog parsing in rsyslogqCh/h,h0h1h2UtitleqDh4}qE(h6]h7]h8]h9]h;]uh=Kh>hh)]qFcdocutils.nodes Text qGXsyslog parsing in rsyslogqHqI}qJ(h.hCh/hAubaubcdocutils.nodes paragraph qK)qL}qM(h.XO*Written by* `Rainer Gerhards `_ *(2008-09-23)*h/h,h0h1h2U paragraphqNh4}qO(h6]h7]h8]h9]h;]uh=Kh>hh)]qP(cdocutils.nodes emphasis qQ)qR}qS(h.X *Written by*h4}qT(h6]h7]h8]h9]h;]uh/hLh)]qUhGX Written byqVqW}qX(h.Uh/hRubah2UemphasisqYubhGX qZ}q[(h.X h/hLubcdocutils.nodes reference q\)q]}q^(h.X3`Rainer Gerhards `_h4}q_(UnameXRainer GerhardsUrefuriq`Xhttp://www.gerhards.net/rainerqah9]h8]h6]h7]h;]uh/hLh)]qbhGXRainer Gerhardsqcqd}qe(h.Uh/h]ubah2U referenceqfubcdocutils.nodes target qg)qh}qi(h.X! U referencedqjKh/hLh2Utargetqkh4}ql(Urefurihah9]qmhah8]h6]h7]h;]qnhauh)]ubhGX qo}qp(h.X h/hLubhQ)qq}qr(h.X*(2008-09-23)*h4}qs(h6]h7]h8]h9]h;]uh/hLh)]qthGX (2008-09-23)quqv}qw(h.Uh/hqubah2hYubeubhK)qx}qy(h.X**We regularly receive messages asking why** `rsyslog `_ **parses this or that message incorrectly.** Of course, it turns out that rsyslog does the right thing, but the message sender does not. And also of course, this is not even of the slightest help to the end user experiencing the problem ;). So I thought I write this paper. It describes the problem source and shows potential solutions (aha!).h/h,h0h1h2hNh4}qz(h6]h7]h8]h9]h;]uh=Kh>hh)]q{(cdocutils.nodes strong q|)q}}q~(h.X,**We regularly receive messages asking why**h4}q(h6]h7]h8]h9]h;]uh/hxh)]qhGX(We regularly receive messages asking whyqq}q(h.Uh/h}ubah2UstrongqubhGX q}q(h.X h/hxubh\)q}q(h.X#`rsyslog `_h4}q(Unamehh`Xhttp://www.rsyslog.comqh9]h8]h6]h7]h;]uh/hxh)]qhGXrsyslogqq}q(h.Uh/hubah2hfubhg)q}q(h.X hjKh/hxh2hkh4}q(Urefurihh9]qh%ah8]h6]h7]h;]qhauh)]ubhGX q}q(h.X h/hxubh|)q}q(h.X,**parses this or that message incorrectly.**h4}q(h6]h7]h8]h9]h;]uh/hxh)]qhGX(parses this or that message incorrectly.qq}q(h.Uh/hubah2hubhGX+ Of course, it turns out that rsyslog does the right thing, but the message sender does not. And also of course, this is not even of the slightest help to the end user experiencing the problem ;). So I thought I write this paper. It describes the problem source and shows potential solutions (aha!).qq}q(h.X+ Of course, it turns out that rsyslog does the right thing, but the message sender does not. And also of course, this is not even of the slightest help to the end user experiencing the problem ;). So I thought I write this paper. It describes the problem source and shows potential solutions (aha!).h/hxubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qh$ah;]qhauh=Kh>hh)]q(h@)q}q(h.XSyslog Standardizationqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXSyslog Standardizationqq}q(h.hh/hubaubhK)q}q(h.XThe syslog protocol has not been standardized until relatively recently.The first document "smelling" a bit like a standard is :rfc:`3164`, which dates back to August 2001. The problem is that this document is no real standard. It has assigned "informational" status by the `IETF `_ which means it provides some hopefully useful information but does not demand anything. It is impossible to "comply" to an informational document. This, of course, doesn't stop marketing guys from telling they comply to RFC3164 and it also does not stop some techs to tell you "this and that does not comply to RFC3164, so it is 's fault".h/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]q(hGXThe syslog protocol has not been standardized until relatively recently.The first document "smelling" a bit like a standard is qq}q(h.XThe syslog protocol has not been standardized until relatively recently.The first document "smelling" a bit like a standard is h/hubcsphinx.addnodes index q)q}q(h.Uh4}q(h9]h8]h6]h7]h;]Uentriesq]q(UsingleqX RFC; RFC 3164Uindex-0qUtqauh/hh)]h2Uindexqubhg)q}q(h.Uh4}q(h6]h7]h8]h9]qhah;]uh/hh)]h2hkubh\)q}q(h.XRFC 3164h4}q(UrefuriU(https://tools.ietf.org/html/rfc3164.htmlh9]h8]h6]h7]qXrfcqah;]Uinternaluh/hh)]qh|)q}q(h.XRFC 3164h4}q(h6]h7]h8]h9]h;]uh/hh)]qhGXRFC 3164qͅq}q(h.Uh/hubah2hubah2hfubhGX, which dates back to August 2001. The problem is that this document is no real standard. It has assigned "informational" status by the qЅq}q(h.X, which dates back to August 2001. The problem is that this document is no real standard. It has assigned "informational" status by the h/hubh\)q}q(h.X`IETF `_h4}q(UnameXIETFh`Xhttp://www.ietf.orgqh9]h8]h6]h7]h;]uh/hh)]qhGXIETFq؅q}q(h.Uh/hubah2hfubhg)q}q(h.X hjKh/hh2hkh4}q(Urefurihh9]qhah8]h6]h7]h;]qhauh)]ubhGXk which means it provides some hopefully useful information but does not demand anything. It is impossible to "comply" to an informational document. This, of course, doesn't stop marketing guys from telling they comply to RFC3164 and it also does not stop some techs to tell you "this and that does not comply to RFC3164, so it is 's fault".qq}q(h.Xk which means it provides some hopefully useful information but does not demand anything. It is impossible to "comply" to an informational document. This, of course, doesn't stop marketing guys from telling they comply to RFC3164 and it also does not stop some techs to tell you "this and that does not comply to RFC3164, so it is 's fault".h/hubeubhK)q}q(h.XThen, there is :rfc:`3195`, which is a real standard. In it's section 3 it makes (a somewhat questionable) reference to (informational) RFC 3164 which may be interpreted in a way that RFC3195 standardizes the format layed out in RFC 3164 by virtue of referencing them. So RFC3195 seems to extend its standardization domain to the concepts layed out in RFC 3164 (which is why I tend to find that refrence questionable). In that sense, RFC3195 standardizes the format informationally described in RFC3164, Section 4. But it demands it only for the scope of RFC3195, which is syslog over BEEP - and NOT syslog over UDP. So one may argue whether or not the RFC3164 format could be considered a standard for any non-BEEP (including UDP) syslog, too. In the strict view I tend to have, it does not. Refering to the RFC3195 context usually does not help, because there are virtually no RFC3195 implementations available (at this time, I would consider this RFC a failure).h/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]q(hGXThen, there is q煁q}q(h.XThen, there is h/hubh)q}q(h.Uh4}q(h9]h8]h6]h7]h;]h]q(hX RFC; RFC 3195Uindex-1qUtqauh/hh)]h2hubhg)q}q(h.Uh4}q(h6]h7]h8]h9]qhah;]uh/hh)]h2hkubh\)q}q(h.XRFC 3195h4}q(UrefuriU(https://tools.ietf.org/html/rfc3195.htmlh9]h8]h6]h7]qXrfcqah;]Uinternaluh/hh)]qh|)q}q(h.XRFC 3195h4}q(h6]h7]h8]h9]h;]uh/hh)]qhGXRFC 3195qq}r(h.Uh/hubah2hubah2hfubhGX, which is a real standard. In it's section 3 it makes (a somewhat questionable) reference to (informational) RFC 3164 which may be interpreted in a way that RFC3195 standardizes the format layed out in RFC 3164 by virtue of referencing them. So RFC3195 seems to extend its standardization domain to the concepts layed out in RFC 3164 (which is why I tend to find that refrence questionable). In that sense, RFC3195 standardizes the format informationally described in RFC3164, Section 4. But it demands it only for the scope of RFC3195, which is syslog over BEEP - and NOT syslog over UDP. So one may argue whether or not the RFC3164 format could be considered a standard for any non-BEEP (including UDP) syslog, too. In the strict view I tend to have, it does not. Refering to the RFC3195 context usually does not help, because there are virtually no RFC3195 implementations available (at this time, I would consider this RFC a failure).rr}r(h.X, which is a real standard. In it's section 3 it makes (a somewhat questionable) reference to (informational) RFC 3164 which may be interpreted in a way that RFC3195 standardizes the format layed out in RFC 3164 by virtue of referencing them. So RFC3195 seems to extend its standardization domain to the concepts layed out in RFC 3164 (which is why I tend to find that refrence questionable). In that sense, RFC3195 standardizes the format informationally described in RFC3164, Section 4. But it demands it only for the scope of RFC3195, which is syslog over BEEP - and NOT syslog over UDP. So one may argue whether or not the RFC3164 format could be considered a standard for any non-BEEP (including UDP) syslog, too. In the strict view I tend to have, it does not. Refering to the RFC3195 context usually does not help, because there are virtually no RFC3195 implementations available (at this time, I would consider this RFC a failure).h/hubeubhK)r}r(h.XNow let's for a short moment assume that RFC3195 would somehow be able to demand RFC3164 format for non-BEEP syslog. So we could use RFC3164 format as a standard. But does that really help? Let's cite RFC 3164, right at the begining of section 4 (actually, this is the first sentence):rh/hh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=K.h>hh)]rhGXNow let's for a short moment assume that RFC3195 would somehow be able to demand RFC3164 format for non-BEEP syslog. So we could use RFC3164 format as a standard. But does that really help? Let's cite RFC 3164, right at the begining of section 4 (actually, this is the first sentence):r r }r (h.jh/jubaubcdocutils.nodes block_quote r )r }r(h.Uh/hh0h1h2U block_quoterh4}r(h6]h7]h8]h9]h;]uh=Nh>hh)]rcdocutils.nodes literal_block r)r}r(h.Xm The payload of any IP packet that has a UDP destination port of 514 MUST be treated as a syslog message. Think a bit about it: this means that whatever is send to port 514 must be considered a valid syslog message. No format at all is demanded. So if "this is junk" is sent to UDP port 514 - voila, we have a valid message (interestingly, it is no longer a syslog message if it is sent to port 515 ;)). You may now argue that I am overdoing. So let's cite RFC 3164, Section 5.4, Example 2: Example 2 Use the BFG! While this is a valid message, it has extraordinarily little useful information.h/j h2U literal_blockrh4}r(U xml:spacerUpreserverh9]h8]h6]h7]h;]uh=K6h)]rhGXm The payload of any IP packet that has a UDP destination port of 514 MUST be treated as a syslog message. Think a bit about it: this means that whatever is send to port 514 must be considered a valid syslog message. No format at all is demanded. So if "this is junk" is sent to UDP port 514 - voila, we have a valid message (interestingly, it is no longer a syslog message if it is sent to port 515 ;)). You may now argue that I am overdoing. So let's cite RFC 3164, Section 5.4, Example 2: Example 2 Use the BFG! While this is a valid message, it has extraordinarily little useful information.rr}r(h.Uh/jubaubaubhK)r}r(h.XMAs you can see, RFC3164 explicitely states that no format at all is required.rh/hh0h1h2hNh4}r (h6]h7]h8]h9]h;]uh=KHh>hh)]r!hGXMAs you can see, RFC3164 explicitely states that no format at all is required.r"r#}r$(h.jh/jubaubhK)r%}r&(h.XNow a side-note is due: all of this does not mean that the RFC3164 authors did not know what they were doing. No, right the contrary is true: RFC3164 mission is to describe what has been seen in practice as syslog messages and the conclusion is quite right that there is no common understanding on the message format. This is also the reason why RFC3164 is an informational document: it provides useful information, but does not precisely specify anything.r'h/hh0h1h2hNh4}r((h6]h7]h8]h9]h;]uh=KKh>hh)]r)hGXNow a side-note is due: all of this does not mean that the RFC3164 authors did not know what they were doing. No, right the contrary is true: RFC3164 mission is to describe what has been seen in practice as syslog messages and the conclusion is quite right that there is no common understanding on the message format. This is also the reason why RFC3164 is an informational document: it provides useful information, but does not precisely specify anything.r*r+}r,(h.j'h/j%ubaubhK)r-}r.(h.X*After all of this bashing, I now have to admit that RFC3164 has some format recommendations layed out in section 4. The format described has quite some value in it and implementors recently try to follow it. This format is usually meant when someone tells you that a software is "RFC3164 compliant" or expects "RFC3164 compliant messages". I also have to admit that rsyslog also uses this format and, in the sense outlined here, expects messages received to be "RFC3164 compliant" (knowingly that such a beast does not exist - I am simply lying here ;)).r/h/hh0h1h2hNh4}r0(h6]h7]h8]h9]h;]uh=KSh>hh)]r1hGX*After all of this bashing, I now have to admit that RFC3164 has some format recommendations layed out in section 4. The format described has quite some value in it and implementors recently try to follow it. This format is usually meant when someone tells you that a software is "RFC3164 compliant" or expects "RFC3164 compliant messages". I also have to admit that rsyslog also uses this format and, in the sense outlined here, expects messages received to be "RFC3164 compliant" (knowingly that such a beast does not exist - I am simply lying here ;)).r2r3}r4(h.j/h/j-ubaubhK)r5}r6(h.XcPlease note that there is some relief of the situation in reach. There is a new normative syslog RFC series upcoming, and it specifies a standard message format. At the time of this writing, the main documents are sitting in the RFC editor queue waiting for a transport mapping to be completed. I personally expect them to be assigned RFC numbers in 2009.r7h/hh0h1h2hNh4}r8(h6]h7]h8]h9]h;]uh=K\h>hh)]r9hGXcPlease note that there is some relief of the situation in reach. There is a new normative syslog RFC series upcoming, and it specifies a standard message format. At the time of this writing, the main documents are sitting in the RFC editor queue waiting for a transport mapping to be completed. I personally expect them to be assigned RFC numbers in 2009.r:r;}r<(h.j7h/j5ubaubhK)r=}r>(h.XEUpdate: the numbers are now assigned and the base RFC is :rfc:`5424`.r?h/hh0h1h2hNh4}r@(h6]h7]h8]h9]h;]uh=Kch>hh)]rA(hGX9Update: the numbers are now assigned and the base RFC is rBrC}rD(h.X9Update: the numbers are now assigned and the base RFC is h/j=ubh)rE}rF(h.Uh4}rG(h9]h8]h6]h7]h;]h]rH(hX RFC; RFC 5424Uindex-2rIUtrJauh/j=h)]h2hubhg)rK}rL(h.Uh4}rM(h6]h7]h8]h9]rNjIah;]uh/j=h)]h2hkubh\)rO}rP(h.XRFC 5424h4}rQ(UrefuriU(https://tools.ietf.org/html/rfc5424.htmlh9]h8]h6]h7]rRXrfcrSah;]Uinternaluh/j=h)]rTh|)rU}rV(h.XRFC 5424h4}rW(h6]h7]h8]h9]h;]uh/jOh)]rXhGXRFC 5424rYrZ}r[(h.Uh/jUubah2hubah2hfubhGX.r\}r](h.X.h/j=ubeubeubh+)r^}r_(h.Uh/h,h0h1h2h3h4}r`(h6]h7]h8]h9]rah#ah;]rbh auh=Kfh>hh)]rc(h@)rd}re(h.XPractical Format Requirementsrfh/j^h0h1h2hDh4}rg(h6]h7]h8]h9]h;]uh=Kfh>hh)]rhhGXPractical Format Requirementsrirj}rk(h.jfh/jdubaubhK)rl}rm(h.XiFrom a practical point of view, the message format expected (and generated by default in legacy mode) is:rnh/j^h0h1h2hNh4}ro(h6]h7]h8]h9]h;]uh=Khh>hh)]rphGXiFrom a practical point of view, the message format expected (and generated by default in legacy mode) is:rqrr}rs(h.jnh/jlubaubj)rt}ru(h.X+TIMESTAMP SP HOST SP TAG MSG(Freetext)h/j^h0h1h2jh4}rv(jjh9]h8]h6]h7]h;]uh=Kmh>hh)]rwhGX+TIMESTAMP SP HOST SP TAG MSG(Freetext)rxry}rz(h.Uh/jtubaubhK)r{}r|(h.XXSP is the ASCII "space" character and the definition of the rest of the fields can be taken from RFC3164. Please note that there also is a lot of confusion on what syntax and semantics the TAG actually has. This format is called "legacy syslog" because it is not well specified (as you know by now) and has been "inherited from the real world".r}h/j^h0h1h2hNh4}r~(h6]h7]h8]h9]h;]uh=Koh>hh)]rhGXXSP is the ASCII "space" character and the definition of the rest of the fields can be taken from RFC3164. Please note that there also is a lot of confusion on what syntax and semantics the TAG actually has. This format is called "legacy syslog" because it is not well specified (as you know by now) and has been "inherited from the real world".rr}r(h.j}h/j{ubaubhK)r}r(h.XRsyslog offers two parsers: one for the upcoming RFC series and one for legacy format. We concentrate on the later. That parser applies some logic to detect missing hostnames, is able to handle various ways the TIMESTAMP is typically malformed. In short it applies a lot of guesswork in trying to figure out what a message really means. I am sure the guessing algorithm can be improved, and I am always trying that when I see new malformed messages (and there is an ample set of them...). However, this finds its limits where it is not possible to differentiate between two entities which could be either. For example, look at this message:rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kuh>hh)]rhGXRsyslog offers two parsers: one for the upcoming RFC series and one for legacy format. We concentrate on the later. That parser applies some logic to detect missing hostnames, is able to handle various ways the TIMESTAMP is typically malformed. In short it applies a lot of guesswork in trying to figure out what a message really means. I am sure the guessing algorithm can be improved, and I am always trying that when I see new malformed messages (and there is an ample set of them...). However, this finds its limits where it is not possible to differentiate between two entities which could be either. For example, look at this message:rr}r(h.jh/jubaubj)r}r(h.X/<144>Tue Sep 23 11:40:01 taghost sample messageh/j^h0h1h2jh4}r(jjh9]h8]h6]h7]h;]uh=Kh>hh)]rhGX/<144>Tue Sep 23 11:40:01 taghost sample messagerr}r(h.Uh/jubaubhK)r}r(h.XDoes it contain a hostname? Mabye. The value "taghost" is a valid hostname. Of course, it is also a valid tag. If it is a hostname, the tag's value is "sample" and the msg value is "message". Or is the hostname missing, the tag is "taghost" and msg is "sample message"? As a human, I tend to say the later interpretation is correct. But that's hard to tell the message parser (and, no, I do not intend to apply artificial intelligence just to guess what the hostname value is...).rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXDoes it contain a hostname? Mabye. The value "taghost" is a valid hostname. Of course, it is also a valid tag. If it is a hostname, the tag's value is "sample" and the msg value is "message". Or is the hostname missing, the tag is "taghost" and msg is "sample message"? As a human, I tend to say the later interpretation is correct. But that's hard to tell the message parser (and, no, I do not intend to apply artificial intelligence just to guess what the hostname value is...).rr}r(h.jh/jubaubhK)r}r(h.XOne approach is to configure the parser so that it never expects hostnames. This becomes problematic if you receive messages from multiple devices. Over time, I may implement parser conditionals, but this is not yet available and I am not really sure if it is needed comlexity...rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXOne approach is to configure the parser so that it never expects hostnames. This becomes problematic if you receive messages from multiple devices. Over time, I may implement parser conditionals, but this is not yet available and I am not really sure if it is needed comlexity...rr}r(h.jh/jubaubhK)r}r(h.XThings like this, happen. Even more scary formats happen in practice. Even from mainstream vendors. For example, I was just asked about this message (which, btw, finally made me write this article here):rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXThings like this, happen. Even more scary formats happen in practice. Even from mainstream vendors. For example, I was just asked about this message (which, btw, finally made me write this article here):rr}r(h.jh/jubaubj)r}r(h.XR"<130> [ERROR] iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"h/j^h0h1h2jh4}r(jjh9]h8]h6]h7]h;]uh=Kh>hh)]rhGXR"<130> [ERROR] iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"rr}r(h.Uh/jubaubhK)r}r(h.XXIf you compare it with the format RFC3164 "suggests", you'll quickly notice that the message is "a bit" malformed. Actually, even my human intelligence is not sufficient to guess if there is a TAG or not (is "[ERROR]" a tag or part of the message). I may not be the smartest guy, but don't expect me to program a parser that is smarter than me.rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXXIf you compare it with the format RFC3164 "suggests", you'll quickly notice that the message is "a bit" malformed. Actually, even my human intelligence is not sufficient to guess if there is a TAG or not (is "[ERROR]" a tag or part of the message). I may not be the smartest guy, but don't expect me to program a parser that is smarter than me.rr}r(h.jh/jubaubhK)r}r(h.XQTo the best of my konwledge, these vendor's device's syslog format can be configured, so it would proabably be a good idea to include a (sufficiently well-formed) timestamp, the sending hostname and (maybe?) a tag to make this message well parseable. I will also once again take this sample and see if we can apply some guesswork. For example, "[" can not be part of a well-formed TIMESTAMP, so logic can conclude there is not TIMESTAMP. Also, "[" can not be used inside a valid hostname, so logic can conclude that the message contains no hostname. Even if I implement this logic (which I will probably do), this is a partial solution: it is impossible to guess if there is a tag or not (honestly!). And, even worse, it is a solution only for those set of messages that can be handled by the logic described. Now consider this hypothetical message:rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXQTo the best of my konwledge, these vendor's device's syslog format can be configured, so it would proabably be a good idea to include a (sufficiently well-formed) timestamp, the sending hostname and (maybe?) a tag to make this message well parseable. I will also once again take this sample and see if we can apply some guesswork. For example, "[" can not be part of a well-formed TIMESTAMP, so logic can conclude there is not TIMESTAMP. Also, "[" can not be used inside a valid hostname, so logic can conclude that the message contains no hostname. Even if I implement this logic (which I will probably do), this is a partial solution: it is impossible to guess if there is a tag or not (honestly!). And, even worse, it is a solution only for those set of messages that can be handled by the logic described. Now consider this hypothetical message:rr}r(h.jh/jubaubj)r}r(h.X{"<130> [ERROR] host.example.net 2008-09-23 11-40-22 PST iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"h/j^h0h1h2jh4}r(jjh9]h8]h6]h7]h;]uh=Kh>hh)]rhGX{"<130> [ERROR] host.example.net 2008-09-23 11-40-22 PST iapp_socket_task.c 399: iappSocketTask: iappRecvPkt returned error"rr}r(h.Uh/jubaubhK)r}r(h.XObviously, it requires additional guesswork. If we iterate over all the cases, we can very quickly see that it is impossible to guess everything correct. In the example above we can not even surely tell if PST should be a timezone or some other message property.rh/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXObviously, it requires additional guesswork. If we iterate over all the cases, we can very quickly see that it is impossible to guess everything correct. In the example above we can not even surely tell if PST should be a timezone or some other message property.rr}r(h.jh/jubaubhK)r}r(h.XA potential solution is to generate a parser-table based parser, but this requires considerable effort and also has quite some runtime overhead. I try to avoid this for now (but I may do it, especially if someone sponsors this work ;)). Side-note: if you want to be a bit scared about potential formats, you may want to have a look at my paper "`On the Nature of Syslog Data `_\ ".h/j^h0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(hGXYA potential solution is to generate a parser-table based parser, but this requires considerable effort and also has quite some runtime overhead. I try to avoid this for now (but I may do it, especially if someone sponsors this work ;)). Side-note: if you want to be a bit scared about potential formats, you may want to have a look at my paper "rr}r(h.XYA potential solution is to generate a parser-table based parser, but this requires considerable effort and also has quite some runtime overhead. I try to avoid this for now (but I may do it, especially if someone sponsors this work ;)). Side-note: if you want to be a bit scared about potential formats, you may want to have a look at my paper "h/jubh\)r}r(h.Xh`On the Nature of Syslog Data `_h4}r(UnameXOn the Nature of Syslog Datah`XFhttp://www.monitorware.com/en/workinprogress/nature-of-syslog-data.phprh9]h8]h6]h7]h;]uh/jh)]rhGXOn the Nature of Syslog Datarr}r(h.Uh/jubah2hfubhg)r}r(h.XI hjKh/jh2hkh4}r(Urefurijh9]rh(ah8]h6]h7]h;]rhauh)]ubhGX".rr}r(h.X\ ".h/jubeubeubh+)r}r(h.Uh/h,h0h1h2h3h4}r(h6]h7]h8]h9]rh!ah;]rh auh=Kh>hh)]r(h@)r}r(h.X Work-Aroundrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGX Work-Aroundrr}r(h.jh/jubaubhK)r}r(h.X**The number one work-around is to configure your devices so that they emit (sufficiently) well-formed messages.** You should by now know what these look like.h/jh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(h|)r}r(h.Xr**The number one work-around is to configure your devices so that they emit (sufficiently) well-formed messages.**h4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXnThe number one work-around is to configure your devices so that they emit (sufficiently) well-formed messages.rr}r(h.Uh/jubah2hubhGX- You should by now know what these look like.rr}r(h.X- You should by now know what these look like.h/jubeubhK)r}r(h.XmIf that cure is not available, there are some things you can do in rsyslog to handle the situation. First of all, be sure to read about :doc:`rsyslog.conf format <../configuration/basic_structure>` and the :doc:`property replacer <../configuration/property_replacer>` specifically. You need to understand that everything is configured in rsyslog. And that the message is parsed into properties. There are also properties available which do not stem back directly to parsing. Most importantly, %fromhost% property holds the name of the system rsyslog received the message from. In non-relay cases, this can be used instead of hostname. In relay cases, there is no cure other than to either fix the orginal sender or at least one of the relays in front of the rsyslog instance in question. Similarly, you can use %timegenerated% instead of %timereported%. Timegenerated is the time the message hit rsyslog for the first time. For non-relayed, locally connected peers, Timegenerated should be a very close approximation of the actual time a message was formed at the sender (depending, of course, on potential internal queueing inside the sender). Also, you may use the %rawmsg% property together with the several extraction modes the property replacer supports. Rawmsg contains the message as it is received from the remote peer. In a sense, you can implement a post-parser with this method.h/jh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(hGXIf that cure is not available, there are some things you can do in rsyslog to handle the situation. First of all, be sure to read about rr}r (h.XIf that cure is not available, there are some things you can do in rsyslog to handle the situation. First of all, be sure to read about h/jubcsphinx.addnodes pending_xref r )r }r (h.X=:doc:`rsyslog.conf format <../configuration/basic_structure>`r h/jh0h1h2U pending_xrefrh4}r(UreftypeXdocrUrefwarnrU reftargetrX ../configuration/basic_structureU refdomainUh9]h8]U refexplicith6]h7]h;]UrefdocrXwhitepapers/syslog_parsingruh=Kh)]rcdocutils.nodes literal r)r}r(h.j h4}r(h6]h7]r(Uxrefrjeh8]h9]h;]uh/j h)]rhGXrsyslog.conf formatrr}r(h.Uh/jubah2Uliteralr ubaubhGX and the r!r"}r#(h.X and the h/jubj )r$}r%(h.X=:doc:`property replacer <../configuration/property_replacer>`r&h/jh0h1h2jh4}r'(UreftypeXdocr(jjX"../configuration/property_replacerU refdomainUh9]h8]U refexplicith6]h7]h;]jjuh=Kh)]r)j)r*}r+(h.j&h4}r,(h6]h7]r-(jj(eh8]h9]h;]uh/j$h)]r.hGXproperty replacerr/r0}r1(h.Uh/j*ubah2j ubaubhGXb specifically. You need to understand that everything is configured in rsyslog. And that the message is parsed into properties. There are also properties available which do not stem back directly to parsing. Most importantly, %fromhost% property holds the name of the system rsyslog received the message from. In non-relay cases, this can be used instead of hostname. In relay cases, there is no cure other than to either fix the orginal sender or at least one of the relays in front of the rsyslog instance in question. Similarly, you can use %timegenerated% instead of %timereported%. Timegenerated is the time the message hit rsyslog for the first time. For non-relayed, locally connected peers, Timegenerated should be a very close approximation of the actual time a message was formed at the sender (depending, of course, on potential internal queueing inside the sender). Also, you may use the %rawmsg% property together with the several extraction modes the property replacer supports. Rawmsg contains the message as it is received from the remote peer. In a sense, you can implement a post-parser with this method.r2r3}r4(h.Xb specifically. You need to understand that everything is configured in rsyslog. And that the message is parsed into properties. There are also properties available which do not stem back directly to parsing. Most importantly, %fromhost% property holds the name of the system rsyslog received the message from. In non-relay cases, this can be used instead of hostname. In relay cases, there is no cure other than to either fix the orginal sender or at least one of the relays in front of the rsyslog instance in question. Similarly, you can use %timegenerated% instead of %timereported%. Timegenerated is the time the message hit rsyslog for the first time. For non-relayed, locally connected peers, Timegenerated should be a very close approximation of the actual time a message was formed at the sender (depending, of course, on potential internal queueing inside the sender). Also, you may use the %rawmsg% property together with the several extraction modes the property replacer supports. Rawmsg contains the message as it is received from the remote peer. In a sense, you can implement a post-parser with this method.h/jubeubhK)r5}r6(h.X5To use these properties, you need to define your own templates and assign them. Details can be found in the above-quoted documentation. Just let's do a quick example. Let's say you have the horrible message shown above and can not fix the sending device for some good reason. In rsyslog.conf, you used to say:r7h/jh0h1h2hNh4}r8(h6]h7]h8]h9]h;]uh=Kh>hh)]r9hGX5To use these properties, you need to define your own templates and assign them. Details can be found in the above-quoted documentation. Just let's do a quick example. Let's say you have the horrible message shown above and can not fix the sending device for some good reason. In rsyslog.conf, you used to say:r:r;}r<(h.j7h/j5ubaubj)r=}r>(h.X*.* /var/log/somefileh/jh0h1h2jh4}r?(jjh9]h8]h6]h7]h;]uh=Kh>hh)]r@hGX*.* /var/log/somefilerArB}rC(h.Uh/j=ubaubhK)rD}rE(h.XOf course, things do not work out well with that ill-formed message. So you decide to dump the rawmsg to the file and pull the remote host and time of message generation from rsyslog's internal properties (which, btw, is clever, because otherwise there is no indication of these two properties...). So you need to define a template for that and make sure the template is used with your file logging action. This is how it may look:rFh/jh0h1h2hNh4}rG(h6]h7]h8]h9]h;]uh=Kh>hh)]rHhGXOf course, things do not work out well with that ill-formed message. So you decide to dump the rawmsg to the file and pull the remote host and time of message generation from rsyslog's internal properties (which, btw, is clever, because otherwise there is no indication of these two properties...). So you need to define a template for that and make sure the template is used with your file logging action. This is how it may look:rIrJ}rK(h.jFh/jDubaubj)rL}rM(h.X$template, MalfromedMsgFormater,"%timegenerated% %fromhost% %rawmsg:::drop-last-lf%\n" *.* /var/log/somefile;MalformedMsgFormatterh/jh0h1h2jh4}rN(jjh9]h8]h6]h7]h;]uh=Kh>hh)]rOhGX$template, MalfromedMsgFormater,"%timegenerated% %fromhost% %rawmsg:::drop-last-lf%\n" *.* /var/log/somefile;MalformedMsgFormatterrPrQ}rR(h.Uh/jLubaubhK)rS}rT(h.XThis will make your log much nicer, but not look perfect. Experiment a bit with the available properties and replacer extraction options to fine-tune it to your needs.rUh/jh0h1h2hNh4}rV(h6]h7]h8]h9]h;]uh=Kh>hh)]rWhGXThis will make your log much nicer, but not look perfect. Experiment a bit with the available properties and replacer extraction options to fine-tune it to your needs.rXrY}rZ(h.jUh/jSubaubeubh+)r[}r\(h.Uh/h,h0h1h2h3h4}r](h6]h7]h8]h9]r^hah;]r_hauh=Kh>hh)]r`(h@)ra}rb(h.XThe Ultimate Solution...rch/j[h0h1h2hDh4}rd(h6]h7]h8]h9]h;]uh=Kh>hh)]rehGXThe Ultimate Solution...rfrg}rh(h.jch/jaubaubhK)ri}rj(h.XIs available with rsyslog 5.3.4 and above. Here, we can define so-called custom parsers. These are plugin modules, written in C and adapted to a specific message format need. The big plus of custom parsers is that they offer excellent performance and unlimited possibilities - far better than any work-around could do. Custom parsers can be `bound to specific rule sets `_ (and thus listening) ports with relative ease. The only con is that they must be written. However, if you are lucky, a parser for your device may already exist. If not, you can opt to write it yourself, what is not too hard if you know some C. Alternatively, Adiscon can program one for you as part of the `rsyslog professional services offering `_. In any case, you should seriously consider custom parsers as an alternative if you can not reconfigure your device to send decent message format.h/j[h0h1h2hNh4}rk(h6]h7]h8]h9]h;]uh=Kh>hh)]rl(hGXUIs available with rsyslog 5.3.4 and above. Here, we can define so-called custom parsers. These are plugin modules, written in C and adapted to a specific message format need. The big plus of custom parsers is that they offer excellent performance and unlimited possibilities - far better than any work-around could do. Custom parsers can be rmrn}ro(h.XUIs available with rsyslog 5.3.4 and above. Here, we can define so-called custom parsers. These are plugin modules, written in C and adapted to a specific message format need. The big plus of custom parsers is that they offer excellent performance and unlimited possibilities - far better than any work-around could do. Custom parsers can be h/jiubh\)rp}rq(h.X;`bound to specific rule sets `_h4}rr(UnameXbound to specific rule setsh`Xrsconf1_rulesetparser.htmlrsh9]h8]h6]h7]h;]uh/jih)]rthGXbound to specific rule setsrurv}rw(h.Uh/jpubah2hfubhg)rx}ry(h.X hjKh/jih2hkh4}rz(Urefurijsh9]r{h&ah8]h6]h7]h;]r|hauh)]ubhGX3 (and thus listening) ports with relative ease. The only con is that they must be written. However, if you are lucky, a parser for your device may already exist. If not, you can opt to write it yourself, what is not too hard if you know some C. Alternatively, Adiscon can program one for you as part of the r}r~}r(h.X3 (and thus listening) ports with relative ease. The only con is that they must be written. However, if you are lucky, a parser for your device may already exist. If not, you can opt to write it yourself, what is not too hard if you know some C. Alternatively, Adiscon can program one for you as part of the h/jiubh\)r}r(h.XX`rsyslog professional services offering `_h4}r(UnameX&rsyslog professional services offeringh`X,http://www.rsyslog.com/professional-servicesrh9]h8]h6]h7]h;]uh/jih)]rhGX&rsyslog professional services offeringrr}r(h.Uh/jubah2hfubhg)r}r(h.X/ hjKh/jih2hkh4}r(Urefurijh9]rh"ah8]h6]h7]h;]rh auh)]ubhGX. In any case, you should seriously consider custom parsers as an alternative if you can not reconfigure your device to send decent message format.rr}r(h.X. In any case, you should seriously consider custom parsers as an alternative if you can not reconfigure your device to send decent message format.h/jiubeubeubh+)r}r(h.Uh/h,h0h1h2h3h4}r(h6]h7]h8]h9]rh ah;]rh auh=M h>hh)]r(h@)r}r(h.XWrap-Uprh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=M h>hh)]rhGXWrap-Uprr}r(h.jh/jubaubhK)r}r(h.XfSyslog message format is not sufficiently standardized. There exists a weak "standard" format, which is used by a good number of implementations. However, there exist many others, including mainstream vendor implementations, which have a (sometimes horribly) different format. Rsyslog tries to deal with anomalies but can not guess right in all instances. If possible, the sender should be configured to submit well-formed messages. If that is not possible, you can work around these issues with rsyslog's property replacer and template system. Or you can use a suitable message parser or write one for your needs.rh/jh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=M h>hh)]rhGXfSyslog message format is not sufficiently standardized. There exists a weak "standard" format, which is used by a good number of implementations. However, there exist many others, including mainstream vendor implementations, which have a (sometimes horribly) different format. Rsyslog tries to deal with anomalies but can not guess right in all instances. If possible, the sender should be configured to submit well-formed messages. If that is not possible, you can work around these issues with rsyslog's property replacer and template system. Or you can use a suitable message parser or write one for your needs.rr}r(h.jh/jubaubhK)r}r(h.XI hope this is a useful guide. You may also have a look at the `rsyslog troubleshooting guide `_ for further help and places where to ask questions.h/jh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=Mh>hh)]r(hGX?I hope this is a useful guide. You may also have a look at the rr}r(h.X?I hope this is a useful guide. You may also have a look at the h/jubh\)r}r(h.X4`rsyslog troubleshooting guide `_h4}r(UnameXrsyslog troubleshooting guideh`Xtroubleshoot.htmlrh9]h8]h6]h7]h;]uh/jh)]rhGXrsyslog troubleshooting guiderr}r(h.Uh/jubah2hfubhg)r}r(h.X hjKh/jh2hkh4}r(Urefurijh9]rh'ah8]h6]h7]h;]rhauh)]ubhGX4 for further help and places where to ask questions.rr}r(h.X4 for further help and places where to ask questions.h/jubeubeubeubah.UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh>hU current_linerNUtransform_messagesr]r(cdocutils.nodes system_message r)r}r(h.Uh4}r(h6]UlevelKh9]h8]Usourceh1h7]h;]UlineKUtypeUINFOruh)]rhK)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX-Hyperlink target "index-0" is not referenced.rr}r(h.Uh/jubah2hNubah2Usystem_messagerubj)r}r(h.Uh4}r(h6]UlevelKh9]h8]Usourceh1h7]h;]UlineKUtypejuh)]rhK)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX-Hyperlink target "index-1" is not referenced.rr}r(h.Uh/jubah2hNubah2jubj)r}r(h.Uh4}r(h6]UlevelKh9]h8]Usourceh1h7]h;]UlineKcUtypejuh)]rhK)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX-Hyperlink target "index-2" is not referenced.rr}r(h.Uh/jubah2hNubah2jubeUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelr KU _destinationr NU halt_levelr KU strip_classesr NhDNUerror_encoding_error_handlerr UbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsr NUsectsubtitle_xformr!U source_linkr"NUrfc_referencesr#NUoutput_encodingr$Uutf-8r%U source_urlr&NUinput_encodingr'U utf-8-sigr(U_disable_configr)NU id_prefixr*UU tab_widthr+KUerror_encodingr,UUTF-8r-U_sourcer.h1Ugettext_compactr/U generatorr0NUdump_internalsr1NU smart_quotesr2U pep_base_urlr3U https://www.python.org/dev/peps/r4Usyntax_highlightr5Ulongr6Uinput_encoding_error_handlerr7jUauto_id_prefixr8Uidr9Udoctitle_xformr:Ustrip_elements_with_classesr;NU _config_filesr<]Ufile_insertion_enabledr=U raw_enabledr>KU dump_settingsr?NubUsymbol_footnote_startr@KUidsrA}rB(h#j^h&jxh(jjIjKh"jhhhh,hj[h jh'jh!jhhhhh%hh$hhhhuUsubstitution_namesrC}rDh2h>h4}rE(h6]h9]h8]Usourceh1h7]h;]uU footnotesrF]rGUrefidsrH}rIub.build/.doctrees/whitepapers/preserve_in_nat.doctree0000664000175000017500000001677113035122644021626 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX!preserving syslog sender over natqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU!preserving-syslog-sender-over-natqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXB/home/rger/proj/rsyslog-doc/source/whitepapers/preserve_in_nat.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX!Preserving syslog sender over NATq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X!Preserving syslog sender over NATq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXpQuestion: I have a number of syslog clients behind a NAT device. The receiver receives syslog messages that travelled over the NAT device. This leads the receiver to believe that all messages originated from the same IP address. With stock syslogd, I can not differentiate between the senders. Is there any way to record the correct sender of the message with rsyslog?q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XpQuestion: I have a number of syslog clients behind a NAT device. The receiver receives syslog messages that travelled over the NAT device. This leads the receiver to believe that all messages originated from the same IP address. With stock syslogd, I can not differentiate between the senders. Is there any way to record the correct sender of the message with rsyslog?q:q;}q<(hh6hh4ubaubh3)q=}q>(hXAnswer: OK, I’ve now had some real lab time. The good news in short: if you use rsyslog both on the senders as well as on the receiver, you do NOT have any problems with NAT.q?hhhhhh7h}q@(h]h]h ]h!]h#]uh%Kh&hh]qAh/XAnswer: OK, I’ve now had some real lab time. The good news in short: if you use rsyslog both on the senders as well as on the receiver, you do NOT have any problems with NAT.qBqC}qD(hh?hh=ubaubh3)qE}qF(hX{To double-check (and out of curiosity), I also tried with stock syslogd. I used the ones that came with RedHat and FreeBSD. Neither of them reports the sending machine correctly, they all report the NAT address. Obviously, this is what made this thread appear, but it is a good verification for the correctness of my lab. Next, I tried rsyslogd on the sender and stock syslogd on the receiver (just RedHat this time). The machine was still incorrectly displayed as the NAT address. However, now the real machine name immediately followed the NAT address, so you could differentiate the different machines – but in a inconsistent way.qGhhhhhh7h}qH(h]h]h ]h!]h#]uh%K h&hh]qIh/X{To double-check (and out of curiosity), I also tried with stock syslogd. I used the ones that came with RedHat and FreeBSD. Neither of them reports the sending machine correctly, they all report the NAT address. Obviously, this is what made this thread appear, but it is a good verification for the correctness of my lab. Next, I tried rsyslogd on the sender and stock syslogd on the receiver (just RedHat this time). The machine was still incorrectly displayed as the NAT address. However, now the real machine name immediately followed the NAT address, so you could differentiate the different machines – but in a inconsistent way.qJqK}qL(hhGhhEubaubh3)qM}qN(hXFinally, I tried to run the stock syslogds against rsyslogd. Again, the host was not properly displayed. Actually, this time the host was not displayed at all (with the default rsyslogd template). Instead, the tag showed up in the host field. So this configuration is basically unusable.qOhhhhhh7h}qP(h]h]h ]h!]h#]uh%K h&hh]qQh/XFinally, I tried to run the stock syslogds against rsyslogd. Again, the host was not properly displayed. Actually, this time the host was not displayed at all (with the default rsyslogd template). Instead, the tag showed up in the host field. So this configuration is basically unusable.qRqS}qT(hhOhhMubaubh3)qU}qV(hXThe root cause of the NAT issue with stock syslogd obviously is that it does NOT include the HOST header that should be sent as of RFC 3164. This requires the receiver to take the host from the socket, which – in a NATed environment – can only hold the mangled NAT address. Rsyslog instead includes the HOST header, so the actual host name can be taken from that (this is the way rsyslog works with the default templates).qWhhhhhh7h}qX(h]h]h ]h!]h#]uh%Kh&hh]qYh/XThe root cause of the NAT issue with stock syslogd obviously is that it does NOT include the HOST header that should be sent as of RFC 3164. This requires the receiver to take the host from the socket, which – in a NATed environment – can only hold the mangled NAT address. Rsyslog instead includes the HOST header, so the actual host name can be taken from that (this is the way rsyslog works with the default templates).qZq[}q\(hhWhhUubaubh3)q]}q^(hXI barely remember seeing this in code when I initially forked rsyslog from sysklogd. I have not verified it once again. I have also not tested with syslog-ng, simply because that is not my prime focus and a lab would have required too much time.q_hhhhhh7h}q`(h]h]h ]h!]h#]uh%Kh&hh]qah/XI barely remember seeing this in code when I initially forked rsyslog from sysklogd. I have not verified it once again. I have also not tested with syslog-ng, simply because that is not my prime focus and a lab would have required too much time.qbqc}qd(hh_hh]ubaubh3)qe}qf(hXjTo make a long story short: If you use rsyslog on both the senders and receivers, NAT is no issue for you.qghhhhhh7h}qh(h]h]h ]h!]h#]uh%Kh&hh]qih/XjTo make a long story short: If you use rsyslog on both the senders and receivers, NAT is no issue for you.qjqk}ql(hhghheubaubeubahUU transformerqmNU footnote_refsqn}qoUrefnamesqp}qqUsymbol_footnotesqr]qsUautofootnote_refsqt]quUsymbol_footnote_refsqv]qwU citationsqx]qyh&hU current_lineqzNUtransform_messagesq{]q|Ureporterq}NUid_startq~KU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqƉUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqʈU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/compatibility/0000775000175000017500000000000013035122641015373 5ustar rgerrgerbuild/.doctrees/compatibility/v7compatibility.doctree0000664000175000017500000006573613035122641022111 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X7retries of output plugins that do not do proper repliesqNX"compatibility notes for rsyslog v7qNX/omruleset and discard (~) action are deprecatedqNX#stricter string-template processingq NXbsd-style blocksq NXuser-noticable changesq NX;background information on why omusrmsg needed to be changedq Xomfile: file creation timeq NXnotes for the 7.3/7.4 branchqNX4omusrmsg: using just a username or "*" is deprecatedqNXcee-propertiesqNXperformance implicationsqNXrsyslog bsd blocks info pageqX*"last message repeated n times" processingqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU7retries-of-output-plugins-that-do-not-do-proper-repliesqhU"compatibility-notes-for-rsyslog-v7qhU+omruleset-and-discard-action-are-deprecatedqh U#stricter-string-template-processingq h Ubsd-style-blocksq!h Uuser-noticable-changesq"h U;background-information-on-why-omusrmsg-needed-to-be-changedq#h Uomfile-file-creation-timeq$hUnotes-for-the-7-3-7-4-branchq%hU/omusrmsg-using-just-a-username-or-is-deprecatedq&hUcee-propertiesq'hUperformance-implicationsq(hUrsyslog-bsd-blocks-info-pageq)hU(last-message-repeated-n-times-processingq*uUchildrenq+]q,cdocutils.nodes section q-)q.}q/(U rawsourceq0UUparentq1hUsourceq2XD/home/rger/proj/rsyslog-doc/source/compatibility/v7compatibility.rstq3Utagnameq4Usectionq5U attributesq6}q7(Udupnamesq8]Uclassesq9]Ubackrefsq:]Uidsq;]qhauUlineq?KUdocumentq@hh+]qA(cdocutils.nodes title qB)qC}qD(h0X"Compatibility Notes for rsyslog v7qEh1h.h2h3h4UtitleqFh6}qG(h8]h9]h:]h;]h=]uh?Kh@hh+]qHcdocutils.nodes Text qIX"Compatibility Notes for rsyslog v7qJqK}qL(h0hEh1hCubaubcdocutils.nodes paragraph qM)qN}qO(h0XPThis document describes things to keep in mind when moving from v6 to v7. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used v6 and want to use v7 without hassle.qPh1h.h2h3h4U paragraphqQh6}qR(h8]h9]h:]h;]h=]uh?Kh@hh+]qShIXPThis document describes things to keep in mind when moving from v6 to v7. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used v6 and want to use v7 without hassle.qTqU}qV(h0hPh1hNubaubhM)qW}qX(h0X%Version 7 builds on the new config language introduced in v6 and extends it. Other than v6, it not just only extends the config language, but provides considerable changes to core elements as well. The result is much more power and ease of use as well (this time that is not contradictionary).qYh1h.h2h3h4hQh6}qZ(h8]h9]h:]h;]h=]uh?K h@hh+]q[hIX%Version 7 builds on the new config language introduced in v6 and extends it. Other than v6, it not just only extends the config language, but provides considerable changes to core elements as well. The result is much more power and ease of use as well (this time that is not contradictionary).q\q]}q^(h0hYh1hWubaubh-)q_}q`(h0Uh1h.h2h3h4h5h6}qa(h8]h9]h:]h;]qbh!ah=]qch auh?Kh@hh+]qd(hB)qe}qf(h0XBSD-Style blocksqgh1h_h2h3h4hFh6}qh(h8]h9]h:]h;]h=]uh?Kh@hh+]qihIXBSD-Style blocksqjqk}ql(h0hgh1heubaubhM)qm}qn(h0XBSD style blocks are no longer supported (for good reason). See the `rsyslog BSD blocks info page `_ for more information and how to upgrade your config.h1h_h2h3h4hQh6}qo(h8]h9]h:]h;]h=]uh?Kh@hh+]qp(hIXDBSD style blocks are no longer supported (for good reason). See the qqqr}qs(h0XDBSD style blocks are no longer supported (for good reason). See the h1hmubcdocutils.nodes reference qt)qu}qv(h0X>`rsyslog BSD blocks info page `_h6}qw(UnameXrsyslog BSD blocks info pageUrefuriqxXhttp://www.rsyslog.com/g/BSDqyh;]h:]h8]h9]h=]uh1hmh+]qzhIXrsyslog BSD blocks info pageq{q|}q}(h0Uh1huubah4U referenceq~ubcdocutils.nodes target q)q}q(h0X U referencedqKh1hmh4Utargetqh6}q(Urefurihyh;]qh)ah:]h8]h9]h=]qhauh+]ubhIX5 for more information and how to upgrade your config.qq}q(h0X5 for more information and how to upgrade your config.h1hmubeubeubh-)q}q(h0Uh1h.h2h3h4h5h6}q(h8]h9]h:]h;]qh'ah=]qhauh?Kh@hh+]q(hB)q}q(h0XCEE-Propertiesqh1hh2h3h4hFh6}q(h8]h9]h:]h;]h=]uh?Kh@hh+]qhIXCEE-Propertiesqq}q(h0hh1hubaubhM)q}q(h0XIn rsyslog v6, CEE properties could not be used across disk-based queues. If this was done, their content was reset. This was a missing feature in v6. In v7, this feature has been implemented. Consequently, situations where the previous behaviour were desired need now to be solved differently. We do not think that this will cause any problems to anyone, especially as in v6 this was announced as a missing feature.qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh@hh+]qhIXIn rsyslog v6, CEE properties could not be used across disk-based queues. If this was done, their content was reset. This was a missing feature in v6. In v7, this feature has been implemented. Consequently, situations where the previous behaviour were desired need now to be solved differently. We do not think that this will cause any problems to anyone, especially as in v6 this was announced as a missing feature.qq}q(h0hh1hubaubeubh-)q}q(h0Uh1h.h2h3h4h5h6}q(h8]h9]h:]h;]qh&ah=]qhauh?Kh@hh+]q(hB)q}q(h0X4omusrmsg: using just a username or "*" is deprecatedqh1hh2h3h4hFh6}q(h8]h9]h:]h;]h=]uh?Kh@hh+]qhIX4omusrmsg: using just a username or "*" is deprecatedqq}q(h0X4omusrmsg: using just a username or "*" is deprecatedqh1hubaubhM)q}q(h0XIn legacy config format, the asterisk denotes writing the message to all users. This is usually used for emergency messages and configured like this:qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K h@hh+]qhIXIn legacy config format, the asterisk denotes writing the message to all users. This is usually used for emergency messages and configured like this:qq}q(h0hh1hubaubcdocutils.nodes literal_block q)q}q(h0X *.emerg *h1hh2h3h4U literal_blockqh6}q(U xml:spaceqUpreserveqh;]h:]h8]h9]h=]uh?K%h@hh+]qhIX *.emerg *qq}q(h0Uh1hubaubhM)q}q(h0XUnfortunately, the use of this single character conflicts with other uses, for example with the multiplication operator. While rsyslog up to versions v7.4 preserves the meaning of asterisk as an action, it is deprecated and will probably be removed in future versions. Consequently, a warning message is emitted. To make this warning go away, the action must be explicitly given, as follows:qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K'h@hh+]qhIXUnfortunately, the use of this single character conflicts with other uses, for example with the multiplication operator. While rsyslog up to versions v7.4 preserves the meaning of asterisk as an action, it is deprecated and will probably be removed in future versions. Consequently, a warning message is emitted. To make this warning go away, the action must be explicitly given, as follows:qDžq}q(h0hh1hubaubh)q}q(h0X*.emerg :omusrmsg:*h1hh2h3h4hh6}q(hhh;]h:]h8]h9]h=]uh?K/h@hh+]qhIX*.emerg :omusrmsg:*q΅q}q(h0Uh1hubaubhM)q}q(h0X/The same holds true for user names. For exampleqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K1h@hh+]qhIX/The same holds true for user names. For exampleqօq}q(h0hh1hubaubh)q}q(h0X *.emerg johnh1hh2h3h4hh6}q(hhh;]h:]h8]h9]h=]uh?K5h@hh+]qhIX *.emerg johnq݅q}q(h0Uh1hubaubhM)q}q(h0X#at a minimum should be rewritten asqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K7h@hh+]qhIX#at a minimum should be rewritten asq允q}q(h0hh1hubaubh)q}q(h0X*.emerg :omusrmsg:johnh1hh2h3h4hh6}q(hhh;]h:]h8]h9]h=]uh?K;h@hh+]qhIX*.emerg :omusrmsg:johnq셁q}q(h0Uh1hubaubhM)q}q(h0XWOf course, for even more clarity the new RainerScript style of action can also be used:qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K=h@hh+]qhIXWOf course, for even more clarity the new RainerScript style of action can also be used:qq}q(h0hh1hubaubh)q}q(h0X-*.emerg action(type="omusrmsg" users="john")h1hh2h3h4hh6}q(hhh;]h:]h8]h9]h=]uh?KBh@hh+]qhIX-*.emerg action(type="omusrmsg" users="john")qq}q(h0Uh1hubaubhM)q}q(h0XIn Rainer's blog, there is more `background information on why omusrmsg needed to be changed `_ available.h1hh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KDh@hh+]r(hIX In Rainer's blog, there is more rr}r(h0X In Rainer's blog, there is more h1hubht)r}r(h0X`background information on why omusrmsg needed to be changed `_h6}r(UnameX;background information on why omusrmsg needed to be changedhxXHhttp://blog.gerhards.net/2011/07/why-omusrmsg-is-evil-and-how-it-is.htmlrh;]h:]h8]h9]h=]uh1hh+]r hIX;background information on why omusrmsg needed to be changedr r }r (h0Uh1jubah4h~ubh)r }r(h0XK hKh1hh4hh6}r(Urefurijh;]rh#ah:]h8]h9]h=]rh auh+]ubhIX available.rr}r(h0X available.h1hubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rhah=]rhauh?KIh@hh+]r(hB)r}r(h0X/omruleset and discard (~) action are deprecatedrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?KIh@hh+]rhIX/omruleset and discard (~) action are deprecatedr r!}r"(h0jh1jubaubhM)r#}r$(h0XEBoth continue to work, but have been replaced by better alternatives.r%h1jh2h3h4hQh6}r&(h8]h9]h:]h;]h=]uh?KJh@hh+]r'hIXEBoth continue to work, but have been replaced by better alternatives.r(r)}r*(h0j%h1j#ubaubhM)r+}r,(h0XThe discard action (tilde character) has been replaced by the "stop" RainerScript directive. It is considered more intuitive and offers slightly better performance.r-h1jh2h3h4hQh6}r.(h8]h9]h:]h;]h=]uh?KLh@hh+]r/hIXThe discard action (tilde character) has been replaced by the "stop" RainerScript directive. It is considered more intuitive and offers slightly better performance.r0r1}r2(h0j-h1j+ubaubhM)r3}r4(h0XThe omruleset module has been replaced by the "call" RainerScript directive. Call permits to execute a ruleset like a subroutine, and does so with much higher performance than omruleset did. Note that omruleset could be run off an async queue. This was more a side than a desired effect and is not supported by the call statement. If that effect was needed, it can simply be simulated by running the called rulesets actions asynchronously (what in any case is the right way to handle this).r5h1jh2h3h4hQh6}r6(h8]h9]h:]h;]h=]uh?KPh@hh+]r7hIXThe omruleset module has been replaced by the "call" RainerScript directive. Call permits to execute a ruleset like a subroutine, and does so with much higher performance than omruleset did. Note that omruleset could be run off an async queue. This was more a side than a desired effect and is not supported by the call statement. If that effect was needed, it can simply be simulated by running the called rulesets actions asynchronously (what in any case is the right way to handle this).r8r9}r:(h0j5h1j3ubaubhM)r;}r<(h0XNote that the deprecated modules emit warning messages when being used. They tell that the construct is deprecated and which statement is to be used as replacement. This does **not** affect operations: both modules are still fully operational and will not be removed in the v7 timeframe.h1jh2h3h4hQh6}r=(h8]h9]h:]h;]h=]uh?KXh@hh+]r>(hIXNote that the deprecated modules emit warning messages when being used. They tell that the construct is deprecated and which statement is to be used as replacement. This does r?r@}rA(h0XNote that the deprecated modules emit warning messages when being used. They tell that the construct is deprecated and which statement is to be used as replacement. This does h1j;ubcdocutils.nodes strong rB)rC}rD(h0X**not**h6}rE(h8]h9]h:]h;]h=]uh1j;h+]rFhIXnotrGrH}rI(h0Uh1jCubah4UstrongrJubhIXi affect operations: both modules are still fully operational and will not be removed in the v7 timeframe.rKrL}rM(h0Xi affect operations: both modules are still fully operational and will not be removed in the v7 timeframe.h1j;ubeubeubh-)rN}rO(h0Uh1h.h2h3h4h5h6}rP(h8]h9]h:]h;]rQhah=]rRhauh?K^h@hh+]rS(hB)rT}rU(h0X7Retries of output plugins that do not do proper repliesrVh1jNh2h3h4hFh6}rW(h8]h9]h:]h;]h=]uh?K^h@hh+]rXhIX7Retries of output plugins that do not do proper repliesrYrZ}r[(h0jVh1jTubaubhM)r\}r](h0XESome output plugins may not be able to detect if their target is capable of accepting data again after an error (technically, they always return OK when TryResume is called). Previously, the rsyslog core engine suspended such an action after 1000 successive failures. This lead to potentially a large amount of errors and error messages. Starting with 7.2.1, this has been reduced to 10 successive failures. This still gives the plugin a chance to recover. In extreme cases, a plugin may now enter suspend mode where it previously did not do so. In practice, we do NOT expect that.r^h1jNh2h3h4hQh6}r_(h8]h9]h:]h;]h=]uh?K_h@hh+]r`hIXESome output plugins may not be able to detect if their target is capable of accepting data again after an error (technically, they always return OK when TryResume is called). Previously, the rsyslog core engine suspended such an action after 1000 successive failures. This lead to potentially a large amount of errors and error messages. Starting with 7.2.1, this has been reduced to 10 successive failures. This still gives the plugin a chance to recover. In extreme cases, a plugin may now enter suspend mode where it previously did not do so. In practice, we do NOT expect that.rarb}rc(h0j^h1j\ubaubeubh-)rd}re(h0Uh1h.h2h3h4h5h6}rf(h8]h9]h:]h;]rgh$ah=]rhh auh?Kih@hh+]ri(hB)rj}rk(h0Xomfile: file creation timerlh1jdh2h3h4hFh6}rm(h8]h9]h:]h;]h=]uh?Kih@hh+]rnhIXomfile: file creation timerorp}rq(h0jlh1jjubaubhM)rr}rs(h0XOriginally, omfile created files immediately during startup, no matter if they were written to or not. In v7, this has changed. Files are only created when they are needed for the first time.rth1jdh2h3h4hQh6}ru(h8]h9]h:]h;]h=]uh?Kjh@hh+]rvhIXOriginally, omfile created files immediately during startup, no matter if they were written to or not. In v7, this has changed. Files are only created when they are needed for the first time.rwrx}ry(h0jth1jrubaubhM)rz}r{(h0XWAlso, in pre-v7 files were created *before* privileges were dropped. This meant that files could be written to locations where the actual desired rsyslog user was *not* permitted to. In v7, this has been fixed. This is fix also the prime reason that files are now created on demand (which is later in the process and after the privilege drop).h1jdh2h3h4hQh6}r|(h8]h9]h:]h;]h=]uh?Knh@hh+]r}(hIX#Also, in pre-v7 files were created r~r}r(h0X#Also, in pre-v7 files were created h1jzubcdocutils.nodes emphasis r)r}r(h0X*before*h6}r(h8]h9]h:]h;]h=]uh1jzh+]rhIXbeforerr}r(h0Uh1jubah4UemphasisrubhIXx privileges were dropped. This meant that files could be written to locations where the actual desired rsyslog user was rr}r(h0Xx privileges were dropped. This meant that files could be written to locations where the actual desired rsyslog user was h1jzubj)r}r(h0X*not*h6}r(h8]h9]h:]h;]h=]uh1jzh+]rhIXnotrr}r(h0Uh1jubah4jubhIX permitted to. In v7, this has been fixed. This is fix also the prime reason that files are now created on demand (which is later in the process and after the privilege drop).rr}r(h0X permitted to. In v7, this has been fixed. This is fix also the prime reason that files are now created on demand (which is later in the process and after the privilege drop).h1jzubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh%ah=]rhauh?Kuh@hh+]r(hB)r}r(h0XNotes for the 7.3/7.4 branchrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kuh@hh+]rhIXNotes for the 7.3/7.4 branchrr}r(h0jh1jubaubh-)r}r(h0Uh1jh2h3h4h5h6}r(h8]h9]h:]h;]rh*ah=]rhauh?Kxh@hh+]r(hB)r}r(h0X*"last message repeated n times" Processingrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kxh@hh+]rhIX*"last message repeated n times" Processingrr}r(h0jh1jubaubhM)r}r(h0XThis processing has been optimized and moved to the input side. This results in usually far better performance and also de-couples different sources from the same processing. It is now also integrated in to the more generic rate-limiting processing.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kzh@hh+]rhIXThis processing has been optimized and moved to the input side. This results in usually far better performance and also de-couples different sources from the same processing. It is now also integrated in to the more generic rate-limiting processing.rr}r(h0jh1jubaubh-)r}r(h0Uh1jh2h3h4h5h6}r(h8]h9]h:]h;]rh"ah=]rh auh?Kh@hh+]r(hB)r}r(h0XUser-Noticable Changesrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXUser-Noticable Changesrr}r(h0jh1jubaubhM)r}r(h0X5The code works almost as before, with two exceptions:rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIX5The code works almost as before, with two exceptions:rr}r(h0jh1jubaubcdocutils.nodes bullet_list r)r}r(h0Uh1jh2h3h4U bullet_listrh6}r(UbulletrX*h;]h:]h8]h9]h=]uh?Kh@hh+]r(cdocutils.nodes list_item r)r}r(h0XThe suppression amount can be different, as the new algorithm precisely check's a single source, and while that source is being read. The previous algorithm worked on a set of mixed messages from multiple sources.h1jh2h3h4U list_itemrh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0XThe suppression amount can be different, as the new algorithm precisely check's a single source, and while that source is being read. The previous algorithm worked on a set of mixed messages from multiple sources.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]rhIXThe suppression amount can be different, as the new algorithm precisely check's a single source, and while that source is being read. The previous algorithm worked on a set of mixed messages from multiple sources.rr}r(h0jh1jubaubaubj)r}r(h0XThe previous algorithm wrote a "last message repeated n times" message at least every 60 seconds. For performance reasons, we do no longer do this but write this message only when a new message arrives or rsyslog is shut down. h1jh2h3h4jh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0XThe previous algorithm wrote a "last message repeated n times" message at least every 60 seconds. For performance reasons, we do no longer do this but write this message only when a new message arrives or rsyslog is shut down.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]rhIXThe previous algorithm wrote a "last message repeated n times" message at least every 60 seconds. For performance reasons, we do no longer do this but write this message only when a new message arrives or rsyslog is shut down.rr}r(h0jh1jubaubaubeubhM)r}r(h0XNote that the new algorithms needs support from input modules. If old modules which do not have the necessary support are used, duplicate messages will most probably not be detected. Upgrading the module code is simple, and all rsyslog-provided plugins support the new method, so this should not be a real problem (crafting a solution would result in rather complex code - for a case that most probably would never happen).rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXNote that the new algorithms needs support from input modules. If old modules which do not have the necessary support are used, duplicate messages will most probably not be detected. Upgrading the module code is simple, and all rsyslog-provided plugins support the new method, so this should not be a real problem (crafting a solution would result in rather complex code - for a case that most probably would never happen).rr}r(h0jh1jubaubeubh-)r}r(h0Uh1jh2h3h4h5h6}r(h8]h9]h:]h;]rh(ah=]rhauh?Kh@hh+]r(hB)r}r(h0XPerformance Implicationsrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXPerformance Implicationsrr}r(h0jh1jubaubhM)r}r (h0X;In general, the new method enables far faster output processing. However, it needs to be noted that the "last message repeated n" processing needs parsed messages in order to detect duplicated. Consequently, if it is enabled the parser step cannot be deferred to the main queue processing thread and thus must be done during input processing. The changes workload distribution and may have (good or bad) effect on the overall performance. If you have a very high performance installation, it is suggested to check the performance profile before deploying the new version.r h1jh2h3h4hQh6}r (h8]h9]h:]h;]h=]uh?Kh@hh+]r hIX;In general, the new method enables far faster output processing. However, it needs to be noted that the "last message repeated n" processing needs parsed messages in order to detect duplicated. Consequently, if it is enabled the parser step cannot be deferred to the main queue processing thread and thus must be done during input processing. The changes workload distribution and may have (good or bad) effect on the overall performance. If you have a very high performance installation, it is suggested to check the performance profile before deploying the new version.r r}r(h0j h1jubaubhM)r}r(h0X**Note:** for high-performance environments it is highly recommended NOT to use "last message repeated n times" processing but rather the other (more efficient) rate-limiting methods. These also do NOT require the parsing step to be done during input processing.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(jB)r}r(h0X **Note:**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXNote:rr}r(h0Uh1jubah4jJubhIX for high-performance environments it is highly recommended NOT to use "last message repeated n times" processing but rather the other (more efficient) rate-limiting methods. These also do NOT require the parsing step to be done during input processing.rr}r(h0X for high-performance environments it is highly recommended NOT to use "last message repeated n times" processing but rather the other (more efficient) rate-limiting methods. These also do NOT require the parsing step to be done during input processing.h1jubeubeubeubh-)r}r(h0Uh1jh2h3h4h5h6}r (h8]h9]h:]h;]r!h ah=]r"h auh?Kh@hh+]r#(hB)r$}r%(h0X#Stricter string-template Processingr&h1jh2h3h4hFh6}r'(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIX#Stricter string-template Processingr)r*}r+(h0j&h1j$ubaubhM)r,}r-(h0XPreviously, no error message for invalid string template parameters was generated. Rather a malformed template was generated, and error information emitted at runtime. However, this could be quite confusing. Note that the new code changes user experience: formerly, rsyslog and the affected actions properly started up, but the actions did not produce proper data. Now, there are startup error messages and the actions are NOT executed (due to missing template due to template error).r.h1jh2h3h4hQh6}r/(h8]h9]h:]h;]h=]uh?Kh@hh+]r0hIXPreviously, no error message for invalid string template parameters was generated. Rather a malformed template was generated, and error information emitted at runtime. However, this could be quite confusing. Note that the new code changes user experience: formerly, rsyslog and the affected actions properly started up, but the actions did not produce proper data. Now, there are startup error messages and the actions are NOT executed (due to missing template due to template error).r1r2}r3(h0j.h1j,ubaubeubeubeubah0UU transformerr4NU footnote_refsr5}r6Urefnamesr7}r8Usymbol_footnotesr9]r:Uautofootnote_refsr;]r<Usymbol_footnote_refsr=]r>U citationsr?]r@h@hU current_linerANUtransform_messagesrB]rCUreporterrDNUid_startrEKU autofootnotesrF]rGU citation_refsrH}rIUindirect_targetsrJ]rKUsettingsrL(cdocutils.frontend Values rMorN}rO(Ufootnote_backlinksrPKUrecord_dependenciesrQNU rfc_base_urlrRUhttps://tools.ietf.org/html/rSU tracebackrTUpep_referencesrUNUstrip_commentsrVNU toc_backlinksrWUentryrXU language_coderYUenrZU datestampr[NU report_levelr\KU _destinationr]NU halt_levelr^KU strip_classesr_NhFNUerror_encoding_error_handlerr`UbackslashreplaceraUdebugrbNUembed_stylesheetrcUoutput_encoding_error_handlerrdUstrictreU sectnum_xformrfKUdump_transformsrgNU docinfo_xformrhKUwarning_streamriNUpep_file_url_templaterjUpep-%04drkUexit_status_levelrlKUconfigrmNUstrict_visitorrnNUcloak_email_addressesroUtrim_footnote_reference_spacerpUenvrqNUdump_pseudo_xmlrrNUexpose_internalsrsNUsectsubtitle_xformrtU source_linkruNUrfc_referencesrvNUoutput_encodingrwUutf-8rxU source_urlryNUinput_encodingrzU utf-8-sigr{U_disable_configr|NU id_prefixr}UU tab_widthr~KUerror_encodingrUUTF-8rU_sourcerh3Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjeUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(h!h_h%jh&hh$jdh(jhjNh jh"jh#j h'hh)hhjhh.h*juUsubstitution_namesr}rh4h@h6}r(h8]h;]h:]Usourceh3h9]h=]uU footnotesr]rUrefidsr}rub.build/.doctrees/compatibility/v6compatibility.doctree0000664000175000017500000011324713035122641022077 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainerscript based rsyslog.confqNX"compatibility notes for rsyslog v6qNX copyrightqNX+blog post about rsyslog 6.3.3 config formatq Xrainer gerhardsq X plugin abiq NXadisconq Xproperty "pri-text"q NX(escape sequences in script-based filtersqNXcompatibility modeqNXompipe default templateqNXomusrmsgqNX$default action queue enqueue timeoutqNX(why the name rainerscript?)qXblog post on omusrmsgqXabort on config errorsqNXdefault batch sizesqNX outchannelsqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q (hUrainerscript-based-rsyslog-confq!hU"compatibility-notes-for-rsyslog-v6q"hU copyrightq#h U+blog-post-about-rsyslog-6-3-3-config-formatq$h Urainer-gerhardsq%h U plugin-abiq&h Uadisconq'h Uproperty-pri-textq(hU(escape-sequences-in-script-based-filtersq)hUcompatibility-modeq*hUompipe-default-templateq+hUomusrmsgq,hU$default-action-queue-enqueue-timeoutq-hUwhy-the-name-rainerscriptq.hUblog-post-on-omusrmsgq/hUabort-on-config-errorsq0hUdefault-batch-sizesq1hU outchannelsq2uUchildrenq3]q4cdocutils.nodes section q5)q6}q7(U rawsourceq8UUparentq9hUsourceq:XD/home/rger/proj/rsyslog-doc/source/compatibility/v6compatibility.rstq;Utagnameq}q?(Udupnamesq@]UclassesqA]UbackrefsqB]UidsqC]qDh"aUnamesqE]qFhauUlineqGKUdocumentqHhh3]qI(cdocutils.nodes title qJ)qK}qL(h8X"Compatibility Notes for rsyslog v6qMh9h6h:h;h}qO(h@]hA]hB]hC]hE]uhGKhHhh3]qPcdocutils.nodes Text qQX"Compatibility Notes for rsyslog v6qRqS}qT(h8hMh9hKubaubcdocutils.nodes paragraph qU)qV}qW(h8XmThis document describes things to keep in mind when moving from v5 to v6. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used a previous version and want to use the current one without hassle.qXh9h6h:h;h}qZ(h@]hA]hB]hC]hE]uhGKhHhh3]q[hQXmThis document describes things to keep in mind when moving from v5 to v6. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used a previous version and want to use the current one without hassle.q\q]}q^(h8hXh9hVubaubhU)q_}q`(h8X\Version 6 offers a better config language and some other improvements. As the config system has many ties into the rsyslog engine AND all plugins, the changes are somewhat intrusive. Note, however, that core processing has not been changed much in v6 and will not. So once the configuration is loaded, the stability of v6 is quite comparable to v5.qah9h6h:h;h}qb(h@]hA]hB]hC]hE]uhGK hHhh3]qchQX\Version 6 offers a better config language and some other improvements. As the config system has many ties into the rsyslog engine AND all plugins, the changes are somewhat intrusive. Note, however, that core processing has not been changed much in v6 and will not. So once the configuration is loaded, the stability of v6 is quite comparable to v5.qdqe}qf(h8hah9h_ubaubh5)qg}qh(h8Uh9h6h:h;h}qi(h@]hA]hB]hC]qjh(ahE]qkh auhGKhHhh3]ql(hJ)qm}qn(h8XProperty "pri-text"qoh9hgh:h;h}qp(h@]hA]hB]hC]hE]uhGKhHhh3]qqhQXProperty "pri-text"qrqs}qt(h8hoh9hmubaubhU)qu}qv(h8XTraditionally, this property did not only return the textual form of the pri ("local0.err"), but also appended the numerical value to it ("local0.err<133>"). This sounds odd and was left unnoticed for some years. In October 2011, this odd behaviour was brought up on the rsyslog mailing list by Gregory K. Ruiz-Ade. Code review showed that the behaviour was intentional, but no trace of what the intention was when it was introduced could be found. The documentation was also unclear, it said no numerical value was present, but the samples had it. We agreed that the additional numerical value is of disadvantage. We also guessed that this property is very rarely being used, otherwise the problem should have been raised much earlier. However, we didn't want to change behaviour in older builds. So v6 was set to clean up the situation. In v6, text-pri will always return the textual part only ("local0.err") and the numerical value will not be contained any longer inside the string. If you actually need that value, it can fairly easily be added via the template system. **If you have used this property previously and relied on the numerical part, you need to update your rsyslog configuration files.**h9hgh:h;h}qw(h@]hA]hB]hC]hE]uhGKhHhh3]qx(hQX3Traditionally, this property did not only return the textual form of the pri ("local0.err"), but also appended the numerical value to it ("local0.err<133>"). This sounds odd and was left unnoticed for some years. In October 2011, this odd behaviour was brought up on the rsyslog mailing list by Gregory K. Ruiz-Ade. Code review showed that the behaviour was intentional, but no trace of what the intention was when it was introduced could be found. The documentation was also unclear, it said no numerical value was present, but the samples had it. We agreed that the additional numerical value is of disadvantage. We also guessed that this property is very rarely being used, otherwise the problem should have been raised much earlier. However, we didn't want to change behaviour in older builds. So v6 was set to clean up the situation. In v6, text-pri will always return the textual part only ("local0.err") and the numerical value will not be contained any longer inside the string. If you actually need that value, it can fairly easily be added via the template system. qyqz}q{(h8X3Traditionally, this property did not only return the textual form of the pri ("local0.err"), but also appended the numerical value to it ("local0.err<133>"). This sounds odd and was left unnoticed for some years. In October 2011, this odd behaviour was brought up on the rsyslog mailing list by Gregory K. Ruiz-Ade. Code review showed that the behaviour was intentional, but no trace of what the intention was when it was introduced could be found. The documentation was also unclear, it said no numerical value was present, but the samples had it. We agreed that the additional numerical value is of disadvantage. We also guessed that this property is very rarely being used, otherwise the problem should have been raised much earlier. However, we didn't want to change behaviour in older builds. So v6 was set to clean up the situation. In v6, text-pri will always return the textual part only ("local0.err") and the numerical value will not be contained any longer inside the string. If you actually need that value, it can fairly easily be added via the template system. h9huubcdocutils.nodes strong q|)q}}q~(h8X**If you have used this property previously and relied on the numerical part, you need to update your rsyslog configuration files.**h>}q(h@]hA]hB]hC]hE]uh9huh3]qhQXIf you have used this property previously and relied on the numerical part, you need to update your rsyslog configuration files.qq}q(h8Uh9h}ubah}q(h@]hA]hB]hC]qh&ahE]qh auhGK%hHhh3]q(hJ)q}q(h8X Plugin ABIqh9hh:h;h}q(h@]hA]hB]hC]hE]uhGK%hHhh3]qhQX Plugin ABIqq}q(h8hh9hubaubhU)q}q(h8X]The plugin interface has considerably been changed to support the new config language. All plugins need to be upgraded. This usually does not require much coding. However, if the new config language shall be supported, more changes must be made to plugin code. All project-supported plugins have been upgraded, so this compatibility issue is only of interest for you if you have custom plugins or use some user-contributed plugins from the rsyslog project that are not maintained by the project itself (omoracle is an example). Please expect some further plugin instability during the initial v6 releases.qh9hh:h;h}q(h@]hA]hB]hC]hE]uhGK&hHhh3]qhQX]The plugin interface has considerably been changed to support the new config language. All plugins need to be upgraded. This usually does not require much coding. However, if the new config language shall be supported, more changes must be made to plugin code. All project-supported plugins have been upgraded, so this compatibility issue is only of interest for you if you have custom plugins or use some user-contributed plugins from the rsyslog project that are not maintained by the project itself (omoracle is an example). Please expect some further plugin instability during the initial v6 releases.qq}q(h8hh9hubaubeubh5)q}q(h8Uh9h6h:h;h}q(h@]hA]hB]hC]qh!ahE]qhauhGK0hHhh3]q(hJ)q}q(h8XRainerScript based rsyslog.confqh9hh:h;h}q(h@]hA]hB]hC]hE]uhGK0hHhh3]qhQXRainerScript based rsyslog.confqq}q(h8hh9hubaubhU)q}q(h8X7A better config format was the main release target for rsyslog v6. It comes in the flavor of so-called RainerScript `(why the name RainerScript?) `_ RainerScript supports legacy syslog.conf format, much as you know it from other syslogds (like sysklogd or the BSD syslogd) as well as previous versions of rsyslog. Initial work on RainerScript began in v4, and the if-construct was already supported in v4 and v5. Version 6 has now taken this further. After long discussions we decided to use the legacy format as a basis, and lightly extend it by native RainerScript constructs. The main goal was to make sure that previous knowledge and config systems could still be used while offering a much more intuitive and powerful way of configuring rsyslog.h9hh:h;h}q(h@]hA]hB]hC]hE]uhGK1hHhh3]q(hQXtA better config format was the main release target for rsyslog v6. It comes in the flavor of so-called RainerScript qq}q(h8XtA better config format was the main release target for rsyslog v6. It comes in the flavor of so-called RainerScript h9hubcdocutils.nodes reference q)q}q(h8Xi`(why the name RainerScript?) `_h>}q(UnameX(why the name RainerScript?)UrefuriqXGhttp://blog.gerhards.net/2008/02/introducing-rainerscript-and-some.htmlqhC]hB]h@]hA]hE]uh9hh3]qhQX(why the name RainerScript?)qq}q(h8Uh9hubahU referencedqKh9hh}q(UrefurihhC]qh.ahB]h@]hA]hE]qhauh3]ubhQXZ RainerScript supports legacy syslog.conf format, much as you know it from other syslogds (like sysklogd or the BSD syslogd) as well as previous versions of rsyslog. Initial work on RainerScript began in v4, and the if-construct was already supported in v4 and v5. Version 6 has now taken this further. After long discussions we decided to use the legacy format as a basis, and lightly extend it by native RainerScript constructs. The main goal was to make sure that previous knowledge and config systems could still be used while offering a much more intuitive and powerful way of configuring rsyslog.qÅq}q(h8XZ RainerScript supports legacy syslog.conf format, much as you know it from other syslogds (like sysklogd or the BSD syslogd) as well as previous versions of rsyslog. Initial work on RainerScript began in v4, and the if-construct was already supported in v4 and v5. Version 6 has now taken this further. After long discussions we decided to use the legacy format as a basis, and lightly extend it by native RainerScript constructs. The main goal was to make sure that previous knowledge and config systems could still be used while offering a much more intuitive and powerful way of configuring rsyslog.h9hubeubhU)q}q(h8XRainerScript has been implemented from scratch and with new tools (flex/bison, for those in the know). Starting with 6.3.3, this new config file processor replaces the legacy one. Note that the new processor handles all formats, extended RainerScript as well as legacy syslog.conf format. There are some legacy construct that were especially hard to translate. You'll read about them in other parts of this document (especially outchannels, which require a format change).qh9hh:h;h}q(h@]hA]hB]hC]hE]uhGK>hHhh3]qhQXRainerScript has been implemented from scratch and with new tools (flex/bison, for those in the know). Starting with 6.3.3, this new config file processor replaces the legacy one. Note that the new processor handles all formats, extended RainerScript as well as legacy syslog.conf format. There are some legacy construct that were especially hard to translate. You'll read about them in other parts of this document (especially outchannels, which require a format change).q˅q}q(h8hh9hubaubhU)q}q(h8XIn v6, all legacy formats are supported. In the long term, we may remove some of the ugly rsyslog-specific constructs. Good candidates are all configuration commands starting with a dollar sign, like "$ActionFileDefaultTemplate"). However, this will not be the case before rsyslog v7 or (much more likely) v8/9. Right now, you also need to use these commands, because not all have already been converted to the new RainerScript format.qh9hh:h;h}q(h@]hA]hB]hC]hE]uhGKDhHhh3]qhQXIn v6, all legacy formats are supported. In the long term, we may remove some of the ugly rsyslog-specific constructs. Good candidates are all configuration commands starting with a dollar sign, like "$ActionFileDefaultTemplate"). However, this will not be the case before rsyslog v7 or (much more likely) v8/9. Right now, you also need to use these commands, because not all have already been converted to the new RainerScript format.qӅq}q(h8hh9hubaubhU)q}q(h8XIn 6.3.3, the new parser is used, but almost none of the extended RainerScript capabilities are available. They will incrementally be introduced with the following releases. Note that for some features (most importantly if-then-else nested blocks), the v6 core engine is not capable enough. It is our aim to provide a much better config language to as many rsyslog users as quickly as possible. As such, we refrain from doing big engine changes in v6. This in turn means we cannot introduce some features into RainerScript that we really want to see. These features will come up with rsyslog v7, which will have even better flow control capabilities inside the core engine. Note that v7 will fully support v6 RainerScript. Let us also say that the v6 version is not a low-end quick hack: it offers full-fledged syslog message processing control, capable of doing the best you can find inside the industry. We just say that v7 will come up with even more advanced capabilities.qh9hh:h;h}q(h@]hA]hB]hC]hE]uhGKJhHhh3]qhQXIn 6.3.3, the new parser is used, but almost none of the extended RainerScript capabilities are available. They will incrementally be introduced with the following releases. Note that for some features (most importantly if-then-else nested blocks), the v6 core engine is not capable enough. It is our aim to provide a much better config language to as many rsyslog users as quickly as possible. As such, we refrain from doing big engine changes in v6. This in turn means we cannot introduce some features into RainerScript that we really want to see. These features will come up with rsyslog v7, which will have even better flow control capabilities inside the core engine. Note that v7 will fully support v6 RainerScript. Let us also say that the v6 version is not a low-end quick hack: it offers full-fledged syslog message processing control, capable of doing the best you can find inside the industry. We just say that v7 will come up with even more advanced capabilities.qۅq}q(h8hh9hubaubhU)q}q(h8X-Please note that we tried hard to make the RainerScript parser compatible with all legacy config files. However, we may have failed in one case or another. So if you experience problems during config processing, chances are there may be a problem on the rsyslog side. In that case, please let us know.qh9hh:h;h}q(h@]hA]hB]hC]hE]uhGKVhHhh3]qhQX-Please note that we tried hard to make the RainerScript parser compatible with all legacy config files. However, we may have failed in one case or another. So if you experience problems during config processing, chances are there may be a problem on the rsyslog side. In that case, please let us know.qㅁq}q(h8hh9hubaubhU)q}q(h8XPlease see the `blog post about rsyslog 6.3.3 config format `_ for details of what is currently supported.h9hh:h;h}q(h@]hA]hB]hC]hE]uhGK[hHhh3]q(hQXPlease see the qꅁq}q(h8XPlease see the h9hubh)q}q(h8X}`blog post about rsyslog 6.3.3 config format `_h>}q(UnameX+blog post about rsyslog 6.3.3 config formathXLhttp://blog.gerhards.net/2011/07/rsyslog-633-config-format-improvements.htmlqhC]hB]h@]hA]hE]uh9hh3]qhQX+blog post about rsyslog 6.3.3 config formatqq}q(h8Uh9hubahhKh9hh}q(UrefurihhC]qh$ahB]h@]hA]hE]qh auh3]ubhQX, for details of what is currently supported.qq}q(h8X, for details of what is currently supported.h9hubeubeubh5)q}q(h8Uh9h6h:h;h}q(h@]hA]hB]hC]rh*ahE]rhauhGKahHhh3]r(hJ)r}r(h8Xcompatibility moderh9hh:h;h}r(h@]hA]hB]hC]hE]uhGKahHhh3]rhQXcompatibility moderr }r (h8jh9jubaubhU)r }r (h8X!Compatibility mode (specified via -c option) has been removed. This was a migration aid from sysklogd and very early versions of rsyslog. As all major distros now have rsyslog as their default, and thus ship rsyslog-compliant config files, there is no longer a need for compatibility mode. Removing it provides easier to maintain code. Also, practice has shown that many users were confused by compatibility mode (and even some package maintainers got it wrong). So this not only cleans up the code but rather removes a frequent source of error.r h9hh:h;h}r(h@]hA]hB]hC]hE]uhGKbhHhh3]rhQX!Compatibility mode (specified via -c option) has been removed. This was a migration aid from sysklogd and very early versions of rsyslog. As all major distros now have rsyslog as their default, and thus ship rsyslog-compliant config files, there is no longer a need for compatibility mode. Removing it provides easier to maintain code. Also, practice has shown that many users were confused by compatibility mode (and even some package maintainers got it wrong). So this not only cleans up the code but rather removes a frequent source of error.rr}r(h8j h9j ubaubhU)r}r(h8XIt must be noted, though, that this means rsyslog is no longer a 100% drop-in replacement for sysklogd. If you convert an extremely old system, you need to checks its config and probably need to apply some very mild changes to the config file.rh9hh:h;h}r(h@]hA]hB]hC]hE]uhGKjhHhh3]rhQXIt must be noted, though, that this means rsyslog is no longer a 100% drop-in replacement for sysklogd. If you convert an extremely old system, you need to checks its config and probably need to apply some very mild changes to the config file.rr}r(h8jh9jubaubeubh5)r}r(h8Uh9h6h:h;h}r(h@]hA]hB]hC]rh0ahE]rhauhGKohHhh3]r (hJ)r!}r"(h8Xabort on config errorsr#h9jh:h;h}r$(h@]hA]hB]hC]hE]uhGKohHhh3]r%hQXabort on config errorsr&r'}r((h8j#h9j!ubaubhU)r)}r*(h8XGPrevious versions accepted some malformedness inside the config file without aborting. This could lead to some uncertainty about which configuration was actually running. In v6 there are some situations where config file errors can not be ignored. In these cases rsyslog emits error messages to stderr, and then exists with a non-zero exit code. It is important to check for those cases as this means log data is potentially lost. Please note that the root problem is the same for earlier versions as well. With them, it was just harder to spot why things went wrong (and if at all).r+h9jh:h;h}r,(h@]hA]hB]hC]hE]uhGKphHhh3]r-hQXGPrevious versions accepted some malformedness inside the config file without aborting. This could lead to some uncertainty about which configuration was actually running. In v6 there are some situations where config file errors can not be ignored. In these cases rsyslog emits error messages to stderr, and then exists with a non-zero exit code. It is important to check for those cases as this means log data is potentially lost. Please note that the root problem is the same for earlier versions as well. With them, it was just harder to spot why things went wrong (and if at all).r.r/}r0(h8j+h9j)ubaubeubh5)r1}r2(h8Uh9h6h:h;h}r3(h@]hA]hB]hC]r4h1ahE]r5hauhGKzhHhh3]r6(hJ)r7}r8(h8XDefault Batch Sizesr9h9j1h:h;h}r:(h@]hA]hB]hC]hE]uhGKzhHhh3]r;hQXDefault Batch Sizesr<r=}r>(h8j9h9j7ubaubhU)r?}r@(h8XDue to their positive effect on performance and comparatively low overhead, default batch sizes have been increased. Starting with 6.3.4, the action queues have a default batch size of 128 messages.rAh9j1h:h;h}rB(h@]hA]hB]hC]hE]uhGK{hHhh3]rChQXDue to their positive effect on performance and comparatively low overhead, default batch sizes have been increased. Starting with 6.3.4, the action queues have a default batch size of 128 messages.rDrE}rF(h8jAh9j?ubaubeubh5)rG}rH(h8Uh9h6h:h;h}rI(h@]hA]hB]hC]rJh-ahE]rKhauhGKhHhh3]rL(hJ)rM}rN(h8X$Default action queue enqueue timeoutrOh9jGh:h;h}rP(h@]hA]hB]hC]hE]uhGKhHhh3]rQhQX$Default action queue enqueue timeoutrRrS}rT(h8jOh9jMubaubhU)rU}rV(h8XThis timeout previously was 2 seconds, and has been reduced to 50ms (starting with 6.5.0). This change was made as a long timeout will caused delays in the associated main queue, something that was quite unexpected to users. Now, this can still happen, but the effect is much less harsh (but still considerable on a busy system). Also, 50ms should be fairly enough for most output sources, except when they are really broken (like network disconnect). If they are really broken, even a 2second timeout does not help, so we hopefully get the best of both worlds with the new timeout. A specific timeout can of course still be configured, it is just the timeout that changed.rWh9jGh:h;h}rX(h@]hA]hB]hC]hE]uhGKhHhh3]rYhQXThis timeout previously was 2 seconds, and has been reduced to 50ms (starting with 6.5.0). This change was made as a long timeout will caused delays in the associated main queue, something that was quite unexpected to users. Now, this can still happen, but the effect is much less harsh (but still considerable on a busy system). Also, 50ms should be fairly enough for most output sources, except when they are really broken (like network disconnect). If they are really broken, even a 2second timeout does not help, so we hopefully get the best of both worlds with the new timeout. A specific timeout can of course still be configured, it is just the timeout that changed.rZr[}r\(h8jWh9jUubaubeubh5)r]}r^(h8Uh9h6h:h;h}r_(h@]hA]hB]hC]r`h2ahE]rahauhGKhHhh3]rb(hJ)rc}rd(h8X outchannelsreh9j]h:h;h}rf(h@]hA]hB]hC]hE]uhGKhHhh3]rghQX outchannelsrhri}rj(h8jeh9jcubaubhU)rk}rl(h8XOutchannels are a to-be-removed feature of rsyslog, at least as far as the config syntax is concerned. Nevertheless, v6 still supports it, but a new syntax is required for the action. Let's assume your outchannel is named "channel". The previous syntax wasrmh9j]h:h;h}rn(h@]hA]hB]hC]hE]uhGKhHhh3]rohQXOutchannels are a to-be-removed feature of rsyslog, at least as far as the config syntax is concerned. Nevertheless, v6 still supports it, but a new syntax is required for the action. Let's assume your outchannel is named "channel". The previous syntax wasrprq}rr(h8jmh9jkubaubcdocutils.nodes literal_block rs)rt}ru(h8X *.* $channelh9j]h:h;h}rw(U xml:spacerxUpreserveryhC]hB]h@]hA]hE]uhGKhHhh3]rzhQX *.* $channelr{r|}r}(h8Uh9jtubaubhU)r~}r(h8XQThis was deprecated in v5 and no longer works in v6. Instead, you need to specifyrh9j]h:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXQThis was deprecated in v5 and no longer works in v6. Instead, you need to specifyrr}r(h8jh9j~ubaubjs)r}r(h8X*.* :omfile:$channelh9j]h:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX*.* :omfile:$channelrr}r(h8Uh9jubaubhU)r}r(h8XVNote that this syntax is available starting with rsyslog v4. It is important to keep on your mind that future versions of rsyslog will require different syntax and/or drop outchannel support completely. So if at all possible, avoid using this feature. If you must use it, be prepared for future changes and watch announcements very carefully.rh9j]h:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXVNote that this syntax is available starting with rsyslog v4. It is important to keep on your mind that future versions of rsyslog will require different syntax and/or drop outchannel support completely. So if at all possible, avoid using this feature. If you must use it, be prepared for future changes and watch announcements very carefully.rr}r(h8jh9jubaubeubh5)r}r(h8Uh9h6h:h;h}r(h@]hA]hB]hC]rh+ahE]rhauhGKhHhh3]r(hJ)r}r(h8Xompipe default templaterh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXompipe default templaterr}r(h8jh9jubaubhU)r}r(h8XStarting with 6.5.0, ompipe does no longer use the omfile default template. Instead, the default template must be set via the module load statement. An example isrh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXStarting with 6.5.0, ompipe does no longer use the omfile default template. Instead, the default template must be set via the module load statement. An example isrr}r(h8jh9jubaubjs)r}r(h8X:module(load="builtin:ompipe" template="myDefaultTemplate")h9jh:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX:module(load="builtin:ompipe" template="myDefaultTemplate")rr}r(h8Uh9jubaubhU)r}r(h8XFor obvious reasons, the default template must be defined somewhere in the config file, otherwise errors will happen during the config load phase.rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXFor obvious reasons, the default template must be defined somewhere in the config file, otherwise errors will happen during the config load phase.rr}r(h8jh9jubaubeubh5)r}r(h8Uh9h6h:h;h}r(h@]hA]hB]hC]rh,ahE]rhauhGKhHhh3]r(hJ)r}r(h8Xomusrmsgrh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXomusrmsgrr}r(h8jh9jubaubhU)r}r(h8XThe omusrmsg module is used to send messages to users. In legacy-legacy config format (that is the very old sysklogd style), it was sufficient to use just the user name to call this action, like in this example:rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXThe omusrmsg module is used to send messages to users. In legacy-legacy config format (that is the very old sysklogd style), it was sufficient to use just the user name to call this action, like in this example:rr}r(h8jh9jubaubjs)r}r(h8X *.* rgerhardsh9jh:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX *.* rgerhardsrr}r(h8Uh9jubaubhU)r}r(h8XThis format is very ambiguous and causes headache (see `blog post on omusrmsg `_ for details). Thus the format has been superseded by this syntax (which is legacy format ;-)):h9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]r(hQX7This format is very ambiguous and causes headache (see rr}r(h8X7This format is very ambiguous and causes headache (see h9jubh)r}r(h8Xc`blog post on omusrmsg `_h>}r(UnameXblog post on omusrmsghXHhttp://blog.gerhards.net/2011/07/why-omusrmsg-is-evil-and-how-it-is.htmlrhC]hB]h@]hA]hE]uh9jh3]rhQXblog post on omusrmsgrr}r(h8Uh9jubahhKh9jh}r(UrefurijhC]rh/ahB]h@]hA]hE]rhauh3]ubhQX_ for details). Thus the format has been superseded by this syntax (which is legacy format ;-)):rr}r(h8X_ for details). Thus the format has been superseded by this syntax (which is legacy format ;-)):h9jubeubjs)r}r(h8X*.* :omusrmsg:rgerhardsh9jh:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX*.* :omusrmsg:rgerhardsrr}r(h8Uh9jubaubhU)r}r(h8X>That syntax is supported since later subversions of version 4.rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQX>That syntax is supported since later subversions of version 4.rr}r(h8jh9jubaubhU)r}r(h8XRsyslog v6 still supports the legacy-legacy format, but in a very strict sense. For example, if multiple users or templates are given, no spaces must be included in the action line. For example, this works up to v5, but no longer in v6:rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXRsyslog v6 still supports the legacy-legacy format, but in a very strict sense. For example, if multiple users or templates are given, no spaces must be included in the action line. For example, this works up to v5, but no longer in v6:rr}r(h8jh9jubaubjs)r}r(h8X*.* rgerhards, bgerhardsh9jh:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX*.* rgerhards, bgerhardsr r }r (h8Uh9jubaubhU)r }r (h8XQTo fix it in a way that is compatible with pre-v4, use (note the removed space!):rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXQTo fix it in a way that is compatible with pre-v4, use (note the removed space!):rr}r(h8jh9j ubaubjs)r}r(h8X*.* rgerhards,bgerhardsh9jh:h;h}r(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]rhQX*.* rgerhards,bgerhardsrr}r(h8Uh9jubaubhU)r}r(h8XCOf course, it probably is better to understand in native v6 format:rh9jh:h;h}r(h@]hA]hB]hC]hE]uhGKhHhh3]rhQXCOf course, it probably is better to understand in native v6 format:r r!}r"(h8jh9jubaubjs)r#}r$(h8X8*.* action(type="omusrmsg" users="rgerhards, bgerhards")h9jh:h;h}r%(jxjyhC]hB]h@]hA]hE]uhGKhHhh3]r&hQX8*.* action(type="omusrmsg" users="rgerhards, bgerhards")r'r(}r)(h8Uh9j#ubaubhU)r*}r+(h8X;As you see, here you may include spaces between user names.r,h9jh:h;h}r-(h@]hA]hB]hC]hE]uhGKhHhh3]r.hQX;As you see, here you may include spaces between user names.r/r0}r1(h8j,h9j*ubaubhU)r2}r3(h8XIn the long term, legacy-legacy format will most probably totally disappear, so it is a wise decision to change config files at least to the legacy format (with ":omusrmsg:" in front of the name).r4h9jh:h;h}r5(h@]hA]hB]hC]hE]uhGKhHhh3]r6hQXIn the long term, legacy-legacy format will most probably totally disappear, so it is a wise decision to change config files at least to the legacy format (with ":omusrmsg:" in front of the name).r7r8}r9(h8j4h9j2ubaubeubh5)r:}r;(h8Uh9h6h:h;h}r<(h@]hA]hB]hC]r=h)ahE]r>hauhGKhHhh3]r?(hJ)r@}rA(h8X(Escape Sequences in Script-Based FiltersrBh9j:h:h;h}rC(h@]hA]hB]hC]hE]uhGKhHhh3]rDhQX(Escape Sequences in Script-Based FiltersrErF}rG(h8jBh9j@ubaubhU)rH}rI(h8X In v5, escape sequences were very simplistic. Inside a string, "\x" meant "x" with x being any character. This has been changed so that the usual set of escapes is supported, must importantly "\n", "\t", "\xhh" (with hh being hex digits) and "\ooo" with (o being octal digits). So if one of these sequences was used previously, results are obviously different. However, that should not create any real problems, because it is hard to envision why someone should have done that (why write "\n" when you can also write "n"?).h9j:h:h;h}rJ(h@]hA]hB]hC]hE]uhGKhHhh3]rKhQXIn v5, escape sequences were very simplistic. Inside a string, "x" meant "x" with x being any character. This has been changed so that the usual set of escapes is supported, must importantly "n", "t", "xhh" (with hh being hex digits) and "ooo" with (o being octal digits). So if one of these sequences was used previously, results are obviously different. However, that should not create any real problems, because it is hard to envision why someone should have done that (why write "n" when you can also write "n"?).rLrM}rN(h8X In v5, escape sequences were very simplistic. Inside a string, "\x" meant "x" with x being any character. This has been changed so that the usual set of escapes is supported, must importantly "\n", "\t", "\xhh" (with hh being hex digits) and "\ooo" with (o being octal digits). So if one of these sequences was used previously, results are obviously different. However, that should not create any real problems, because it is hard to envision why someone should have done that (why write "\n" when you can also write "n"?).h9jHubaubeubh5)rO}rP(h8Uh9h6h:h;h}rQ(h@]hA]hB]hC]rRh#ahE]rShauhGKhHhh3]rT(hJ)rU}rV(h8X CopyrightrWh9jOh:h;h}rX(h@]hA]hB]hC]hE]uhGKhHhh3]rYhQX CopyrightrZr[}r\(h8jWh9jUubaubhU)r]}r^(h8XCopyright (C) 2011-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h9jOh:h;h}r_(h@]hA]hB]hC]hE]uhGKhHhh3]r`(hQXCopyright (C) 2011-2014 by rarb}rc(h8XCopyright (C) 2011-2014 by h9j]ubh)rd}re(h8X3`Rainer Gerhards `_h>}rf(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrghC]hB]h@]hA]hE]uh9j]h3]rhhQXRainer Gerhardsrirj}rk(h8Uh9jdubahhKh9j]h}rn(UrefurijghC]roh%ahB]h@]hA]hE]rph auh3]ubhQX and rqrr}rs(h8X and h9j]ubh)rt}ru(h8X#`Adiscon `_h>}rv(UnameXAdisconhXhttp://www.adiscon.comrwhC]hB]h@]hA]hE]uh9j]h3]rxhQXAdisconryrz}r{(h8Uh9jtubahhKh9j]h}r~(UrefurijwhC]rh'ahB]h@]hA]hE]rh auh3]ubhQX1. Released under the GNU GPL version 2 or higher.rr}r(h8X1. Released under the GNU GPL version 2 or higher.h9j]ubeubeubeubah8UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhHhU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhNNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh;Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(h*hh+jh1j1h.hh%jlh)j:h&hh'j|h-jGh(hgh0jh/jh,jh!hh#jOh2j]h$hh"h6uUsubstitution_namesr}rh}r(h@]hC]hB]Usourceh;hA]hE]uU footnotesr]rUrefidsr}rub.build/.doctrees/compatibility/v8compatibility.doctree0000664000175000017500000011241713035122641022077 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X!specifics for version 8.3 and 8.4qNX mark messagesqNX!specifics for version 8.5 and 8.6qNXcommand line optionsq NXoutput plugin interfaceq NX"compatibility notes for rsyslog v8q NX(unsupported command line options removedq NXuntested modulesq NXwhat developers need to knowqNXimfile changesqNXstring generator interfaceqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU!specifics-for-version-8-3-and-8-4qhU mark-messagesqhU!specifics-for-version-8-5-and-8-6qh Ucommand-line-optionsqh Uoutput-plugin-interfaceqh U"compatibility-notes-for-rsyslog-v8qh U(unsupported-command-line-options-removedq h Uuntested-modulesq!hUwhat-developers-need-to-knowq"hUimfile-changesq#hUstring-generator-interfaceq$uUchildrenq%]q&cdocutils.nodes section q')q(}q)(U rawsourceq*UUparentq+hUsourceq,XD/home/rger/proj/rsyslog-doc/source/compatibility/v8compatibility.rstq-Utagnameq.Usectionq/U attributesq0}q1(Udupnamesq2]Uclassesq3]Ubackrefsq4]Uidsq5]q6haUnamesq7]q8h auUlineq9KUdocumentq:hh%]q;(cdocutils.nodes title q<)q=}q>(h*X"Compatibility Notes for rsyslog v8q?h+h(h,h-h.Utitleq@h0}qA(h2]h3]h4]h5]h7]uh9Kh:hh%]qBcdocutils.nodes Text qCX"Compatibility Notes for rsyslog v8qDqE}qF(h*h?h+h=ubaubcdocutils.nodes paragraph qG)qH}qI(h*XPThis document describes things to keep in mind when moving from v7 to v8. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used v7 and want to use v8 without hassle.qJh+h(h,h-h.U paragraphqKh0}qL(h2]h3]h4]h5]h7]uh9Kh:hh%]qMhCXPThis document describes things to keep in mind when moving from v7 to v8. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents). Its focus is primarily on what you need to know if you used v7 and want to use v8 without hassle.qNqO}qP(h*hJh+hHubaubhG)qQ}qR(h*XTVersion 8 offers a completely rewritten core rsyslog engine. This resulted in a number of changes that are visible to users and (plugin) developers. Most importantly, pre-v8 plugins **do not longer work** and need to be updated to support the new calling interfaces. If you developed a plugin, be sure to review the developer section below.h+h(h,h-h.hKh0}qS(h2]h3]h4]h5]h7]uh9K h:hh%]qT(hCXVersion 8 offers a completely rewritten core rsyslog engine. This resulted in a number of changes that are visible to users and (plugin) developers. Most importantly, pre-v8 plugins qUqV}qW(h*XVersion 8 offers a completely rewritten core rsyslog engine. This resulted in a number of changes that are visible to users and (plugin) developers. Most importantly, pre-v8 plugins h+hQubcdocutils.nodes strong qX)qY}qZ(h*X**do not longer work**h0}q[(h2]h3]h4]h5]h7]uh+hQh%]q\hCXdo not longer workq]q^}q_(h*Uh+hYubah.Ustrongq`ubhCX and need to be updated to support the new calling interfaces. If you developed a plugin, be sure to review the developer section below.qaqb}qc(h*X and need to be updated to support the new calling interfaces. If you developed a plugin, be sure to review the developer section below.h+hQubeubh')qd}qe(h*Uh+h(h,h-h.h/h0}qf(h2]h3]h4]h5]qghah7]qhhauh9Kh:hh%]qi(h<)qj}qk(h*X Mark Messagesqlh+hdh,h-h.h@h0}qm(h2]h3]h4]h5]h7]uh9Kh:hh%]qnhCX Mark Messagesqoqp}qq(h*hlh+hjubaubhG)qr}qs(h*X`In previous versions, mark messages were by default only processed if an action was not executed for some time. The default has now changed, and mark messages are now always processed. Note that this enables faster processing inside rsyslog. To change to previous behaviour, you need to add action.writeAllMarkMessages="off" to the actions in question.qth+hdh,h-h.hKh0}qu(h2]h3]h4]h5]h7]uh9Kh:hh%]qvhCX`In previous versions, mark messages were by default only processed if an action was not executed for some time. The default has now changed, and mark messages are now always processed. Note that this enables faster processing inside rsyslog. To change to previous behaviour, you need to add action.writeAllMarkMessages="off" to the actions in question.qwqx}qy(h*hth+hrubaubeubh')qz}q{(h*Uh+h(h,h-h.h/h0}q|(h2]h3]h4]h5]q}h!ah7]q~h auh9Kh:hh%]q(h<)q}q(h*XUntested Modulesqh+hzh,h-h.h@h0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCXUntested Modulesqq}q(h*hh+hubaubhG)q}q(h*XThe following modules have been updated and successfully build, but no "real" test were conducted. Users of these modules should use extra care.qh+hzh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCXThe following modules have been updated and successfully build, but no "real" test were conducted. Users of these modules should use extra care.qq}q(h*hh+hubaubcdocutils.nodes bullet_list q)q}q(h*Uh+hzh,h-h.U bullet_listqh0}q(UbulletqX-h5]h4]h2]h3]h7]uh9K h:hh%]q(cdocutils.nodes list_item q)q}q(h*X mmsequenceqh+hh,h-h.U list_itemqh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K h%]qhCX mmsequenceqq}q(h*hh+hubaubaubh)q}q(h*Xplugins/omgssapiqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K!h%]qhCXplugins/omgssapiqq}q(h*hh+hubaubaubh)q}q(h*Xomsnmpqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K"h%]qhCXomsnmpqq}q(h*hh+hubaubaubh)q}q(h*Xmmfieldsqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K#h%]qhCXmmfieldsqƅq}q(h*hh+hubaubaubh)q}q(h*X mmpstrucdataqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K$h%]qhCX mmpstrucdataq҅q}q(h*hh+hubaubaubh)q}q(h*Xplugins/mmauditqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K%h%]qhCXplugins/mmauditqޅq}q(h*hh+hubaubaubh)q}q(h*X,ommongodb - larger changes still outstandingqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K&h%]qhCX,ommongodb - larger changes still outstandingqꅁq}q(h*hh+hubaubaubh)q}q(h*Xompgsqlqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}q(h2]h3]h4]h5]h7]uh9K'h%]qhCXompgsqlqq}q(h*hh+hubaubaubh)q}q(h*X*plugins/omrabbitmq - not project supportedqh+hh,h-h.hh0}q(h2]h3]h4]h5]h7]uh9Nh:hh%]qhG)q}q(h*hh+hh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9K(h%]rhCX*plugins/omrabbitmq - not project supportedrr}r(h*hh+hubaubaubh)r}r(h*X&plugins/omzmq3 - not project supportedrh+hh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]r hG)r }r (h*jh+jh,h-h.hKh0}r (h2]h3]h4]h5]h7]uh9K)h%]r hCX&plugins/omzmq3 - not project supportedrr}r(h*jh+j ubaubaubh)r}r(h*XIplugins/omhdfs (transaction support should be improved, requires sponsor)rh+hh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*jh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9K*h%]rhCXIplugins/omhdfs (transaction support should be improved, requires sponsor)rr}r(h*jh+jubaubaubh)r}r(h*X omuxsock h+hh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]r hG)r!}r"(h*Xomuxsockr#h+jh,h-h.hKh0}r$(h2]h3]h4]h5]h7]uh9K+h%]r%hCXomuxsockr&r'}r((h*j#h+j!ubaubaubeubhG)r)}r*(h*XnIn addition to bug reports, success reports are also appreciated for these modules (this may save us testing).r+h+hzh,h-h.hKh0}r,(h2]h3]h4]h5]h7]uh9K-h:hh%]r-hCXnIn addition to bug reports, success reports are also appreciated for these modules (this may save us testing).r.r/}r0(h*j+h+j)ubaubeubh')r1}r2(h*Uh+h(h,h-h.h/h0}r3(h2]h3]h4]h5]r4h"ah7]r5hauh9K1h:hh%]r6(h<)r7}r8(h*XWhat Developers need to Knowr9h+j1h,h-h.h@h0}r:(h2]h3]h4]h5]h7]uh9K1h:hh%]r;hCXWhat Developers need to Knowr<r=}r>(h*j9h+j7ubaubh')r?}r@(h*Uh+j1h,h-h.h/h0}rA(h2]h3]h4]h5]rBhah7]rCh auh9K4h:hh%]rD(h<)rE}rF(h*Xoutput plugin interfacerGh+j?h,h-h.h@h0}rH(h2]h3]h4]h5]h7]uh9K4h:hh%]rIhCXoutput plugin interfacerJrK}rL(h*jGh+jEubaubhG)rM}rN(h*XTo support the new core engine, the output interface has been considerably changed. It is suggested to review some of the project-provided plugins for full details. In this doc, we describe the most important changes from a high level perspective.rOh+j?h,h-h.hKh0}rP(h2]h3]h4]h5]h7]uh9K6h:hh%]rQhCXTo support the new core engine, the output interface has been considerably changed. It is suggested to review some of the project-provided plugins for full details. In this doc, we describe the most important changes from a high level perspective.rRrS}rT(h*jOh+jMubaubhG)rU}rV(h*X#**Multi-thread awareness required**rWh+j?h,h-h.hKh0}rX(h2]h3]h4]h5]h7]uh9K;h:hh%]rYhX)rZ}r[(h*jWh0}r\(h2]h3]h4]h5]h7]uh+jUh%]r]hCXMulti-thread awareness requiredr^r_}r`(h*Uh+jZubah.h`ubaubhG)ra}rb(h*XThe new engine activates one **worker**\ instance of output actions on each worker thread. This means an action has now three types of data:h+j?h,h-h.hKh0}rc(h2]h3]h4]h5]h7]uh9K=h:hh%]rd(hCXThe new engine activates one rerf}rg(h*XThe new engine activates one h+jaubhX)rh}ri(h*X **worker**h0}rj(h2]h3]h4]h5]h7]uh+jah%]rkhCXworkerrlrm}rn(h*Uh+jhubah.h`ubhCXcinstance of output actions on each worker thread. This means an action has now three types of data:rorp}rq(h*Xe\ instance of output actions on each worker thread. This means an action has now three types of data:h+jaubeubh)rr}rs(h*Uh+j?h,h-h.hh0}rt(hX-h5]h4]h2]h3]h7]uh9K@h:hh%]ru(h)rv}rw(h*Xglobalrxh+jrh,h-h.hh0}ry(h2]h3]h4]h5]h7]uh9Nh:hh%]rzhG)r{}r|(h*jxh+jvh,h-h.hKh0}r}(h2]h3]h4]h5]h7]uh9K@h%]r~hCXglobalrr}r(h*jxh+j{ubaubaubh)r}r(h*XOaction-instance - previously known pData, one for each action inside the configh+jrh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*XOaction-instance - previously known pData, one for each action inside the configrh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KAh%]rhCXOaction-instance - previously known pData, one for each action inside the configrr}r(h*jh+jubaubaubh)r}r(h*Xxworker-action-instance - one for each worker thread (called pWrkrData), note that this is specific to exactly one pData h+jrh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*Xwworker-action-instance - one for each worker thread (called pWrkrData), note that this is specific to exactly one pDatarh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KCh%]rhCXwworker-action-instance - one for each worker thread (called pWrkrData), note that this is specific to exactly one pDatarr}r(h*jh+jubaubaubeubhG)r}r(h*XThe plugin **must** now by multi-threading aware. It may be called by multiple threads concurrently, but it is guaranteed that each call is for a unique pWrkrData structure. This still permits to write plugins easily, but enables the engine to work with much higher performance. Note that plugin developers should assume it is the norm that multiple concurrent worker action instances are active a the some time.h+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KFh:hh%]r(hCX The plugin rr}r(h*X The plugin h+jubhX)r}r(h*X**must**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXmustrr}r(h*Uh+jubah.h`ubhCX now by multi-threading aware. It may be called by multiple threads concurrently, but it is guaranteed that each call is for a unique pWrkrData structure. This still permits to write plugins easily, but enables the engine to work with much higher performance. Note that plugin developers should assume it is the norm that multiple concurrent worker action instances are active a the some time.rr}r(h*X now by multi-threading aware. It may be called by multiple threads concurrently, but it is guaranteed that each call is for a unique pWrkrData structure. This still permits to write plugins easily, but enables the engine to work with much higher performance. Note that plugin developers should assume it is the norm that multiple concurrent worker action instances are active a the some time.h+jubeubhG)r}r(h*X**New required entry points**rh+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KMh:hh%]rhX)r}r(h*jh0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXNew required entry pointsrr}r(h*Uh+jubah.h`ubaubhG)r}r(h*XIn order to support the new threading model, new entry points are required. Most importantly, only the plugin knows which data must be present in pData and pWrkrData, so it must created and destroy these data structures on request of the engine. Note that pWrkrData may be destroyed at any time and new ones re-created later. Depending on workload structure and configuration, this can happen frequently.rh+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KOh:hh%]rhCXIn order to support the new threading model, new entry points are required. Most importantly, only the plugin knows which data must be present in pData and pWrkrData, so it must created and destroy these data structures on request of the engine. Note that pWrkrData may be destroyed at any time and new ones re-created later. Depending on workload structure and configuration, this can happen frequently.rr}r(h*jh+jubaubhG)r}r(h*XNew entry points are:rh+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KVh:hh%]rhCXNew entry points are:rr}r(h*jh+jubaubh)r}r(h*Uh+j?h,h-h.hh0}r(hX-h5]h4]h2]h3]h7]uh9KXh:hh%]r(h)r}r(h*XcreateWrkrInstancerh+jh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*jh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KXh%]rhCXcreateWrkrInstancerr}r(h*jh+jubaubaubh)r}r(h*XfreeWrkrInstance h+jh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*XfreeWrkrInstancerh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9KYh%]rhCXfreeWrkrInstancerr}r(h*jh+jubaubaubeubhG)r}r(h*XThe calling interface for these entry points has changed. Basically, they now receive a pWrkrData object instead pData. It is assumed that createWrkrInstance populates pWrkrData->pData appropriately.rh+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9K[h:hh%]rhCXThe calling interface for these entry points has changed. Basically, they now receive a pWrkrData object instead pData. It is assumed that createWrkrInstance populates pWrkrData->pData appropriately.rr}r(h*jh+jubaubh)r}r(h*Uh+j?h,h-h.hh0}r(hX-h5]h4]h2]h3]h7]uh9K_h:hh%]r(h)r}r(h*XbeginTransactionrh+jh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*jh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9K_h%]rhCXbeginTransactionrr}r(h*jh+jubaubaubh)r}r(h*XdoActionrh+jh,h-h.hh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rhG)r}r(h*jh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9K`h%]rhCXdoActionrr}r(h*jh+jubaubaubh)r}r(h*XendTransaction h+jh,h-h.hh0}r (h2]h3]h4]h5]h7]uh9Nh:hh%]r hG)r }r (h*XendTransactionr h+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kah%]rhCXendTransactionrr}r(h*j h+j ubaubaubeubhG)r}r(h*X**Changed entry points**rh+j?h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kch:hh%]rhX)r}r(h*jh0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXChanged entry pointsrr}r(h*Uh+jubah.h`ubaubhG)r}r (h*X4Some of the existing entry points have been changed.r!h+j?h,h-h.hKh0}r"(h2]h3]h4]h5]h7]uh9Keh:hh%]r#hCX4Some of the existing entry points have been changed.r$r%}r&(h*j!h+jubaubhG)r'}r((h*XvThe **doAction** entry point formerly got a variable ``iMsgOpts`` which is no longer provided. This variable was introduced in early days and exposed some internal message state information to the output module. Review of all known existing plugins showed that none except omfile ever used that variable. And omfile only did so to do some no longer required legacy handling.h+j?h,h-h.hKh0}r)(h2]h3]h4]h5]h7]uh9Kgh:hh%]r*(hCXThe r+r,}r-(h*XThe h+j'ubhX)r.}r/(h*X **doAction**h0}r0(h2]h3]h4]h5]h7]uh+j'h%]r1hCXdoActionr2r3}r4(h*Uh+j.ubah.h`ubhCX% entry point formerly got a variable r5r6}r7(h*X% entry point formerly got a variable h+j'ubcdocutils.nodes literal r8)r9}r:(h*X ``iMsgOpts``h0}r;(h2]h3]h4]h5]h7]uh+j'h%]r<hCXiMsgOptsr=r>}r?(h*Uh+j9ubah.Uliteralr@ubhCX5 which is no longer provided. This variable was introduced in early days and exposed some internal message state information to the output module. Review of all known existing plugins showed that none except omfile ever used that variable. And omfile only did so to do some no longer required legacy handling.rArB}rC(h*X5 which is no longer provided. This variable was introduced in early days and exposed some internal message state information to the output module. Review of all known existing plugins showed that none except omfile ever used that variable. And omfile only did so to do some no longer required legacy handling.h+j'ubeubhG)rD}rE(h*XIn essence, it is highly unlikely that you ever accessed this variable. So we expect that nobody actually notices that the variable has gone away.rFh+j?h,h-h.hKh0}rG(h2]h3]h4]h5]h7]uh9Knh:hh%]rHhCXIn essence, it is highly unlikely that you ever accessed this variable. So we expect that nobody actually notices that the variable has gone away.rIrJ}rK(h*jFh+jDubaubhG)rL}rM(h*XRemoval of the variable provides a slight performance gain, as we do no longer need to maintain it inside the output system (which leads to less CPU instructions and better cache hits).rNh+j?h,h-h.hKh0}rO(h2]h3]h4]h5]h7]uh9Krh:hh%]rPhCXRemoval of the variable provides a slight performance gain, as we do no longer need to maintain it inside the output system (which leads to less CPU instructions and better cache hits).rQrR}rS(h*jNh+jLubaubhG)rT}rU(h*XN**RS\_RET\_SUSPENDED is no longer supported when creating an action instance**h+j?h,h-h.hKh0}rV(h2]h3]h4]h5]h7]uh9Kvh:hh%]rWhX)rX}rY(h*XN**RS\_RET\_SUSPENDED is no longer supported when creating an action instance**h0}rZ(h2]h3]h4]h5]h7]uh+jTh%]r[hCXHRS_RET_SUSPENDED is no longer supported when creating an action instancer\r]}r^(h*Uh+jXubah.h`ubaubhG)r_}r`(h*X=This means a plugin must not try to establish any connections or the like before any of its processing entry points (like beginTransaction or doAction) is called. This was generally also the case von v7, but was not enforced in all cases. In v8, creating action creation fails if anything but RS\_RET\_OK is returned.h+j?h,h-h.hKh0}ra(h2]h3]h4]h5]h7]uh9Kyh:hh%]rbhCX;This means a plugin must not try to establish any connections or the like before any of its processing entry points (like beginTransaction or doAction) is called. This was generally also the case von v7, but was not enforced in all cases. In v8, creating action creation fails if anything but RS_RET_OK is returned.rcrd}re(h*X=This means a plugin must not try to establish any connections or the like before any of its processing entry points (like beginTransaction or doAction) is called. This was generally also the case von v7, but was not enforced in all cases. In v8, creating action creation fails if anything but RS\_RET\_OK is returned.h+j_ubaubeubh')rf}rg(h*Uh+j1h,h-h.h/h0}rh(h2]h3]h4]h5]rih$ah7]rjhauh9Kh:hh%]rk(h<)rl}rm(h*Xstring generator interfacernh+jfh,h-h.h@h0}ro(h2]h3]h4]h5]h7]uh9Kh:hh%]rphCXstring generator interfacerqrr}rs(h*jnh+jlubaubhG)rt}ru(h*X@Bottom line: string generators need to be changed or will abort.rvh+jfh,h-h.hKh0}rw(h2]h3]h4]h5]h7]uh9Kh:hh%]rxhCX@Bottom line: string generators need to be changed or will abort.ryrz}r{(h*jvh+jtubaubhG)r|}r}(h*X+The BEGINstrgen() entry point has greatly changed. Instead of two parameters for the output buffers, they now receive a single ``iparam`` pointer, which contains all data items needed. Also, the message pointer is now const to "prevent" (accidential) changes to the message via the strgen interface.h+jfh,h-h.hKh0}r~(h2]h3]h4]h5]h7]uh9Kh:hh%]r(hCXThe BEGINstrgen() entry point has greatly changed. Instead of two parameters for the output buffers, they now receive a single rr}r(h*XThe BEGINstrgen() entry point has greatly changed. Instead of two parameters for the output buffers, they now receive a single h+j|ubj8)r}r(h*X ``iparam``h0}r(h2]h3]h4]h5]h7]uh+j|h%]rhCXiparamrr}r(h*Uh+jubah.j@ubhCX pointer, which contains all data items needed. Also, the message pointer is now const to "prevent" (accidential) changes to the message via the strgen interface.rr}r(h*X pointer, which contains all data items needed. Also, the message pointer is now const to "prevent" (accidential) changes to the message via the strgen interface.h+j|ubeubhG)r}r(h*XaNote that strgen modules must now maintain the iparam->lenStr field, which must hold the length of the generated string on exit. This is necessary as we cache the string sizes in order to reduced strlen() calls. Also, the numerical parameters are now unsigned and no longer size\_t. This permits us to store them directly into optimized heap structures.h+jfh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX`Note that strgen modules must now maintain the iparam->lenStr field, which must hold the length of the generated string on exit. This is necessary as we cache the string sizes in order to reduced strlen() calls. Also, the numerical parameters are now unsigned and no longer size_t. This permits us to store them directly into optimized heap structures.rr}r(h*XaNote that strgen modules must now maintain the iparam->lenStr field, which must hold the length of the generated string on exit. This is necessary as we cache the string sizes in order to reduced strlen() calls. Also, the numerical parameters are now unsigned and no longer size\_t. This permits us to store them directly into optimized heap structures.h+jubaubeubeubh')r}r(h*Uh+h(h,h-h.h/h0}r(h2]h3]h4]h5]rhah7]rhauh9Kh:hh%]r(h<)r}r(h*X!Specifics for Version 8.3 and 8.4rh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX!Specifics for Version 8.3 and 8.4rr}r(h*jh+jubaubh')r}r(h*Uh+jh,h-h.h/h0}r(h2]h3]h4]h5]rh ah7]rh auh9Kh:hh%]r(h<)r}r(h*X(Unsupported Command Line Options Removedrh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX(Unsupported Command Line Options Removedrr}r(h*jh+jubaubhG)r}r(h*X"The command line options a, h, m, o, p, g, r, t and c were not supported since many versions. However, they spit out an error message that they were unsupported. This error message now no longer appears, instead the regular usage() display happens. This should not have any effect to users.rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX"The command line options a, h, m, o, p, g, r, t and c were not supported since many versions. However, they spit out an error message that they were unsupported. This error message now no longer appears, instead the regular usage() display happens. This should not have any effect to users.rr}r(h*jh+jubaubeubeubh')r}r(h*Uh+h(h,h-h.h/h0}r(h2]h3]h4]h5]rhah7]rhauh9Kh:hh%]r(h<)r}r(h*X!Specifics for Version 8.5 and 8.6rh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX!Specifics for Version 8.5 and 8.6rr}r(h*jh+jubaubh')r}r(h*Uh+jh,h-h.h/h0}r(h2]h3]h4]h5]rh#ah7]rhauh9Kh:hh%]r(h<)r}r(h*Ximfile changesrh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXimfile changesrr}r(h*jh+jubaubhG)r}r(h*XVStarting with 8.5.0, imfile supports wildcards in file names, but does do so only in inotify mode. In order to support wildcards, the handling of statefile needed to be changed. Most importantly, the *statefile* input parameter has been deprecated. See :doc:`imfile module documentation <../../configuration/modules/imfile>` for more details.h+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(hCXStarting with 8.5.0, imfile supports wildcards in file names, but does do so only in inotify mode. In order to support wildcards, the handling of statefile needed to be changed. Most importantly, the rr}r(h*XStarting with 8.5.0, imfile supports wildcards in file names, but does do so only in inotify mode. In order to support wildcards, the handling of statefile needed to be changed. Most importantly, the h+jubcdocutils.nodes emphasis r)r}r(h*X *statefile*h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCX statefilerr}r(h*Uh+jubah.UemphasisrubhCX* input parameter has been deprecated. See rr}r(h*X* input parameter has been deprecated. See h+jubcsphinx.addnodes pending_xref r)r}r(h*XG:doc:`imfile module documentation <../../configuration/modules/imfile>`rh+jh,h-h.U pending_xrefrh0}r(UreftypeXdocrUrefwarnrU reftargetrX"../../configuration/modules/imfileU refdomainUh5]h4]U refexplicith2]h3]h7]UrefdocrXcompatibility/v8compatibilityruh9Kh%]rj8)r}r(h*jh0}r(h2]h3]r(Uxrefrjeh4]h5]h7]uh+jh%]rhCXimfile module documentationrr}r(h*Uh+jubah.j@ubaubhCX for more details.rr}r(h*X for more details.h+jubeubeubh')r}r(h*Uh+jh,h-h.h/h0}r(h2]h3]h4]h5]rhah7]rh auh9Kh:hh%]r(h<)r}r(h*XCommand Line Optionsrh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r hCXCommand Line Optionsr r }r (h*jh+jubaubhG)r }r(h*XThere is a small set of configuration command line options available dating back to the dark ages of syslog technology. Setting command-line options is distro specific and a hassle for most users. As such, we are phasing out these options, and will do so rather quickly.rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXThere is a small set of configuration command line options available dating back to the dark ages of syslog technology. Setting command-line options is distro specific and a hassle for most users. As such, we are phasing out these options, and will do so rather quickly.rr}r(h*jh+j ubaubhG)r}r(h*XSome of them (most notably -l, -s) will completely be removed, as feedback so far indicated they are no longer in use. Others will be replaced by proper configuration objects.rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXSome of them (most notably -l, -s) will completely be removed, as feedback so far indicated they are no longer in use. Others will be replaced by proper configuration objects.rr}r(h*jh+jubaubhG)r}r(h*X`**Expect future rsyslog versions to no longer accept those configuration command line options.**rh+jh,h-h.hKh0}r (h2]h3]h4]h5]h7]uh9Kh:hh%]r!hX)r"}r#(h*jh0}r$(h2]h3]h4]h5]h7]uh+jh%]r%hCX\Expect future rsyslog versions to no longer accept those configuration command line options.r&r'}r((h*Uh+j"ubah.h`ubaubhG)r)}r*(h*XRPlease see this table to see what to use as a replacement for the current options:r+h+jh,h-h.hKh0}r,(h2]h3]h4]h5]h7]uh9Kh:hh%]r-hCXRPlease see this table to see what to use as a replacement for the current options:r.r/}r0(h*j+h+j)ubaubcdocutils.nodes table r1)r2}r3(h*Uh+jh,h-h.Utabler4h0}r5(h2]h3]h4]h5]h7]uh9Nh:hh%]r6cdocutils.nodes tgroup r7)r8}r9(h*Uh0}r:(h5]h4]h2]h3]h7]UcolsKuh+j2h%]r;(cdocutils.nodes colspec r<)r=}r>(h*Uh0}r?(h5]h4]h2]h3]h7]UcolwidthK uh+j8h%]h.Ucolspecr@ubj<)rA}rB(h*Uh0}rC(h5]h4]h2]h3]h7]UcolwidthKKuh+j8h%]h.j@ubcdocutils.nodes tbody rD)rE}rF(h*Uh0}rG(h2]h3]h4]h5]h7]uh+j8h%]rH(cdocutils.nodes row rI)rJ}rK(h*Uh0}rL(h2]h3]h4]h5]h7]uh+jEh%]rM(cdocutils.nodes entry rN)rO}rP(h*Uh0}rQ(h2]h3]h4]h5]h7]uh+jJh%]rRhG)rS}rT(h*X **Option**rUh+jOh,h-h.hKh0}rV(h2]h3]h4]h5]h7]uh9Kh%]rWhX)rX}rY(h*jUh0}rZ(h2]h3]h4]h5]h7]uh+jSh%]r[hCXOptionr\r]}r^(h*Uh+jXubah.h`ubaubah.Uentryr_ubjN)r`}ra(h*Uh0}rb(h2]h3]h4]h5]h7]uh+jJh%]rchG)rd}re(h*X**replacement**rfh+j`h,h-h.hKh0}rg(h2]h3]h4]h5]h7]uh9Kh%]rhhX)ri}rj(h*jfh0}rk(h2]h3]h4]h5]h7]uh+jdh%]rlhCX replacementrmrn}ro(h*Uh+jiubah.h`ubaubah.j_ubeh.UrowrpubjI)rq}rr(h*Uh0}rs(h2]h3]h4]h5]h7]uh+jEh%]rt(jN)ru}rv(h*Uh0}rw(h2]h3]h4]h5]h7]uh+jqh%]rxhG)ry}rz(h*X-4r{h+juh,h-h.hKh0}r|(h2]h3]h4]h5]h7]uh9Kh%]r}hCX-4r~r}r(h*j{h+jyubaubah.j_ubjN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jqh%]rhG)r}r(h*X"global(net.ipprotocol="ipv4-only")rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX"global(net.ipprotocol="ipv4-only")rr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X-6rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX-6rr}r(h*jh+jubaubah.j_ubjN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X"global(net.ipprotocol="ipv6-only")rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX"global(net.ipprotocol="ipv6-only")rr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X-Arh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX-Arr}r(h*jh+jubaubah.j_ubjN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X%omfwd input parameter "udp.sendToAll"rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX%omfwd input parameter "udp.sendToAll"rr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X-lrh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX-lrr}r(h*jh+jubaubah.j_ubjN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X!dropped, currently no replacementrh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX!dropped, currently no replacementrr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X-qrh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX-qrr}r(h*jh+jubaubah.j_ubjN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X%global(net.aclAddHostnameOnFail="on")rh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX%global(net.aclAddHostnameOnFail="on")rr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X-Qrh+jh,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]r hCX-Qr r }r (h*jh+jubaubah.j_ubjN)r }r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X$global(net.aclResolveHostname="off")rh+j h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX$global(net.aclResolveHostname="off")rr}r(h*jh+jubaubah.j_ubeh.jpubjI)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jEh%]r(jN)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r hG)r!}r"(h*X-sr#h+jh,h-h.hKh0}r$(h2]h3]h4]h5]h7]uh9Kh%]r%hCX-sr&r'}r((h*j#h+j!ubaubah.j_ubjN)r)}r*(h*Uh0}r+(h2]h3]h4]h5]h7]uh+jh%]r,hG)r-}r.(h*X!dropped, currently no replacementr/h+j)h,h-h.hKh0}r0(h2]h3]h4]h5]h7]uh9Kh%]r1hCX!dropped, currently no replacementr2r3}r4(h*j/h+j-ubaubah.j_ubeh.jpubjI)r5}r6(h*Uh0}r7(h2]h3]h4]h5]h7]uh+jEh%]r8(jN)r9}r:(h*Uh0}r;(h2]h3]h4]h5]h7]uh+j5h%]r<hG)r=}r>(h*X-Sr?h+j9h,h-h.hKh0}r@(h2]h3]h4]h5]h7]uh9Kh%]rAhCX-SrBrC}rD(h*j?h+j=ubaubah.j_ubjN)rE}rF(h*Uh0}rG(h2]h3]h4]h5]h7]uh+j5h%]rHhG)rI}rJ(h*X'omrelp action parameter "localclientip"rKh+jEh,h-h.hKh0}rL(h2]h3]h4]h5]h7]uh9Kh%]rMhCX'omrelp action parameter "localclientip"rNrO}rP(h*jKh+jIubaubah.j_ubeh.jpubjI)rQ}rR(h*Uh0}rS(h2]h3]h4]h5]h7]uh+jEh%]rT(jN)rU}rV(h*Uh0}rW(h2]h3]h4]h5]h7]uh+jQh%]rXhG)rY}rZ(h*X-wr[h+jUh,h-h.hKh0}r\(h2]h3]h4]h5]h7]uh9Kh%]r]hCX-wr^r_}r`(h*j[h+jYubaubah.j_ubjN)ra}rb(h*Uh0}rc(h2]h3]h4]h5]h7]uh+jQh%]rdhG)re}rf(h*X"global(net.permitACLWarning="off")rgh+jah,h-h.hKh0}rh(h2]h3]h4]h5]h7]uh9Kh%]rihCX"global(net.permitACLWarning="off")rjrk}rl(h*jgh+jeubaubah.j_ubeh.jpubjI)rm}rn(h*Uh0}ro(h2]h3]h4]h5]h7]uh+jEh%]rp(jN)rq}rr(h*Uh0}rs(h2]h3]h4]h5]h7]uh+jmh%]rthG)ru}rv(h*X-xrwh+jqh,h-h.hKh0}rx(h2]h3]h4]h5]h7]uh9Kh%]ryhCX-xrzr{}r|(h*jwh+juubaubah.j_ubjN)r}}r~(h*Uh0}r(h2]h3]h4]h5]h7]uh+jmh%]rhG)r}r(h*Xglobal(net.enableDNS="off")rh+j}h,h-h.hKh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXglobal(net.enableDNS="off")rr}r(h*jh+jubaubah.j_ubeh.jpubeh.Utbodyrubeh.Utgrouprubaubeubeubeubah*UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh:hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrj_U language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh@NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh-Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hjh$jfh"j1hj?h jhh(h#jhjh!hzhhdhjuUsubstitution_namesr}rh.h:h0}r(h2]h5]h4]Usourceh-h3]h7]uU footnotesr]rUrefidsr}rub.build/.doctrees/compatibility/v4compatibility.doctree0000664000175000017500000004720613035122640022075 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X"compatibility notes for rsyslog v4qNXrainer gerhardsqXrsyslog v3 compatibility notesqXhup processingq NX outchannelsq NuUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU"compatibility-notes-for-rsyslog-v4qhUrainer-gerhardsqhUrsyslog-v3-compatibility-notesqh Uhup-processingqh U outchannelsquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XD/home/rger/proj/rsyslog-doc/source/compatibility/v4compatibility.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hX"Compatibility Notes for rsyslog v4q3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7X"Compatibility Notes for rsyslog v4q8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hXO*Written by* `Rainer Gerhards `_ *(2009-07-15)*hhh h!h"U paragraphq>h$}q?(h&]h']h(]h)]h+]uh-Kh.hh]q@(cdocutils.nodes emphasis qA)qB}qC(hX *Written by*h$}qD(h&]h']h(]h)]h+]uhh`_h$}qO(UnameXRainer GerhardsUrefuriqPXhttp://www.gerhards.net/rainerqQh)]h(]h&]h']h+]uhhU referencedqZKhh`_).hhh h!h"h>h$}qj(h&]h']h(]h)]h+]uh-Kh.hh]qk(h7XThe changes introduced in rsyslog v4 are numerous, but not very intrusive. This document describes things to keep in mind when moving from v3 to v4. It does not list enhancements nor does it talk about compatibility concerns introduced by v3 (for this, see the qlqm}qn(hXThe changes introduced in rsyslog v4 are numerous, but not very intrusive. This document describes things to keep in mind when moving from v3 to v4. It does not list enhancements nor does it talk about compatibility concerns introduced by v3 (for this, see the hhhubhL)qo}qp(hX8`rsyslog v3 compatibility notes `_h$}qq(UnameXrsyslog v3 compatibility noteshPXv3compatibility.htmlqrh)]h(]h&]h']h+]uhhhh]qsh7Xrsyslog v3 compatibility notesqtqu}qv(hUhhoubah"hVubhW)qw}qx(hX hZKhhhh"h[h$}qy(Urefurihrh)]qzhah(]h&]h']h+]q{hauh]ubh7X).q|q}}q~(hX).hhhubeubh)q}q(hUhhh h!h"h#h$}q(h&]h']h(]h)]qhah+]qh auh-Kh.hh]q(h0)q}q(hXHUP processingqhhh h!h"h4h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7XHUP processingqq}q(hhhhubaubh;)q}q(hXWith v3 and below, rsyslog used the traditional HUP behaviour. That meant that all output files are closed and the configuration file is re-read and the new configuration applied.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7XWith v3 and below, rsyslog used the traditional HUP behaviour. That meant that all output files are closed and the configuration file is re-read and the new configuration applied.qq}q(hhhhubaubh;)q}q(hXWith a program as simple and static as sysklogd, this was not much of an issue. The most important config settings (like udp reception) of a traditional syslogd can not be modified via the configuration file. So a config file reload only meant setting up a new set of filters. It also didn't account as problem that while doing so messages may be lost - without any threading and queuing model, a traditional syslogd will potentially always loose messages, so it is irrelevant if this happens, too, during the short config re-read phase.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7XWith a program as simple and static as sysklogd, this was not much of an issue. The most important config settings (like udp reception) of a traditional syslogd can not be modified via the configuration file. So a config file reload only meant setting up a new set of filters. It also didn't account as problem that while doing so messages may be lost - without any threading and queuing model, a traditional syslogd will potentially always loose messages, so it is irrelevant if this happens, too, during the short config re-read phase.qq}q(hhhhubaubh;)q}q(hXIn rsyslog, things are quite different: the program is more or less a framework into which loadable modules are loaded as needed for a particular configuration. The software that will actually be running is tailored via the config file. Thus, a re-read of the config file requires a full, very heavy restart, because the software actually running with the new config can be totally different from what ran with the old config.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7XIn rsyslog, things are quite different: the program is more or less a framework into which loadable modules are loaded as needed for a particular configuration. The software that will actually be running is tailored via the config file. Thus, a re-read of the config file requires a full, very heavy restart, because the software actually running with the new config can be totally different from what ran with the old config.qq}q(hhhhubaubh;)q}q(hXConsequently, the traditional HUP is a very heavy operation and may even cause some data loss because queues must be shut down, listeners stopped and so on. Some of these operations (depending on their configuration) involve intentional message loss. The operation also takes up a lot of system resources and needs quite some time (maybe seconds) to be completed. During this restart period, the syslog subsystem is not fully available.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K%h.hh]qh7XConsequently, the traditional HUP is a very heavy operation and may even cause some data loss because queues must be shut down, listeners stopped and so on. Some of these operations (depending on their configuration) involve intentional message loss. The operation also takes up a lot of system resources and needs quite some time (maybe seconds) to be completed. During this restart period, the syslog subsystem is not fully available.qq}q(hhhhubaubh;)q}q(hXFrom the software developer's point of view, the full restart done by a HUP is rather complex, especially if user-timeout limits set on action completion are taken into consideration (for those in the know: at the extreme ends this means we need to cancel threads as a last resort, but than we need to make sure that such cancellation does not happen at points where it would be fatal for a restart). A regular restart, where the process is actually terminated, is much less complex, because the operating system does a full cleanup after process termination, so rsyslogd does not need to take care for exotic cleanup cases and leave that to the OS. In the end result, restart-type HUPs clutter the code, increase complexity (read: add bugs) and cost performance.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K-h.hh]qh7XFrom the software developer's point of view, the full restart done by a HUP is rather complex, especially if user-timeout limits set on action completion are taken into consideration (for those in the know: at the extreme ends this means we need to cancel threads as a last resort, but than we need to make sure that such cancellation does not happen at points where it would be fatal for a restart). A regular restart, where the process is actually terminated, is much less complex, because the operating system does a full cleanup after process termination, so rsyslogd does not need to take care for exotic cleanup cases and leave that to the OS. In the end result, restart-type HUPs clutter the code, increase complexity (read: add bugs) and cost performance.qq}q(hhhhubaubh;)q}q(hXOn the contrary, a HUP is typically needed for log rotation, and the real desire is to close files. This is a non-disruptive and very lightweight operation.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K9h.hh]qh7XOn the contrary, a HUP is typically needed for log rotation, and the real desire is to close files. This is a non-disruptive and very lightweight operation.qq}q(hhhhubaubh;)q}q(hXMany people have said that they are used to HUP the syslogd to apply configuration changes. This is true, but it is questionable if that really justifies all the cost that comes with it. After all, it is the difference between typingqhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K=h.hh]qh7XMany people have said that they are used to HUP the syslogd to apply configuration changes. This is true, but it is questionable if that really justifies all the cost that comes with it. After all, it is the difference between typingq…q}q(hhhhubaubcdocutils.nodes literal_block q)q}q(hX'$ kill -HUP `cat /var/run/rsyslogd.pid`hhh h!h"U literal_blockqh$}q(U xml:spaceqUpreserveqh)]h(]h&]h']h+]uh-KDh.hh]qh7X'$ kill -HUP `cat /var/run/rsyslogd.pid`qͅq}q(hUhhubaubh;)q}q(hXversusqhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-KFh.hh]qh7XversusqՅq}q(hhhhubaubh)q}q(hX$ /etc/init.d/rsyslog restarthhh h!h"hh$}q(hhh)]h(]h&]h']h+]uh-KJh.hh]qh7X$ /etc/init.d/rsyslog restartq܅q}q(hUhhubaubh;)q}q(hXSemantically, both is mostly the same thing. The only difference is that with the restart command rsyslogd can spit config error message to stderr, so that the user is able to see any problems and fix them. With a HUP, we do not have access to stderr and thus can log error messages only to their configured destinations; experience tells that most users will never find them there. What, by the way, is another strong argument against restarting rsyslogd by HUPing it.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-KLh.hh]qh7XSemantically, both is mostly the same thing. The only difference is that with the restart command rsyslogd can spit config error message to stderr, so that the user is able to see any problems and fix them. With a HUP, we do not have access to stderr and thus can log error messages only to their configured destinations; experience tells that most users will never find them there. What, by the way, is another strong argument against restarting rsyslogd by HUPing it.q䅁q}q(hhhhubaubh;)q}q(hXSo a restart via HUP is not strictly necessary and most other daemons require that a restart command is typed in if a restart is required.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-KTh.hh]qh7XSo a restart via HUP is not strictly necessary and most other daemons require that a restart command is typed in if a restart is required.q셁q}q(hhhhubaubh;)q}q(hXRsyslog will follow this paradigm in the next versions, resulting in many benefits. In v4, we provide some support for the old-style semantics. We introduced a setting $HUPisRestart which may be set to "on" (traditional, heavy operation) or "off" (new, lightweight "file close only" operation). The initial versions had the default set to traditional behavior, but starting with 4.5.1 we are now using the new behavior as the default.qhhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-KWh.hh]qh7XRsyslog will follow this paradigm in the next versions, resulting in many benefits. In v4, we provide some support for the old-style semantics. We introduced a setting $HUPisRestart which may be set to "on" (traditional, heavy operation) or "off" (new, lightweight "file close only" operation). The initial versions had the default set to traditional behavior, but starting with 4.5.1 we are now using the new behavior as the default.qq}q(hhhhubaubh;)q}q(hXMost importantly, **this may break some scripts**, but my sincere belief is that there are very few scripts that automatically **change** rsyslog's config and then do a HUP to reload it. Anyhow, if you have some of these, it may be a good idea to change them now instead of turning restart-type HUPs on. Other than that, one mainly needs to change the habit of how to restart rsyslog after a configuration change.hhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K_h.hh]q(h7XMost importantly, qq}q(hXMost importantly, hhubcdocutils.nodes strong q)q}r(hX**this may break some scripts**h$}r(h&]h']h(]h)]h+]uhhh]rh7Xthis may break some scriptsrr}r(hUhhubah"Ustrongrubh7XN, but my sincere belief is that there are very few scripts that automatically rr}r (hXN, but my sincere belief is that there are very few scripts that automatically hhubh)r }r (hX **change**h$}r (h&]h']h(]h)]h+]uhhh]r h7Xchangerr}r(hUhj ubah"jubh7X rsyslog's config and then do a HUP to reload it. Anyhow, if you have some of these, it may be a good idea to change them now instead of turning restart-type HUPs on. Other than that, one mainly needs to change the habit of how to restart rsyslog after a configuration change.rr}r(hX rsyslog's config and then do a HUP to reload it. Anyhow, if you have some of these, it may be a good idea to change them now instead of turning restart-type HUPs on. Other than that, one mainly needs to change the habit of how to restart rsyslog after a configuration change.hhubeubh;)r}r(hX**Please note that restart-type HUP is deprecated and will go away in rsyslog v5.** So it is a good idea to become ready for the new version now and also enjoy some of the benefits of the "real restart", like the better error-reporting capability.hhh h!h"h>h$}r(h&]h']h(]h)]h+]uh-Kfh.hh]r(h)r}r(hXS**Please note that restart-type HUP is deprecated and will go away in rsyslog v5.**h$}r(h&]h']h(]h)]h+]uhjh]rh7XOPlease note that restart-type HUP is deprecated and will go away in rsyslog v5.rr}r(hUhjubah"jubh7X So it is a good idea to become ready for the new version now and also enjoy some of the benefits of the "real restart", like the better error-reporting capability.rr }r!(hX So it is a good idea to become ready for the new version now and also enjoy some of the benefits of the "real restart", like the better error-reporting capability.hjubeubh;)r"}r#(hXNote that code complexity reduction (and thus performance improvement) needs the restart-type HUP code to be removed, so these changes can (and will) only happen in version 5.r$hhh h!h"h>h$}r%(h&]h']h(]h)]h+]uh-Kkh.hh]r&h7XNote that code complexity reduction (and thus performance improvement) needs the restart-type HUP code to be removed, so these changes can (and will) only happen in version 5.r'r(}r)(hj$hj"ubaubeubh)r*}r+(hUhhh h!h"h#h$}r,(h&]h']h(]h)]r-hah+]r.h auh-Kph.hh]r/(h0)r0}r1(hX outchannelsr2hj*h h!h"h4h$}r3(h&]h']h(]h)]h+]uh-Kph.hh]r4h7X outchannelsr5r6}r7(hj2hj0ubaubh;)r8}r9(hX Note: as always documented, outchannels are an experimental feature that may be removed and/or changed in the future. There is one concrete change done starting with 4.6.7: let's assume an outchannel "mychannel" was defined. Then, this channel could be used inside anr:hj*h h!h"h>h$}r;(h&]h']h(]h)]h+]uh-Krh.hh]r<h7X Note: as always documented, outchannels are an experimental feature that may be removed and/or changed in the future. There is one concrete change done starting with 4.6.7: let's assume an outchannel "mychannel" was defined. Then, this channel could be used inside anr=r>}r?(hj:hj8ubaubh;)r@}rA(hX\*.\* $mychannelrBhj*h h!h"h>h$}rC(h&]h']h(]h)]h+]uh-Kwh.hh]rDh7X*.* $mychannelrErF}rG(hX\*.\* $mychannelhj@ubaubh;)rH}rI(hXThis is still supported and will remain to be supported in v4. However, there is a new variant which explicitly tells this is to be handled by omfile. This new syntax is as follows:rJhj*h h!h"h>h$}rK(h&]h']h(]h)]h+]uh-Kyh.hh]rLh7XThis is still supported and will remain to be supported in v4. However, there is a new variant which explicitly tells this is to be handled by omfile. This new syntax is as follows:rMrN}rO(hjJhjHubaubh;)rP}rQ(hX\*.\* :omfile:$mychannelrRhj*h h!h"h>h$}rS(h&]h']h(]h)]h+]uh-K}h.hh]rTh7X*.* :omfile:$mychannelrUrV}rW(hX\*.\* :omfile:$mychannelhjPubaubh;)rX}rY(hXNNote that future versions, specifically starting with v6, the older syntax is no longer supported. So users are strongly advised to switch to the new syntax. As an aid to the conversion process, rsyslog 4.7.4 and above issue a warning message if the old-style directive is seen -- but still accept the old syntax without any problems.rZhj*h h!h"h>h$}r[(h&]h']h(]h)]h+]uh-Kh.hh]r\h7XNNote that future versions, specifically starting with v6, the older syntax is no longer supported. So users are strongly advised to switch to the new syntax. As an aid to the conversion process, rsyslog 4.7.4 and above issue a warning message if the old-style directive is seen -- but still accept the old syntax without any problems.r]r^}r_(hjZhjXubaubeubeubahUU transformerr`NU footnote_refsra}rbUrefnamesrc}rdUsymbol_footnotesre]rfUautofootnote_refsrg]rhUsymbol_footnote_refsri]rjU citationsrk]rlh.hU current_linermNUtransform_messagesrn]roUreporterrpNUid_startrqKU autofootnotesrr]rsU citation_refsrt}ruUindirect_targetsrv]rwUsettingsrx(cdocutils.frontend Values ryorz}r{(Ufootnote_backlinksr|KUrecord_dependenciesr}NU rfc_base_urlr~Uhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh!Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hj*hhwhhhhhhXuUsubstitution_namesr}rh"h.h$}r(h&]h)]h(]Usourceh!h']h+]uU footnotesr]rUrefidsr}rub.build/.doctrees/compatibility/v3compatibility.doctree0000664000175000017500000011147013035122640022067 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XinputsqNXforwarding formatqNX/forum thread on "last message repeated n times"qX&default port for udp (and tcp) serversq NX"compatibility notes for rsyslog v3q NX-c option / compatibility modeq NXcommand line optionsq NXrainer gerhardsq X&queue modes for the main message queueqNXklogdqNX -e optionqNXoutput file syncingqNX -m optionqNX -r optionqNXoutput file formatqNuUsubstitution_defsq}qUparse_messagesq]q(cdocutils.nodes system_message q)q}q(U rawsourceqUUparentqcdocutils.nodes section q)q}q (hUhh)q!}q"(hUhhUsourceq#XD/home/rger/proj/rsyslog-doc/source/compatibility/v3compatibility.rstq$Utagnameq%Usectionq&U attributesq'}q((Udupnamesq)]Uclassesq*]Ubackrefsq+]Uidsq,]q-U"compatibility-notes-for-rsyslog-v3q.aUnamesq/]q0h auUlineq1KUdocumentq2hUchildrenq3]q4(cdocutils.nodes title q5)q6}q7(hX"Compatibility Notes for rsyslog v3q8hh!h#h$h%Utitleq9h'}q:(h)]h*]h+]h,]h/]uh1Kh2hh3]q;cdocutils.nodes Text q}q?(hh8hh6ubaubcdocutils.nodes paragraph q@)qA}qB(hXO*Written by* `Rainer Gerhards `_ *(2008-03-28)*hh!h#h$h%U paragraphqCh'}qD(h)]h*]h+]h,]h/]uh1Kh2hh3]qE(cdocutils.nodes emphasis qF)qG}qH(hX *Written by*h'}qI(h)]h*]h+]h,]h/]uhhAh3]qJh`_h'}qT(UnameXRainer GerhardsUrefuriqUXhttp://www.gerhards.net/rainerqVh,]h+]h)]h*]h/]uhhAh3]qWhU referencedq_KhhAh%Utargetq`h'}qa(UrefurihVh,]qbUrainer-gerhardsqcah+]h)]h*]h/]qdh auh3]ubh where vers is the rsyslog version that it shall be compatible to. Use -c0 to be command-line compatible to sysklogd.qhhh#h$h%hCh'}q(h)]h*]h+]h,]h/]uh1K where vers is the rsyslog version that it shall be compatible to. Use -c0 to be command-line compatible to sysklogd.qޅq}q(hhhhubaubh@)q}q(hXPlease note that rsyslogd issues warning messages if the -c3 command line option is not given. This is to alert you that your are running in compatibility mode. Compatibility mode interferes with your rsyslog.conf commands and may cause some undesired side-effects. It is meant to be used with a plain old rsyslog.conf - if you use new features, things become messy. So the best advise is to work through this document, convert your options and config file and then use rsyslog in native mode. In order to aid you in this process, rsyslog logs every compatibility-mode config file directive it has generated. So you can simply copy them from your logfile and paste them to the config.qhhh#h$h%hCh'}q(h)]h*]h+]h,]h/]uh1KDh2hh3]qh`_. This thread also contains information on how to configure rsyslogd so that it continues to support this feature (as long as it is not totally removed).hhh#h$h%hCh'}q(h)]h*]h+]h,]h/]uh1KRh2hh3]q(h`_h'}r(UnameX/forum thread on "last message repeated n times"hUX6http://www.rsyslog.com/PNphpBB2-viewtopic-p-1130.phtmlrh,]h+]h)]h*]h/]uhhh3]rhh_Khhh%h`h'}r (Urefurijh,]r U-forum-thread-on-last-message-repeated-n-timesr ah+]h)]h*]h/]r hauh3]ubh(hXIs no longer available in native mode. However, it is understood in compatibility mode (if no -c option is given). Use the ``$UDPSeverRun `` config file directives. You can now also set the local address the server should listen to via ``$UDPServerAddress `` config directive.hj.h#h$h%hCh'}r?(h)]h*]h+]h,]h/]uh1Kkh2hh3]r@(h``h'}rG(h)]h*]h+]h,]h/]uhj=h3]rHhrIrJ}rK(hUhjEubah%UliteralrLubh``h'}rR(h)]h*]h+]h,]h/]uhj=h3]rShrTrU}rV(hUhjPubah%jLubh(hj9hj7ubaubh@)r?}r@(hXEither "FixedArray" or "LinkedList" is recommended. "Direct" is available, but should not be used except for a very good reason ("Direct" disables queueing and will potentially lead to message loss on the input side).rAhj0h#h$h%hCh'}rB(h)]h*]h+]h,]h/]uh1Mh2hh3]rCh}q?(h XO*Written by* `Rainer Gerhards `_ *(2009-07-15)*h!hh"h#h$U paragraphq@h&}qA(h(]h)]h*]h+]h-]uh/Kh0hh]qB(cdocutils.nodes emphasis qC)qD}qE(h X *Written by*h&}qF(h(]h)]h*]h+]h-]uh!h>h]qGh9X Written byqHqI}qJ(h Uh!hDubah$UemphasisqKubh9X qL}qM(h X h!h>ubcdocutils.nodes reference qN)qO}qP(h X3`Rainer Gerhards `_h&}qQ(UnameXRainer GerhardsUrefuriqRXhttp://www.gerhards.net/rainerqSh+]h*]h(]h)]h-]uh!h>h]qTh9XRainer GerhardsqUqV}qW(h Uh!hOubah$U referenceqXubcdocutils.nodes target qY)qZ}q[(h X! U referencedq\Kh!h>h$Utargetq]h&}q^(UrefurihSh+]q_hah*]h(]h)]h-]q`hauh]ubh9X qa}qb(h X h!h>ubhC)qc}qd(h X*(2009-07-15)*h&}qe(h(]h)]h*]h+]h-]uh!h>h]qfh9X (2009-07-15)qgqh}qi(h Uh!hcubah$hKubeubh=)qj}qk(h X9The changes introduced in rsyslog v5 are numerous, but not very intrusive. This document describes things to keep in mind when moving from v4 to v5. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents).qlh!hh"h#h$h@h&}qm(h(]h)]h*]h+]h-]uh/Kh0hh]qnh9X9The changes introduced in rsyslog v5 are numerous, but not very intrusive. This document describes things to keep in mind when moving from v4 to v5. It does not list enhancements nor does it talk about compatibility concerns introduced by earlier versions (for this, see their respective compatibility documents).qoqp}qq(h hlh!hjubaubh)qr}qs(h Uh!hh"h#h$h%h&}qt(h(]h)]h*]h+]quhah-]qvh auh/Kh0hh]qw(h2)qx}qy(h XHUP processingqzh!hrh"h#h$h6h&}q{(h(]h)]h*]h+]h-]uh/Kh0hh]q|h9XHUP processingq}q~}q(h hzh!hxubaubh=)q}q(h XThe $HUPisRestart directive is supported by some early v5 versions, but has been removed in 5.1.3 and above. That means that restart-type HUP processing is no longer available. This processing was redundant and had a lot a drawbacks. For details, please see the `rsyslog v4 compatibility notes `_ which elaborate on the reasons and the (few) things you may need to change.h!hrh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]q(h9XThe $HUPisRestart directive is supported by some early v5 versions, but has been removed in 5.1.3 and above. That means that restart-type HUP processing is no longer available. This processing was redundant and had a lot a drawbacks. For details, please see the qq}q(h XThe $HUPisRestart directive is supported by some early v5 versions, but has been removed in 5.1.3 and above. That means that restart-type HUP processing is no longer available. This processing was redundant and had a lot a drawbacks. For details, please see the h!hubhN)q}q(h X8`rsyslog v4 compatibility notes `_h&}q(UnameXrsyslog v4 compatibility noteshRXv4compatibility.htmlqh+]h*]h(]h)]h-]uh!hh]qh9Xrsyslog v4 compatibility notesqq}q(h Uh!hubah$hXubhY)q}q(h X h\Kh!hh$h]h&}q(Urefurihh+]qhah*]h(]h)]h-]qh auh]ubh9XL which elaborate on the reasons and the (few) things you may need to change.qq}q(h XL which elaborate on the reasons and the (few) things you may need to change.h!hubeubh=)q}q(h XOPlease note that starting with 5.8.11 HUP will also requery the local hostname.qh!hrh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XOPlease note that starting with 5.8.11 HUP will also requery the local hostname.qq}q(h hh!hubaubeubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qhauh/Kh0hh]q(h2)q}q(h XQueue on-disk formatqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XQueue on-disk formatqq}q(h hh!hubaubh=)q}q(h X+The queue information file format has been changed. When upgrading from v4 to v5, make sure that the queue is emptied and no on-disk structure present. We did not go great length in understanding the old format, as there was too little demand for that (and it being quite some effort if done right).qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9X+The queue information file format has been changed. When upgrading from v4 to v5, make sure that the queue is emptied and no on-disk structure present. We did not go great length in understanding the old format, as there was too little demand for that (and it being quite some effort if done right).qq}q(h hh!hubaubeubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qh auh/K$h0hh]q(h2)q}q(h XQueue Worker Thread Shutdownqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/K$h0hh]qh9XQueue Worker Thread Shutdownqq}q(h hh!hubaubh=)q}q(h XPrevious rsyslog versions had the capability to "run" on zero queue worker if no work was required. This was done to save a very limited number of resources. However, it came at the price of great complexity. In v5, we have decided to let a minimum of one worker run all the time. The additional resource consumption is probably not noticeable at all, however, this enabled us to do some important code cleanups, resulting in faster and more reliable code (complex code is hard to maintain and error-prone). From the regular user's point of view, this change should be barely noticeable. I am including the note for expert users, who will notice it in rsyslog debug output and other analysis tools. So it is no error if each queue in non-direct mode now always runs at least one worker thread.qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/K&h0hh]qh9XPrevious rsyslog versions had the capability to "run" on zero queue worker if no work was required. This was done to save a very limited number of resources. However, it came at the price of great complexity. In v5, we have decided to let a minimum of one worker run all the time. The additional resource consumption is probably not noticeable at all, however, this enabled us to do some important code cleanups, resulting in faster and more reliable code (complex code is hard to maintain and error-prone). From the regular user's point of view, this change should be barely noticeable. I am including the note for expert users, who will notice it in rsyslog debug output and other analysis tools. So it is no error if each queue in non-direct mode now always runs at least one worker thread.qȅq}q(h hh!hubaubeubeubah UU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh0hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh6NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesr NUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongr Uinput_encoding_error_handlerr!hUauto_id_prefixr"Uidr#Udoctitle_xformr$Ustrip_elements_with_classesr%NU _config_filesr&]r'Ufile_insertion_enabledr(U raw_enabledr)KU dump_settingsr*NubUsymbol_footnote_startr+KUidsr,}r-(hhhhhhhhrhhhhZuUsubstitution_namesr.}r/h$h0h&}r0(h(]h+]h*]Usourceh#h)]h-]uU footnotesr1]r2Urefidsr3}r4ub.build/.doctrees/compatibility/index.doctree0000664000175000017500000000570413035122640020056 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX compatibilityqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU compatibilityqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX:/home/rger/proj/rsyslog-doc/source/compatibility/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Compatibilityq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Compatibilityq0q1}q2(hh+hh)ubaubcdocutils.nodes compound q3)q4}q5(hUhhhhhUcompoundq6h}q7(h]h]q8Utoctree-wrapperq9ah ]h!]h#]uh%Nh&hh]q:csphinx.addnodes toctree q;)q<}q=(hUhh4hhhUtoctreeq>h}q?(Unumberedq@KU includehiddenqAhXcompatibility/indexqBUcaptionqCNUglobqDh!]h ]U titlesonlyqEh]h]h#]UentriesqF]qG(NXcompatibility/v8compatibilityqHqINXcompatibility/v7compatibilityqJqKNXcompatibility/v6compatibilityqLqMNXcompatibility/v5compatibilityqNqONXcompatibility/v4compatibilityqPqQNXcompatibility/v3compatibilityqRqSeUhiddenqTU includefilesqU]qV(hHhJhLhNhPhReUmaxdepthqWJuh%Kh]ubaubeubahUU transformerqXNU footnote_refsqY}qZUrefnamesq[}q\Usymbol_footnotesq]]q^Uautofootnote_refsq_]q`Usymbol_footnote_refsqa]qbU citationsqc]qdh&hU current_lineqeNUtransform_messagesqf]qgUreporterqhNUid_startqiKU autofootnotesqj]qkU citation_refsql}qmUindirect_targetsqn]qoUsettingsqp(cdocutils.frontend Values qqoqr}qs(Ufootnote_backlinksqtKUrecord_dependenciesquNU rfc_base_urlqvUhttps://tools.ietf.org/html/qwU tracebackqxUpep_referencesqyNUstrip_commentsqzNU toc_backlinksq{Uentryq|U language_codeq}Uenq~U datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/concepts/0000775000175000017500000000000013035122641014340 5ustar rgerrgerbuild/.doctrees/concepts/janitor.doctree0000664000175000017500000002527413035122641017367 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXrainer gerhardsqXrsyslogqXthe janitor processq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUrainer-gerhardsqhUrsyslogqh Uthe-janitor-processquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX7/home/rger/proj/rsyslog-doc/source/concepts/janitor.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*h auUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hXThe Janitor Processq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5XThe Janitor Processq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hXThe janitor process carries out periodic cleanup tasks. For example, it is used by :doc:`omfile <../configuration/modules/omfile>` to close files after a timeout has expired.hhhhh U paragraphq(h5XSThe janitor process carries out periodic cleanup tasks. For example, it is used by q?q@}qA(hXSThe janitor process carries out periodic cleanup tasks. For example, it is used by hh:ubcsphinx.addnodes pending_xref qB)qC}qD(hX/:doc:`omfile <../configuration/modules/omfile>`qEhh:hhh U pending_xrefqFh"}qG(UreftypeXdocqHUrefwarnqIU reftargetqJX../configuration/modules/omfileU refdomainUh']h&]U refexplicith$]h%]h)]UrefdocqKXconcepts/janitorqLuh+Kh]qMcdocutils.nodes literal qN)qO}qP(hhEh"}qQ(h$]h%]qR(UxrefqShHeh&]h']h)]uhhCh]qTh5XomfileqUqV}qW(hUhhOubah UliteralqXubaubh5X, to close files after a timeout has expired.qYqZ}q[(hX, to close files after a timeout has expired.hh:ubeubh9)q\}q](hXThe janitor runs periodically. As such, all tasks carried out via the janitor will be activated based on the interval at which it runs. This means that all janitor-related times set are approximate and should be considered as "no earlier than" (NET). If, for example, you set a timeout to 5 minutes and the janitor is run in 10-minute intervals, the timeout may actually happen after 5 minutes, but it may also take up to 20 minutes for it to be detected.q^hhhhh h`\ . If high precision is required, it should be set to one minute. Janitor-based activities will still be NET times, but the time frame will be much smaller. In the example with the file timeout, it would be between 5 and 6 minutes if the janitor is run at a one-minute interval.hhhhh h`qhhhhh hFh"}q(UreftypeXrefhIhJXglobal_janitorintervalU refdomainXstdqh']h&]U refexplicith$]h%]h)]hKhLuh+Kh]qcdocutils.nodes inline q)q}q(hhh"}q(h$]h%]q(hShXstd-refqeh&]h']h)]uhhh]qh5X9the interval at which the janitor runs can be be adjustedqq}q(hUhhubah Uinlinequbaubh5X. If high precision is required, it should be set to one minute. Janitor-based activities will still be NET times, but the time frame will be much smaller. In the example with the file timeout, it would be between 5 and 6 minutes if the janitor is run at a one-minute interval.qq}q(hX\ . If high precision is required, it should be set to one minute. Janitor-based activities will still be NET times, but the time frame will be much smaller. In the example with the file timeout, it would be between 5 and 6 minutes if the janitor is run at a one-minute interval.hhubeubh9)q}q(hXVNote that the more frequent the janitor is run, the more frequent the system needs to wakeup from potential low power state. This is no issue for data center machines (which usually always run at full speed), but it may be an issue for power-constrained environments like notebooks. For such systems, a higher janitor interval may make sense.qhhhhh h`_ project. Copyright © 2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hhhhh h`_h"}q(UnamehUrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogq…q}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X project. Copyright © 2014 by q΅q}q(hX project. Copyright © 2014 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqօq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qޅq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconq慁q}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 3 or higher.qq}q(hX1. Released under the GNU GPL version 3 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr (cdocutils.frontend Values r or }r (Ufootnote_backlinksr KUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh2NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetr Uoutput_encoding_error_handlerr!Ustrictr"U sectnum_xformr#KUdump_transformsr$NU docinfo_xformr%KUwarning_streamr&NUpep_file_url_templater'Upep-%04dr(Uexit_status_levelr)KUconfigr*NUstrict_visitorr+NUcloak_email_addressesr,Utrim_footnote_reference_spacer-Uenvr.NUdump_pseudo_xmlr/NUexpose_internalsr0NUsectsubtitle_xformr1U source_linkr2NUrfc_referencesr3NUoutput_encodingr4Uutf-8r5U source_urlr6NUinput_encodingr7U utf-8-sigr8U_disable_configr9NU id_prefixr:UU tab_widthr;KUerror_encodingr<UUTF-8r=U_sourcer>hUgettext_compactr?U generatorr@NUdump_internalsrANU smart_quotesrBU pep_base_urlrCU https://www.python.org/dev/peps/rDUsyntax_highlightrEUlongrFUinput_encoding_error_handlerrGj"Uauto_id_prefixrHUidrIUdoctitle_xformrJUstrip_elements_with_classesrKNU _config_filesrL]Ufile_insertion_enabledrMU raw_enabledrNKU dump_settingsrONubUsymbol_footnote_startrPKUidsrQ}rR(hhhhhhhhuUsubstitution_namesrS}rTh h,h"}rU(h$]h']h&]Usourcehh%]h)]uU footnotesrV]rWUrefidsrX}rYub.build/.doctrees/concepts/queues.doctree0000664000175000017500000026177113035122641017234 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xin-memory queuesqNXprocessing timeframesqNX rate limitingqNXterminating queuesq NX disk queuesq NXunderstanding rsyslog queuesq NXfilled-up queuesq NXmassive database insertsq Xwhere are queues used?qNX performanceqNX queue modesqNX rsyslog wikiqXdisk-assisted memory queuesqNXlimiting the queue sizeqNXworker thread poolsqNXdiscarding messagesqNX direct queuesqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUin-memory-queuesq hUprocessing-timeframesq!hU rate-limitingq"h Uterminating-queuesq#h U disk-queuesq$h Uunderstanding-rsyslog-queuesq%h Ufilled-up-queuesq&h Umassive-database-insertsq'hUwhere-are-queues-usedq(hU performanceq)hU queue-modesq*hU rsyslog-wikiq+hUdisk-assisted-memory-queuesq,hUlimiting-the-queue-sizeq-hUworker-thread-poolsq.hUdiscarding-messagesq/hU direct-queuesq0uUchildrenq1]q2cdocutils.nodes section q3)q4}q5(U rawsourceq6UUparentq7hUsourceq8X6/home/rger/proj/rsyslog-doc/source/concepts/queues.rstq9Utagnameq:Usectionq;U attributesq<}q=(Udupnamesq>]Uclassesq?]Ubackrefsq@]UidsqA]qBh%aUnamesqC]qDh auUlineqEKUdocumentqFhh1]qG(cdocutils.nodes title qH)qI}qJ(h6XUnderstanding rsyslog QueuesqKh7h4h8h9h:UtitleqLh<}qM(h>]h?]h@]hA]hC]uhEKhFhh1]qNcdocutils.nodes Text qOXUnderstanding rsyslog QueuesqPqQ}qR(h6hKh7hIubaubcdocutils.nodes paragraph qS)qT}qU(h6XRsyslog uses queues whenever two activities need to be loosely coupled. With a queue, one part of the system "produces" something while another part "consumes" this something. The "something" is most often syslog messages, but queues may also be used for other purposes.qVh7h4h8h9h:U paragraphqWh<}qX(h>]h?]h@]hA]hC]uhEKhFhh1]qYhOXRsyslog uses queues whenever two activities need to be loosely coupled. With a queue, one part of the system "produces" something while another part "consumes" this something. The "something" is most often syslog messages, but queues may also be used for other purposes.qZq[}q\(h6hVh7hTubaubhS)q]}q^(h6XThis document provides a good insight into technical details, operation modes and implications. In addition to it, an :doc:`rsyslog queue concepts overview <../whitepapers/queues_analogy>` document exists which tries to explain queues with the help of some analogies. This may probably be a better place to start reading about queues. I assume that once you have understood that document, the material here will be much easier to grasp and look much more natural.h7h4h8h9h:hWh<}q_(h>]h?]h@]hA]hC]uhEK hFhh1]q`(hOXvThis document provides a good insight into technical details, operation modes and implications. In addition to it, an qaqb}qc(h6XvThis document provides a good insight into technical details, operation modes and implications. In addition to it, an h7h]ubcsphinx.addnodes pending_xref qd)qe}qf(h6XF:doc:`rsyslog queue concepts overview <../whitepapers/queues_analogy>`qgh7h]h8h9h:U pending_xrefqhh<}qi(UreftypeXdocqjUrefwarnqkU reftargetqlX../whitepapers/queues_analogyU refdomainUhA]h@]U refexplicith>]h?]hC]UrefdocqmXconcepts/queuesqnuhEK h1]qocdocutils.nodes literal qp)qq}qr(h6hgh<}qs(h>]h?]qt(Uxrefquhjeh@]hA]hC]uh7heh1]qvhOXrsyslog queue concepts overviewqwqx}qy(h6Uh7hqubah:UliteralqzubaubhOX document exists which tries to explain queues with the help of some analogies. This may probably be a better place to start reading about queues. I assume that once you have understood that document, the material here will be much easier to grasp and look much more natural.q{q|}q}(h6X document exists which tries to explain queues with the help of some analogies. This may probably be a better place to start reading about queues. I assume that once you have understood that document, the material here will be much easier to grasp and look much more natural.h7h]ubeubhS)q~}q(h6XThe most prominent example is the main message queue. Whenever rsyslog receives a message (e.g. locally, via UDP, TCP or in whatever else way), it places these messages into the main message queue. Later, it is dequeued by the rule processor, which then evaluates which actions are to be carried out. In front of each action, there is also a queue, which potentially de-couples the filter processing from the actual action (e.g. writing to file, database or forwarding to another host).qh7h4h8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEKhFhh1]qhOXThe most prominent example is the main message queue. Whenever rsyslog receives a message (e.g. locally, via UDP, TCP or in whatever else way), it places these messages into the main message queue. Later, it is dequeued by the rule processor, which then evaluates which actions are to be carried out. In front of each action, there is also a queue, which potentially de-couples the filter processing from the actual action (e.g. writing to file, database or forwarding to another host).qq}q(h6hh7h~ubaubh3)q}q(h6Uh7h4h8h9h:h;h<}q(h>]h?]h@]hA]qh(ahC]qhauhEKhFhh1]q(hH)q}q(h6XWhere are Queues Used?qh7hh8h9h:hLh<}q(h>]h?]h@]hA]hC]uhEKhFhh1]qhOXWhere are Queues Used?qq}q(h6hh7hubaubhS)q}q(h6XJCurrently, queues are used for the main message queue and for the actions.qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEKhFhh1]qhOXJCurrently, queues are used for the main message queue and for the actions.qq}q(h6hh7hubaubhS)q}q(h6X=There is a single main message queue inside rsyslog. Each input module delivers messages to it. The main message queue worker filters messages based on rules specified in rsyslog.conf and dispatches them to the individual action queues. Once a message is in an action queue, it is deleted from the main message queue.qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEKhFhh1]qhOX=There is a single main message queue inside rsyslog. Each input module delivers messages to it. The main message queue worker filters messages based on rules specified in rsyslog.conf and dispatches them to the individual action queues. Once a message is in an action queue, it is deleted from the main message queue.qq}q(h6hh7hubaubhS)q}q(h6XThere are multiple action queues, one for each configured action. By default, these queues operate in direct (non-queueing) mode. Action queues are fully configurable and thus can be changed to whatever is best for the given use case.qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEK%hFhh1]qhOXThere are multiple action queues, one for each configured action. By default, these queues operate in direct (non-queueing) mode. Action queues are fully configurable and thus can be changed to whatever is best for the given use case.qq}q(h6hh7hubaubhS)q}q(h6XRFuture versions of rsyslog will most probably utilize queues at other places, too.qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEK*hFhh1]qhOXRFuture versions of rsyslog will most probably utilize queues at other places, too.qq}q(h6hh7hubaubhS)q}q(h6XWherever "**\ "  is used in the config file statements, substitute "**\ " with either "MainMsg" or "Action". The former will set main message queue parameters, the later parameters for the next action that will be created. Action queue parameters can not be modified once the action has been specified. For example, to tell the main message queue to save its content on shutdown, use *$MainMsgQueueSaveOnShutdown on*".h7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEK-hFhh1]q(hOX Wherever "qq}q(h6X Wherever "h7hubcdocutils.nodes emphasis q)q}q(h6X **h<}q(h>]h?]h@]hA]hC]uh7hh1]qhOXqq}q(h6Uh7hubah:UemphasisqubhOX7"  is used in the config file statements, substitute "qąq}q(h6X9\ "  is used in the config file statements, substitute "h7hubh)q}q(h6X **h<}q(h>]h?]h@]hA]hC]uh7hh1]qhOXq˅q}q(h6Uh7hubah:hubhOX8" with either "MainMsg" or "Action". The former will set main message queue parameters, the later parameters for the next action that will be created. Action queue parameters can not be modified once the action has been specified. For example, to tell the main message queue to save its content on shutdown, use q΅q}q(h6X:\ " with either "MainMsg" or "Action". The former will set main message queue parameters, the later parameters for the next action that will be created. Action queue parameters can not be modified once the action has been specified. For example, to tell the main message queue to save its content on shutdown, use h7hubh)q}q(h6X *$MainMsgQueueSaveOnShutdown on*h<}q(h>]h?]h@]hA]hC]uh7hh1]qhOX$MainMsgQueueSaveOnShutdown onqՅq}q(h6Uh7hubah:hubhOX".q؅q}q(h6X".h7hubeubhS)q}q(h6XIf the same parameter is specified multiple times before a queue is created, the last one specified takes precedence. The main message queue is created after parsing the config file and all of its potential includes. An action queue is created each time an action selector is specified. Action queue parameters are reset to default after an action queue has been created (to provide a clean environment for the next action).qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEK5hFhh1]qhOXIf the same parameter is specified multiple times before a queue is created, the last one specified takes precedence. The main message queue is created after parsing the config file and all of its potential includes. An action queue is created each time an action selector is specified. Action queue parameters are reset to default after an action queue has been created (to provide a clean environment for the next action).qq}q(h6hh7hubaubhS)q}q(h6X-Not all queues necessarily support the full set of queue configuration parameters, because not all are applicable. For example, in current output module design, actions do not support multi-threading. Consequently, the number of worker threads is fixed to one for action queues and can not be changed.qh7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEK=hFhh1]qhOX-Not all queues necessarily support the full set of queue configuration parameters, because not all are applicable. For example, in current output module design, actions do not support multi-threading. Consequently, the number of worker threads is fixed to one for action queues and can not be changed.q腁q}q(h6hh7hubaubeubh3)q}q(h6Uh7h4h8h9h:h;h<}q(h>]h?]h@]hA]qh*ahC]qhauhEKDhFhh1]q(hH)q}q(h6X Queue Modesqh7hh8h9h:hLh<}q(h>]h?]h@]hA]hC]uhEKDhFhh1]qhOX Queue Modesqq}q(h6hh7hubaubhS)q}q(h6XRsyslog supports different queue modes, some with submodes. Each of them has specific advantages and disadvantages. Selecting the right queue mode is quite important when tuning rsyslogd. The queue mode (aka "type") is set via the "*$QueueType*\ " config directive.h7hh8h9h:hWh<}q(h>]h?]h@]hA]hC]uhEKFhFhh1]q(hOXRsyslog supports different queue modes, some with submodes. Each of them has specific advantages and disadvantages. Selecting the right queue mode is quite important when tuning rsyslogd. The queue mode (aka "type") is set via the "qq}q(h6XRsyslog supports different queue modes, some with submodes. Each of them has specific advantages and disadvantages. Selecting the right queue mode is quite important when tuning rsyslogd. The queue mode (aka "type") is set via the "h7hubh)r}r(h6X*$QueueType*h<}r(h>]h?]h@]hA]hC]uh7hh1]rhOX$QueueTyperr}r(h6Uh7jubah:hubhOX" config directive.rr}r (h6X\ " config directive.h7hubeubh3)r }r (h6Uh7hh8h9h:h;h<}r (h>]h?]h@]hA]r h0ahC]rhauhEKLhFhh1]r(hH)r}r(h6X Direct Queuesrh7j h8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEKLhFhh1]rhOX Direct Queuesrr}r(h6jh7jubaubhS)r}r(h6XDirect queues are **non**-queuing queues. A queue in direct mode does neither queue nor buffer any of the queue elements but rather passes the element directly (and immediately) from the producer to the consumer. This sounds strange, but there is a good reason for this queue type.h7j h8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKNhFhh1]r(hOXDirect queues are rr}r(h6XDirect queues are h7jubcdocutils.nodes strong r)r }r!(h6X**non**h<}r"(h>]h?]h@]hA]hC]uh7jh1]r#hOXnonr$r%}r&(h6Uh7j ubah:Ustrongr'ubhOX-queuing queues. A queue in direct mode does neither queue nor buffer any of the queue elements but rather passes the element directly (and immediately) from the producer to the consumer. This sounds strange, but there is a good reason for this queue type.r(r)}r*(h6X-queuing queues. A queue in direct mode does neither queue nor buffer any of the queue elements but rather passes the element directly (and immediately) from the producer to the consumer. This sounds strange, but there is a good reason for this queue type.h7jubeubhS)r+}r,(h6XDirect mode queues allow to use queues generically, even in places where queuing is not always desired. A good example is the queue in front of output actions. While it makes perfect sense to buffer forwarding actions or database writes, it makes only limited sense to build up a queue in front of simple local file writes. Yet, rsyslog still has a queue in front of every action. So for file writes, the queue mode can simply be set to "direct", in which case no queuing happens.r-h7j h8h9h:hWh<}r.(h>]h?]h@]hA]hC]uhEKShFhh1]r/hOXDirect mode queues allow to use queues generically, even in places where queuing is not always desired. A good example is the queue in front of output actions. While it makes perfect sense to buffer forwarding actions or database writes, it makes only limited sense to build up a queue in front of simple local file writes. Yet, rsyslog still has a queue in front of every action. So for file writes, the queue mode can simply be set to "direct", in which case no queuing happens.r0r1}r2(h6j-h7j+ubaubhS)r3}r4(h6X1Please note that a direct queue also is the only queue type that passes back the execution return code (success/failure) from the consumer to the producer. This, for example, is needed for the backup action logic. Consequently, backup actions require the to-be-checked action to use a "direct" mode queue.r5h7j h8h9h:hWh<}r6(h>]h?]h@]hA]hC]uhEK[hFhh1]r7hOX1Please note that a direct queue also is the only queue type that passes back the execution return code (success/failure) from the consumer to the producer. This, for example, is needed for the backup action logic. Consequently, backup actions require the to-be-checked action to use a "direct" mode queue.r8r9}r:(h6j5h7j3ubaubhS)r;}r<(h6XSTo create a direct queue, use the "*$QueueType Direct*\ " config directive.h7j h8h9h:hWh<}r=(h>]h?]h@]hA]hC]uhEKahFhh1]r>(hOX#To create a direct queue, use the "r?r@}rA(h6X#To create a direct queue, use the "h7j;ubh)rB}rC(h6X*$QueueType Direct*h<}rD(h>]h?]h@]hA]hC]uh7j;h1]rEhOX$QueueType DirectrFrG}rH(h6Uh7jBubah:hubhOX" config directive.rIrJ}rK(h6X\ " config directive.h7j;ubeubeubh3)rL}rM(h6Uh7hh8h9h:h;h<}rN(h>]h?]h@]hA]rOh$ahC]rPh auhEKehFhh1]rQ(hH)rR}rS(h6X Disk QueuesrTh7jLh8h9h:hLh<}rU(h>]h?]h@]hA]hC]uhEKehFhh1]rVhOX Disk QueuesrWrX}rY(h6jTh7jRubaubhS)rZ}r[(h6XYDisk queues use disk drives for buffering. The important fact is that they always use the disk and do not buffer anything in memory. Thus, the queue is ultra-reliable, but by far the slowest mode. For regular use cases, this queue mode is not recommended. It is useful if log data is so important that it must not be lost, even in extreme cases.r\h7jLh8h9h:hWh<}r](h>]h?]h@]hA]hC]uhEKghFhh1]r^hOXYDisk queues use disk drives for buffering. The important fact is that they always use the disk and do not buffer anything in memory. Thus, the queue is ultra-reliable, but by far the slowest mode. For regular use cases, this queue mode is not recommended. It is useful if log data is so important that it must not be lost, even in extreme cases.r_r`}ra(h6j\h7jZubaubhS)rb}rc(h6XWhen a disk queue is written, it is done in chunks. Each chunk receives its individual file. Files are named with a prefix (set via the "*$QueueFilename*\ " config directive) and followed by a 7-digit number (starting at one and incremented for each file). Chunks are 10mb by default, a different size can be set via the"*$QueueMaxFileSize*\ " config directive. Note that the size limit is not a sharp one: rsyslog always writes one complete queue entry, even if it violates the size limit. So chunks are actually a little but (usually less than 1k) larger then the configured size. Each chunk also has a different size for the same reason. If you observe different chunk sizes, you can relax: this is not a problem.h7jLh8h9h:hWh<}rd(h>]h?]h@]hA]hC]uhEKmhFhh1]re(hOXWhen a disk queue is written, it is done in chunks. Each chunk receives its individual file. Files are named with a prefix (set via the "rfrg}rh(h6XWhen a disk queue is written, it is done in chunks. Each chunk receives its individual file. Files are named with a prefix (set via the "h7jbubh)ri}rj(h6X*$QueueFilename*h<}rk(h>]h?]h@]hA]hC]uh7jbh1]rlhOX$QueueFilenamermrn}ro(h6Uh7jiubah:hubhOX" config directive) and followed by a 7-digit number (starting at one and incremented for each file). Chunks are 10mb by default, a different size can be set via the"rprq}rr(h6X\ " config directive) and followed by a 7-digit number (starting at one and incremented for each file). Chunks are 10mb by default, a different size can be set via the"h7jbubh)rs}rt(h6X*$QueueMaxFileSize*h<}ru(h>]h?]h@]hA]hC]uh7jbh1]rvhOX$QueueMaxFileSizerwrx}ry(h6Uh7jsubah:hubhOXv" config directive. Note that the size limit is not a sharp one: rsyslog always writes one complete queue entry, even if it violates the size limit. So chunks are actually a little but (usually less than 1k) larger then the configured size. Each chunk also has a different size for the same reason. If you observe different chunk sizes, you can relax: this is not a problem.rzr{}r|(h6Xx\ " config directive. Note that the size limit is not a sharp one: rsyslog always writes one complete queue entry, even if it violates the size limit. So chunks are actually a little but (usually less than 1k) larger then the configured size. Each chunk also has a different size for the same reason. If you observe different chunk sizes, you can relax: this is not a problem.h7jbubeubhS)r}}r~(h6XWriting in chunks is used so that processed data can quickly be deleted and is free for other uses - while at the same time keeping no artificial upper limit on disk space used. If a disk quota is set (instructions further below), be sure that the quota/chunk size allows at least two chunks to be written. Rsyslog currently does not check that and will fail miserably if a single chunk is over the quota.rh7jLh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKyhFhh1]rhOXWriting in chunks is used so that processed data can quickly be deleted and is free for other uses - while at the same time keeping no artificial upper limit on disk space used. If a disk quota is set (instructions further below), be sure that the quota/chunk size allows at least two chunks to be written. Rsyslog currently does not check that and will fail miserably if a single chunk is over the quota.rr}r(h6jh7j}ubaubhS)r}r(h6X_Creating new chunks costs performance but provides quicker ability to free disk space. The 10mb default is considered a good compromise between these two. However, it may make sense to adapt these settings to local policies. For example, if a disk queue is written on a dedicated 200gb disk, it may make sense to use a 2gb (or even larger) chunk size.rh7jLh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOX_Creating new chunks costs performance but provides quicker ability to free disk space. The 10mb default is considered a good compromise between these two. However, it may make sense to adapt these settings to local policies. For example, if a disk queue is written on a dedicated 200gb disk, it may make sense to use a 2gb (or even larger) chunk size.rr}r(h6jh7jubaubhS)r}r(h6XPlease note, however, that the disk queue by default does not update its housekeeping structures every time it writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when manually is mangled with the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.rh7jLh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXPlease note, however, that the disk queue by default does not update its housekeeping structures every time it writes to disk. This is for performance reasons. In the event of failure, data will still be lost (except when manually is mangled with the file structures). However, disk queues can be set to write bookkeeping information on checkpoints (every n records), so that this can be made ultra-reliable, too. If the checkpoint interval is set to one, no data can be lost, but the queue is exceptionally slow.rr}r(h6jh7jubaubhS)r}r(h6XEach queue can be placed on a different disk for best performance and/or isolation. This is currently selected by specifying different *$WorkDirectory* config directives before the queue creation statement.h7jLh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]r(hOXEach queue can be placed on a different disk for best performance and/or isolation. This is currently selected by specifying different rr}r(h6XEach queue can be placed on a different disk for best performance and/or isolation. This is currently selected by specifying different h7jubh)r}r(h6X*$WorkDirectory*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$WorkDirectoryrr}r(h6Uh7jubah:hubhOX7 config directives before the queue creation statement.rr}r(h6X7 config directives before the queue creation statement.h7jubeubhS)r}r(h6XTo create a disk queue, use the "*$QueueType Disk*\ " config directive. Checkpoint intervals can be specified via "*$QueueCheckpointInterval*\ ", with 0 meaning no checkpoints. Note that disk-based queues can be made very reliable by issuing a (f)sync after each write operation. Starting with version 4.3.2, this can be requested via "*QueueSyncQueueFiles on/off* with the default being off. Activating this option has a performance penalty, so it should not be turned on without reason.h7jLh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]r(hOX!To create a disk queue, use the "rr}r(h6X!To create a disk queue, use the "h7jubh)r}r(h6X*$QueueType Disk*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueType Diskrr}r(h6Uh7jubah:hubhOX?" config directive. Checkpoint intervals can be specified via "rr}r(h6XA\ " config directive. Checkpoint intervals can be specified via "h7jubh)r}r(h6X"*$QueueCheckpointInterval*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX $QueueCheckpointIntervalrr}r(h6Uh7jubah:hubhOX", with 0 meaning no checkpoints. Note that disk-based queues can be made very reliable by issuing a (f)sync after each write operation. Starting with version 4.3.2, this can be requested via "rr}r(h6X\ ", with 0 meaning no checkpoints. Note that disk-based queues can be made very reliable by issuing a (f)sync after each write operation. Starting with version 4.3.2, this can be requested via "h7jubh)r}r(h6X$*QueueSyncQueueFiles on/off*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX"QueueSyncQueueFiles on/offrr}r(h6Uh7jubah:hubhOX| with the default being off. Activating this option has a performance penalty, so it should not be turned on without reason.rr}r(h6X| with the default being off. Activating this option has a performance penalty, so it should not be turned on without reason.h7jubeubeubh3)r}r(h6Uh7hh8h9h:h;h<}r(h>]h?]h@]hA]rh ahC]rhauhEKhFhh1]r(hH)r}r(h6XIn-Memory Queuesrh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXIn-Memory Queuesrr}r(h6jh7jubaubhS)r}r(h6XIn-memory queue mode is what most people have on their mind when they think about computing queues. Here, the enqueued data elements are held in memory. Consequently, in-memory queues are very fast. But of course, they do not survive any program or operating system abort (what usually is tolerable and unlikely). Be sure to use an UPS if you use in-memory mode and your log data is important to you. Note that even in-memory queues may hold data for an infinite amount of time when e.g. an output destination system is down and there is no reason to move the data out of memory (lying around in memory for an extended period of time is NOT a reason). Pure in-memory queues can't even store queue elements anywhere else than in core memory.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXIn-memory queue mode is what most people have on their mind when they think about computing queues. Here, the enqueued data elements are held in memory. Consequently, in-memory queues are very fast. But of course, they do not survive any program or operating system abort (what usually is tolerable and unlikely). Be sure to use an UPS if you use in-memory mode and your log data is important to you. Note that even in-memory queues may hold data for an infinite amount of time when e.g. an output destination system is down and there is no reason to move the data out of memory (lying around in memory for an extended period of time is NOT a reason). Pure in-memory queues can't even store queue elements anywhere else than in core memory.rr}r(h6jh7jubaubhS)r}r(h6XThere exist two different in-memory queue modes: LinkedList and FixedArray. Both are quite similar from the user's point of view, but utilize different algorithms.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXThere exist two different in-memory queue modes: LinkedList and FixedArray. Both are quite similar from the user's point of view, but utilize different algorithms.rr}r(h6jh7jubaubhS)r}r(h6XA FixedArray queue uses a fixed, pre-allocated array that holds pointers to queue elements. The majority of space is taken up by the actual user data elements, to which the pointers in the array point. The pointer array itself is comparatively small. However, it has a certain memory footprint even if the queue is empty. As there is no need to dynamically allocate any housekeeping structures, FixedArray offers the best run time performance (uses the least CPU cycle). FixedArray is best if there is a relatively low number of queue elements expected and performance is desired. It is the default mode for the main message queue (with a limit of 10,000 elements).rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXA FixedArray queue uses a fixed, pre-allocated array that holds pointers to queue elements. The majority of space is taken up by the actual user data elements, to which the pointers in the array point. The pointer array itself is comparatively small. However, it has a certain memory footprint even if the queue is empty. As there is no need to dynamically allocate any housekeeping structures, FixedArray offers the best run time performance (uses the least CPU cycle). FixedArray is best if there is a relatively low number of queue elements expected and performance is desired. It is the default mode for the main message queue (with a limit of 10,000 elements).rr}r(h6jh7jubaubhS)r}r(h6XpA LinkedList queue is quite the opposite. All housekeeping structures are dynamically allocated (in a linked list, as its name implies). This requires somewhat more runtime processing overhead, but ensures that memory is only allocated in cases where it is needed. LinkedList queues are especially well-suited for queues where only occasionally a than-high number of elements need to be queued. A use case may be occasional message burst. Memory permitting, it could be limited to e.g. 200,000 elements which would take up only memory if in use. A FixedArray queue may have a too large static memory footprint in such cases.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]rhOXpA LinkedList queue is quite the opposite. All housekeeping structures are dynamically allocated (in a linked list, as its name implies). This requires somewhat more runtime processing overhead, but ensures that memory is only allocated in cases where it is needed. LinkedList queues are especially well-suited for queues where only occasionally a than-high number of elements need to be queued. A use case may be occasional message burst. Memory permitting, it could be limited to e.g. 200,000 elements which would take up only memory if in use. A FixedArray queue may have a too large static memory footprint in such cases.rr}r(h6jh7jubaubhS)r}r(h6X**In general, it is advised to use LinkedList mode if in doubt**. The processing overhead compared to FixedArray is low and may be outweigh by the reduction in memory use. Paging in most-often-unused pointer array pages can be much slower than dynamically allocating them.h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEKhFhh1]r(j)r}r(h6X@**In general, it is advised to use LinkedList mode if in doubt**h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX<In general, it is advised to use LinkedList mode if in doubtrr}r(h6Uh7jubah:j'ubhOX. The processing overhead compared to FixedArray is low and may be outweigh by the reduction in memory use. Paging in most-often-unused pointer array pages can be much slower than dynamically allocating them.rr}r(h6X. The processing overhead compared to FixedArray is low and may be outweigh by the reduction in memory use. Paging in most-often-unused pointer array pages can be much slower than dynamically allocating them.h7jubeubhS)r}r(h6XTo create an in-memory queue, use the "*$QueueType LinkedList*\ " or  "*$QueueType FixedArray*\ " config directive.h7jh8h9h:hWh<}r (h>]h?]h@]hA]hC]uhEKhFhh1]r (hOX'To create an in-memory queue, use the "r r }r (h6X'To create an in-memory queue, use the "h7jubh)r}r(h6X*$QueueType LinkedList*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueType LinkedListrr}r(h6Uh7jubah:hubhOX" or  "rr}r(h6X \ " or  "h7jubh)r}r(h6X*$QueueType FixedArray*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueType FixedArrayrr}r(h6Uh7jubah:hubhOX" config directive.rr }r!(h6X\ " config directive.h7jubeubh3)r"}r#(h6Uh7jh8h9h:h;h<}r$(h>]h?]h@]hA]r%h,ahC]r&hauhEKhFhh1]r'(hH)r(}r)(h6XDisk-Assisted Memory Queuesr*h7j"h8h9h:hLh<}r+(h>]h?]h@]hA]hC]uhEKhFhh1]r,hOXDisk-Assisted Memory Queuesr-r.}r/(h6j*h7j(ubaubhS)r0}r1(h6XIf a disk queue name is defined for in-memory queues (via *$QueueFileName*), they automatically become "disk-assisted" (DA). In that mode, data is written to disk (and read back) on an as-needed basis.h7j"h8h9h:hWh<}r2(h>]h?]h@]hA]hC]uhEKhFhh1]r3(hOX:If a disk queue name is defined for in-memory queues (via r4r5}r6(h6X:If a disk queue name is defined for in-memory queues (via h7j0ubh)r7}r8(h6X*$QueueFileName*h<}r9(h>]h?]h@]hA]hC]uh7j0h1]r:hOX$QueueFileNamer;r<}r=(h6Uh7j7ubah:hubhOX), they automatically become "disk-assisted" (DA). In that mode, data is written to disk (and read back) on an as-needed basis.r>r?}r@(h6X), they automatically become "disk-assisted" (DA). In that mode, data is written to disk (and read back) on an as-needed basis.h7j0ubeubhS)rA}rB(h6XSActually, the regular memory queue (called the "primary queue") and a disk queue (called the "DA queue") work in tandem in this mode. Most importantly, the disk queue is activated if the primary queue is full or needs to be persisted on shutdown. Disk-assisted queues combine the advantages of pure memory queues with those of  pure disk queues. Under normal operations, they are very fast and messages will never touch the disk. But if there is need to, an unlimited amount of messages can be buffered (actually limited by free disk space only) and data can be persisted between rsyslogd runs.rCh7j"h8h9h:hWh<}rD(h>]h?]h@]hA]hC]uhEKhFhh1]rEhOXSActually, the regular memory queue (called the "primary queue") and a disk queue (called the "DA queue") work in tandem in this mode. Most importantly, the disk queue is activated if the primary queue is full or needs to be persisted on shutdown. Disk-assisted queues combine the advantages of pure memory queues with those of  pure disk queues. Under normal operations, they are very fast and messages will never touch the disk. But if there is need to, an unlimited amount of messages can be buffered (actually limited by free disk space only) and data can be persisted between rsyslogd runs.rFrG}rH(h6jCh7jAubaubhS)rI}rJ(h6XEWith a DA-queue, both disk-specific and in-memory specific configuration parameters can be set. From the user's point of view, think of a DA queue like a "super-queue" which does all within a single queue [from the code perspective, there is some specific handling for this case, so it is actually much like a single object].rKh7j"h8h9h:hWh<}rL(h>]h?]h@]hA]hC]uhEKhFhh1]rMhOXEWith a DA-queue, both disk-specific and in-memory specific configuration parameters can be set. From the user's point of view, think of a DA queue like a "super-queue" which does all within a single queue [from the code perspective, there is some specific handling for this case, so it is actually much like a single object].rNrO}rP(h6jKh7jIubaubhS)rQ}rR(h6XFDA queues are typically used to de-couple potentially long-running and unreliable actions (to make them reliable). For example, it is recommended to use a disk-assisted linked list in-memory queue in front of each database and "send via tcp" action. Doing so makes these actions reliable and de-couples their potential low execution speed from the rest of your rules (e.g. the local file writes). There is a howto on `massive database inserts `_ which nicely describes this use case. It may even be a good read if you do not intend to use databases.h7j"h8h9h:hWh<}rS(h>]h?]h@]hA]hC]uhEKhFhh1]rT(hOXDA queues are typically used to de-couple potentially long-running and unreliable actions (to make them reliable). For example, it is recommended to use a disk-assisted linked list in-memory queue in front of each database and "send via tcp" action. Doing so makes these actions reliable and de-couples their potential low execution speed from the rest of your rules (e.g. the local file writes). There is a howto on rUrV}rW(h6XDA queues are typically used to de-couple potentially long-running and unreliable actions (to make them reliable). For example, it is recommended to use a disk-assisted linked list in-memory queue in front of each database and "send via tcp" action. Doing so makes these actions reliable and de-couples their potential low execution speed from the rest of your rules (e.g. the local file writes). There is a howto on h7jQubcdocutils.nodes reference rX)rY}rZ(h6X=`massive database inserts `_h<}r[(UnameXmassive database insertsUrefurir\Xrsyslog_high_database_rate.htmlr]hA]h@]h>]h?]hC]uh7jQh1]r^hOXmassive database insertsr_r`}ra(h6Uh7jYubah:U referencerbubcdocutils.nodes target rc)rd}re(h6X" U referencedrfKh7jQh:Utargetrgh<}rh(Urefurij]hA]rih'ah@]h>]h?]hC]rjh auh1]ubhOXh which nicely describes this use case. It may even be a good read if you do not intend to use databases.rkrl}rm(h6Xh which nicely describes this use case. It may even be a good read if you do not intend to use databases.h7jQubeubhS)rn}ro(h6XWith DA queues, we do not simply write out everything to disk and then run as a disk queue once the in-memory queue is full. A much smarter algorithm is used, which involves a "high watermark" and a "low watermark". Both specify numbers of queued items. If the queue size reaches high watermark elements, the queue begins to write data elements to disk. It does so until it reaches the low water mark elements. At this point, it stops writing until either high water mark is reached again or the on-disk queue becomes empty, in which case the queue reverts back to in-memory mode, only. While holding at the low watermark, new elements are actually enqueued in memory. They are eventually written to disk, but only if the high water mark is ever reached again. If it isn't, these items never touch the disk. So even when a queue runs disk-assisted, there is in-memory data present (this is a big difference to pure disk queues!).rph7j"h8h9h:hWh<}rq(h>]h?]h@]hA]hC]uhEKhFhh1]rrhOXWith DA queues, we do not simply write out everything to disk and then run as a disk queue once the in-memory queue is full. A much smarter algorithm is used, which involves a "high watermark" and a "low watermark". Both specify numbers of queued items. If the queue size reaches high watermark elements, the queue begins to write data elements to disk. It does so until it reaches the low water mark elements. At this point, it stops writing until either high water mark is reached again or the on-disk queue becomes empty, in which case the queue reverts back to in-memory mode, only. While holding at the low watermark, new elements are actually enqueued in memory. They are eventually written to disk, but only if the high water mark is ever reached again. If it isn't, these items never touch the disk. So even when a queue runs disk-assisted, there is in-memory data present (this is a big difference to pure disk queues!).rsrt}ru(h6jph7jnubaubhS)rv}rw(h6XYThis algorithm prevents unnecessary disk writes, but also leaves some additional buffer space for message bursts. Remember that creating disk files and writing to them is a lengthy operation. It is too lengthy to e.g. block receiving UDP messages. Doing so would result in message loss. Thus, the queue initiates DA mode, but still is able to receive messages and enqueue them - as long as the maximum queue size is not reached. The number of elements between the high water mark and the maximum queue size serves as this "emergency buffer". Size it according to your needs, if traffic is very bursty you will probably need a large buffer here. Keep in mind, though, that under normal operations these queue elements will probably never be used. Setting the high water mark too low will cause disk-assistance to be turned on more often than actually needed.rxh7j"h8h9h:hWh<}ry(h>]h?]h@]hA]hC]uhEKhFhh1]rzhOXYThis algorithm prevents unnecessary disk writes, but also leaves some additional buffer space for message bursts. Remember that creating disk files and writing to them is a lengthy operation. It is too lengthy to e.g. block receiving UDP messages. Doing so would result in message loss. Thus, the queue initiates DA mode, but still is able to receive messages and enqueue them - as long as the maximum queue size is not reached. The number of elements between the high water mark and the maximum queue size serves as this "emergency buffer". Size it according to your needs, if traffic is very bursty you will probably need a large buffer here. Keep in mind, though, that under normal operations these queue elements will probably never be used. Setting the high water mark too low will cause disk-assistance to be turned on more often than actually needed.r{r|}r}(h6jxh7jvubaubhS)r~}r(h6XThe water marks can be set via the "*$QueueHighWatermark*\ " and  "*$QueueLowWatermark*\ " configuration file directives. Note that these are actual numbers, not percentages. Be sure they make sense (also in respect to "*$QueueSize*\ "), as rsyslodg does currently not perform any checks on the numbers provided. It is easy to screw up the system here (yes, a feature enhancement request is filed ;)).h7j"h8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEM hFhh1]r(hOX$The water marks can be set via the "rr}r(h6X$The water marks can be set via the "h7j~ubh)r}r(h6X*$QueueHighWatermark*h<}r(h>]h?]h@]hA]hC]uh7j~h1]rhOX$QueueHighWatermarkrr}r(h6Uh7jubah:hubhOX " and  "rr}r(h6X \ " and  "h7j~ubh)r}r(h6X*$QueueLowWatermark*h<}r(h>]h?]h@]hA]hC]uh7j~h1]rhOX$QueueLowWatermarkrr}r(h6Uh7jubah:hubhOX" configuration file directives. Note that these are actual numbers, not percentages. Be sure they make sense (also in respect to "rr}r(h6X\ " configuration file directives. Note that these are actual numbers, not percentages. Be sure they make sense (also in respect to "h7j~ubh)r}r(h6X*$QueueSize*h<}r(h>]h?]h@]hA]hC]uh7j~h1]rhOX$QueueSizerr}r(h6Uh7jubah:hubhOX"), as rsyslodg does currently not perform any checks on the numbers provided. It is easy to screw up the system here (yes, a feature enhancement request is filed ;)).rr}r(h6X\ "), as rsyslodg does currently not perform any checks on the numbers provided. It is easy to screw up the system here (yes, a feature enhancement request is filed ;)).h7j~ubeubeubeubeubh3)r}r(h6Uh7h4h8h9h:h;h<}r(h>]h?]h@]hA]rh-ahC]rhauhEMhFhh1]r(hH)r}r(h6XLimiting the Queue Sizerh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXLimiting the Queue Sizerr}r(h6jh7jubaubhS)r}r(h6XAll queues, including disk queues, have a limit of the number of elements they can enqueue. This is set via the "*$QueueSize*\ " config parameter. Note that the size is specified in number of enqueued elements, not their actual memory size. Memory size limits can not be set. A conservative assumption is that a single syslog messages takes up 512 bytes on average (in-memory, NOT on the wire, this \*is\* a difference).h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOXqAll queues, including disk queues, have a limit of the number of elements they can enqueue. This is set via the "rr}r(h6XqAll queues, including disk queues, have a limit of the number of elements they can enqueue. This is set via the "h7jubh)r}r(h6X*$QueueSize*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueSizerr}r(h6Uh7jubah:hubhOX#" config parameter. Note that the size is specified in number of enqueued elements, not their actual memory size. Memory size limits can not be set. A conservative assumption is that a single syslog messages takes up 512 bytes on average (in-memory, NOT on the wire, this *is* a difference).rr}r(h6X'\ " config parameter. Note that the size is specified in number of enqueued elements, not their actual memory size. Memory size limits can not be set. A conservative assumption is that a single syslog messages takes up 512 bytes on average (in-memory, NOT on the wire, this \*is\* a difference).h7jubeubhS)r}r(h6XDisk assisted queues are special in that they do **not** have any size limit. The enqueue an unlimited amount of elements. To prevent running out of space, disk and disk-assisted queues can be size-limited via the "*$QueueMaxDiskSpace*\ " configuration parameter. If it is not set, the limit is only available free space (and reaching this limit is currently not very gracefully handled, so avoid running into it!). If a limit is set, the queue can not grow larger than it. Note, however, that the limit is approximate. The engine always writes complete records. As such, it is possible that slightly more than the set limit is used (usually less than 1k, given the average message size). Keeping strictly on the limit would be a performance hurt, and thus the design decision was to favour performance. If you don't like that policy, simply specify a slightly lower limit (e.g. 999,999K instead of 1G).h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOX1Disk assisted queues are special in that they do rr}r(h6X1Disk assisted queues are special in that they do h7jubj)r}r(h6X**not**h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOXnotrr}r(h6Uh7jubah:j'ubhOX have any size limit. The enqueue an unlimited amount of elements. To prevent running out of space, disk and disk-assisted queues can be size-limited via the "rr}r(h6X have any size limit. The enqueue an unlimited amount of elements. To prevent running out of space, disk and disk-assisted queues can be size-limited via the "h7jubh)r}r(h6X*$QueueMaxDiskSpace*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueMaxDiskSpacerr}r(h6Uh7jubah:hubhOX" configuration parameter. If it is not set, the limit is only available free space (and reaching this limit is currently not very gracefully handled, so avoid running into it!). If a limit is set, the queue can not grow larger than it. Note, however, that the limit is approximate. The engine always writes complete records. As such, it is possible that slightly more than the set limit is used (usually less than 1k, given the average message size). Keeping strictly on the limit would be a performance hurt, and thus the design decision was to favour performance. If you don't like that policy, simply specify a slightly lower limit (e.g. 999,999K instead of 1G).rr}r(h6X\ " configuration parameter. If it is not set, the limit is only available free space (and reaching this limit is currently not very gracefully handled, so avoid running into it!). If a limit is set, the queue can not grow larger than it. Note, however, that the limit is approximate. The engine always writes complete records. As such, it is possible that slightly more than the set limit is used (usually less than 1k, given the average message size). Keeping strictly on the limit would be a performance hurt, and thus the design decision was to favour performance. If you don't like that policy, simply specify a slightly lower limit (e.g. 999,999K instead of 1G).h7jubeubhS)r}r(h6XIn general, it is a good idea to limit the physical disk space even if you dedicate a whole disk to rsyslog. That way, you prevent it from running out of space (future version will have an auto-size-limit logic, that then kicks in in such situations).rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEM,hFhh1]rhOXIn general, it is a good idea to limit the physical disk space even if you dedicate a whole disk to rsyslog. That way, you prevent it from running out of space (future version will have an auto-size-limit logic, that then kicks in in such situations).rr}r(h6jh7jubaubeubh3)r}r(h6Uh7h4h8h9h:h;h<}r(h>]h?]h@]hA]rh.ahC]rhauhEM2hFhh1]r(hH)r}r(h6XWorker Thread Poolsrh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEM2hFhh1]rhOXWorker Thread Poolsrr}r(h6jh7jubaubhS)r}r(h6XGEach queue (except in "direct" mode) has an associated pool of worker threads. Worker threads carry out the action to be performed on the data elements enqueued. As an actual sample, the main message queue's worker task is to apply filter logic to each incoming message and enqueue them to the relevant output queues (actions).rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEM4hFhh1]rhOXGEach queue (except in "direct" mode) has an associated pool of worker threads. Worker threads carry out the action to be performed on the data elements enqueued. As an actual sample, the main message queue's worker task is to apply filter logic to each incoming message and enqueue them to the relevant output queues (actions).rr}r(h6jh7jubaubhS)r}r(h6X#Worker threads are started and stopped on an as-needed basis. On a system without activity, there may be no worker at all running. One is automatically started when a message comes in. Similarly, additional workers are started if the queue grows above a specific size. The "*$QueueWorkerThreadMinimumMessages*\ "  config parameter controls worker startup. If it is set to the minimum number of elements that must be enqueued in order to justify a new worker startup. For example, let's assume it is set to 100. As long as no more than 100 messages are in the queue, a single worker will be used. When more than 100 messages arrive, a new worker thread is automatically started. Similarly, a third worker will be started when there are at least 300 messages, a forth when reaching 400 and so on.h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEM:hFhh1]r(hOXWorker threads are started and stopped on an as-needed basis. On a system without activity, there may be no worker at all running. One is automatically started when a message comes in. Similarly, additional workers are started if the queue grows above a specific size. The "rr}r(h6XWorker threads are started and stopped on an as-needed basis. On a system without activity, there may be no worker at all running. One is automatically started when a message comes in. Similarly, additional workers are started if the queue grows above a specific size. The "h7jubh)r}r(h6X+*$QueueWorkerThreadMinimumMessages*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX)$QueueWorkerThreadMinimumMessagesrr}r(h6Uh7jubah:hubhOX"  config parameter controls worker startup. If it is set to the minimum number of elements that must be enqueued in order to justify a new worker startup. For example, let's assume it is set to 100. As long as no more than 100 messages are in the queue, a single worker will be used. When more than 100 messages arrive, a new worker thread is automatically started. Similarly, a third worker will be started when there are at least 300 messages, a forth when reaching 400 and so on.r r }r (h6X\ "  config parameter controls worker startup. If it is set to the minimum number of elements that must be enqueued in order to justify a new worker startup. For example, let's assume it is set to 100. As long as no more than 100 messages are in the queue, a single worker will be used. When more than 100 messages arrive, a new worker thread is automatically started. Similarly, a third worker will be started when there are at least 300 messages, a forth when reaching 400 and so on.h7jubeubhS)r }r (h6XIt, however, does not make sense to have too many worker threads running in parallel. Thus, the upper limit can be set via "*$QueueWorkerThreads*\ ". If it, for example, is set to four, no more than four workers will ever be started, no matter how many elements are enqueued.h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMGhFhh1]r(hOX|It, however, does not make sense to have too many worker threads running in parallel. Thus, the upper limit can be set via "rr}r(h6X|It, however, does not make sense to have too many worker threads running in parallel. Thus, the upper limit can be set via "h7j ubh)r}r(h6X*$QueueWorkerThreads*h<}r(h>]h?]h@]hA]hC]uh7j h1]rhOX$QueueWorkerThreadsrr}r(h6Uh7jubah:hubhOX". If it, for example, is set to four, no more than four workers will ever be started, no matter how many elements are enqueued.rr}r(h6X\ ". If it, for example, is set to four, no more than four workers will ever be started, no matter how many elements are enqueued.h7j ubeubhS)r}r(h6XWorker threads that have been started are kept running until an inactivity timeout happens. The timeout can be set via "*$QueueWorkerTimeoutThreadShutdown*\ " and is specified in milliseconds. If you do not like to keep the workers running, simply set it to 0, which means immediate timeout and thus immediate shutdown. But consider that creating threads involves some overhead, and this is why we keep them running. If you would like to never shutdown any worker threads, specify -1 for this parameter.h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMMhFhh1]r (hOXxWorker threads that have been started are kept running until an inactivity timeout happens. The timeout can be set via "r!r"}r#(h6XxWorker threads that have been started are kept running until an inactivity timeout happens. The timeout can be set via "h7jubh)r$}r%(h6X+*$QueueWorkerTimeoutThreadShutdown*h<}r&(h>]h?]h@]hA]hC]uh7jh1]r'hOX)$QueueWorkerTimeoutThreadShutdownr(r)}r*(h6Uh7j$ubah:hubhOXZ" and is specified in milliseconds. If you do not like to keep the workers running, simply set it to 0, which means immediate timeout and thus immediate shutdown. But consider that creating threads involves some overhead, and this is why we keep them running. If you would like to never shutdown any worker threads, specify -1 for this parameter.r+r,}r-(h6X\\ " and is specified in milliseconds. If you do not like to keep the workers running, simply set it to 0, which means immediate timeout and thus immediate shutdown. But consider that creating threads involves some overhead, and this is why we keep them running. If you would like to never shutdown any worker threads, specify -1 for this parameter.h7jubeubh3)r.}r/(h6Uh7jh8h9h:h;h<}r0(h>]h?]h@]hA]r1h/ahC]r2hauhEMWhFhh1]r3(hH)r4}r5(h6XDiscarding Messagesr6h7j.h8h9h:hLh<}r7(h>]h?]h@]hA]hC]uhEMWhFhh1]r8hOXDiscarding Messagesr9r:}r;(h6j6h7j4ubaubhS)r<}r=(h6XIf the queue reaches the so called "discard watermark" (a number of queued elements), less important messages can automatically be discarded. This is in an effort to save queue space for more important messages, which you even less like to lose. Please note that whenever there are more than "discard watermark" messages, both newly incoming as well as already enqueued low-priority messages are discarded. The algorithm discards messages newly coming in and those at the front of the queue.r>h7j.h8h9h:hWh<}r?(h>]h?]h@]hA]hC]uhEMYhFhh1]r@hOXIf the queue reaches the so called "discard watermark" (a number of queued elements), less important messages can automatically be discarded. This is in an effort to save queue space for more important messages, which you even less like to lose. Please note that whenever there are more than "discard watermark" messages, both newly incoming as well as already enqueued low-priority messages are discarded. The algorithm discards messages newly coming in and those at the front of the queue.rArB}rC(h6j>h7j<ubaubhS)rD}rE(h6X The discard watermark is a last resort setting. It should be set sufficiently high, but low enough to allow for large message burst. Please note that it take effect immediately and thus shows effect promptly - but that doesn't help if the burst mainly consist of high-priority messages...rFh7j.h8h9h:hWh<}rG(h>]h?]h@]hA]hC]uhEMbhFhh1]rHhOX The discard watermark is a last resort setting. It should be set sufficiently high, but low enough to allow for large message burst. Please note that it take effect immediately and thus shows effect promptly - but that doesn't help if the burst mainly consist of high-priority messages...rIrJ}rK(h6jFh7jDubaubhS)rL}rM(h6X_The discard watermark is set via the "*$QueueDiscardMark*\ " directive. The priority of messages to be discarded is set via "*$QueueDiscardSeverity*\ ". This directive accepts both the usual textual severity as well as a numerical one. To understand it, you must be aware of the numerical severity values. They are defined in RFC 3164:h7j.h8h9h:hWh<}rN(h>]h?]h@]hA]hC]uhEMhhFhh1]rO(hOX&The discard watermark is set via the "rPrQ}rR(h6X&The discard watermark is set via the "h7jLubh)rS}rT(h6X*$QueueDiscardMark*h<}rU(h>]h?]h@]hA]hC]uh7jLh1]rVhOX$QueueDiscardMarkrWrX}rY(h6Uh7jSubah:hubhOXB" directive. The priority of messages to be discarded is set via "rZr[}r\(h6XD\ " directive. The priority of messages to be discarded is set via "h7jLubh)r]}r^(h6X*$QueueDiscardSeverity*h<}r_(h>]h?]h@]hA]hC]uh7jLh1]r`hOX$QueueDiscardSeverityrarb}rc(h6Uh7j]ubah:hubhOX". This directive accepts both the usual textual severity as well as a numerical one. To understand it, you must be aware of the numerical severity values. They are defined in RFC 3164:rdre}rf(h6X\ ". This directive accepts both the usual textual severity as well as a numerical one. To understand it, you must be aware of the numerical severity values. They are defined in RFC 3164:h7jLubeubcdocutils.nodes block_quote rg)rh}ri(h6Uh7j.h8h9h:U block_quoterjh<}rk(h>]h?]h@]hA]hC]uhENhFhh1]rlcdocutils.nodes table rm)rn}ro(h6Uh<}rp(h>]h?]h@]hA]hC]uh7jhh1]rqcdocutils.nodes tgroup rr)rs}rt(h6Uh<}ru(hA]h@]h>]h?]hC]UcolsKuh7jnh1]rv(cdocutils.nodes colspec rw)rx}ry(h6Uh<}rz(hA]h@]h>]h?]hC]UcolwidthKuh7jsh1]h:Ucolspecr{ubjw)r|}r}(h6Uh<}r~(hA]h@]h>]h?]hC]UcolwidthK(uh7jsh1]h:j{ubcdocutils.nodes thead r)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jsh1]rcdocutils.nodes row r)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(cdocutils.nodes entry r)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6XCoderh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMph1]rhOXCoderr}r(h6jh7jubaubah:Uentryrubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6XSeverityrh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMph1]rhOXSeverityrr}r(h6jh7jubaubah:jubeh:Urowrubah:Utheadrubcdocutils.nodes tbody r)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jsh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X0h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMrh1]rhOX0r}r(h6X0h7jubaubah:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6XEmergency: system is unusablerh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMrh1]rhOXEmergency: system is unusablerr}r(h6jh7jubaubah:jubeh:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X1h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMsh1]rhOX1r}r(h6X1h7jubaubah:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X'Alert: action must be taken immediatelyrh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMsh1]rhOX'Alert: action must be taken immediatelyrr}r(h6jh7jubaubah:jubeh:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X2h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMth1]rhOX2r}r(h6X2h7jubaubah:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6XCritical: critical conditionsrh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMth1]rhOXCritical: critical conditionsrr}r(h6jh7jubaubah:jubeh:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X3h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMuh1]rhOX3r}r(h6X3h7jubaubah:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r hS)r }r (h6XError: error conditionsr h7jh8h9h:hWh<}r (h>]h?]h@]hA]hC]uhEMuh1]rhOXError: error conditionsrr}r(h6j h7j ubaubah:jubeh:jubj)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]r(j)r}r(h6Uh<}r(h>]h?]h@]hA]hC]uh7jh1]rhS)r}r(h6X4h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMvh1]rhOX4r}r(h6X4h7jubaubah:jubj)r }r!(h6Uh<}r"(h>]h?]h@]hA]hC]uh7jh1]r#hS)r$}r%(h6XWarning: warning conditionsr&h7j h8h9h:hWh<}r'(h>]h?]h@]hA]hC]uhEMvh1]r(hOXWarning: warning conditionsr)r*}r+(h6j&h7j$ubaubah:jubeh:jubj)r,}r-(h6Uh<}r.(h>]h?]h@]hA]hC]uh7jh1]r/(j)r0}r1(h6Uh<}r2(h>]h?]h@]hA]hC]uh7j,h1]r3hS)r4}r5(h6X5h7j0h8h9h:hWh<}r6(h>]h?]h@]hA]hC]uhEMwh1]r7hOX5r8}r9(h6X5h7j4ubaubah:jubj)r:}r;(h6Uh<}r<(h>]h?]h@]hA]hC]uh7j,h1]r=hS)r>}r?(h6X(Notice: normal but significant conditionr@h7j:h8h9h:hWh<}rA(h>]h?]h@]hA]hC]uhEMwh1]rBhOX(Notice: normal but significant conditionrCrD}rE(h6j@h7j>ubaubah:jubeh:jubj)rF}rG(h6Uh<}rH(h>]h?]h@]hA]hC]uh7jh1]rI(j)rJ}rK(h6Uh<}rL(h>]h?]h@]hA]hC]uh7jFh1]rMhS)rN}rO(h6X6h7jJh8h9h:hWh<}rP(h>]h?]h@]hA]hC]uhEMxh1]rQhOX6rR}rS(h6X6h7jNubaubah:jubj)rT}rU(h6Uh<}rV(h>]h?]h@]hA]hC]uh7jFh1]rWhS)rX}rY(h6X%Informational: informational messagesrZh7jTh8h9h:hWh<}r[(h>]h?]h@]hA]hC]uhEMxh1]r\hOX%Informational: informational messagesr]r^}r_(h6jZh7jXubaubah:jubeh:jubj)r`}ra(h6Uh<}rb(h>]h?]h@]hA]hC]uh7jh1]rc(j)rd}re(h6Uh<}rf(h>]h?]h@]hA]hC]uh7j`h1]rghS)rh}ri(h6X7h7jdh8h9h:hWh<}rj(h>]h?]h@]hA]hC]uhEMyh1]rkhOX7rl}rm(h6X7h7jhubaubah:jubj)rn}ro(h6Uh<}rp(h>]h?]h@]hA]hC]uh7j`h1]rqhS)rr}rs(h6XDebug: debug-level messagesrth7jnh8h9h:hWh<}ru(h>]h?]h@]hA]hC]uhEMyh1]rvhOXDebug: debug-level messagesrwrx}ry(h6jth7jrubaubah:jubeh:jubeh:Utbodyrzubeh:Utgroupr{ubah:Utabler|ubaubhS)r}}r~(h6XAnything of the specified severity and (numerically) above it is discarded. To turn message discarding off, simply specify the discard watermark to be higher than the queue size. An alternative is to specify the numerical value 8 as DiscardSeverity. This is also the default setting to prevent unintentional message loss. So if you would like to use message discarding, you need to set" *$QueueDiscardSeverity*" to an actual value.h7j.h8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEM|hFhh1]r(hOXAnything of the specified severity and (numerically) above it is discarded. To turn message discarding off, simply specify the discard watermark to be higher than the queue size. An alternative is to specify the numerical value 8 as DiscardSeverity. This is also the default setting to prevent unintentional message loss. So if you would like to use message discarding, you need to set" rr}r(h6XAnything of the specified severity and (numerically) above it is discarded. To turn message discarding off, simply specify the discard watermark to be higher than the queue size. An alternative is to specify the numerical value 8 as DiscardSeverity. This is also the default setting to prevent unintentional message loss. So if you would like to use message discarding, you need to set" h7j}ubh)r}r(h6X*$QueueDiscardSeverity*h<}r(h>]h?]h@]hA]hC]uh7j}h1]rhOX$QueueDiscardSeverityrr}r(h6Uh7jubah:hubhOX" to an actual value.rr}r(h6X" to an actual value.h7j}ubeubhS)r}r(h6XrAn interesting application is with disk-assisted queues: if the discard watermark is set lower than the high watermark, message discarding will start before the queue becomes disk-assisted. This may be a good thing if you would like to switch to disk-assisted mode only in cases where it is absolutely unavoidable and you prefer to discard less important messages first.rh7j.h8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXrAn interesting application is with disk-assisted queues: if the discard watermark is set lower than the high watermark, message discarding will start before the queue becomes disk-assisted. This may be a good thing if you would like to switch to disk-assisted mode only in cases where it is absolutely unavoidable and you prefer to discard less important messages first.rr}r(h6jh7jubaubeubeubh3)r}r(h6Uh7h4h8h9h:h;h<}r(h>]h?]h@]hA]rh&ahC]rh auhEMhFhh1]r(hH)r}r(h6XFilled-Up Queuesrh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXFilled-Up Queuesrr}r(h6jh7jubaubhS)r}r(h6X=If the queue has either reached its configured maximum number of entries or disk space, it is finally full. If so, rsyslogd throttles the data element submitter. If that, for example, is a reliable input (TCP, local log socket), that will slow down the message originator which is a good resolution for this scenario.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOX=If the queue has either reached its configured maximum number of entries or disk space, it is finally full. If so, rsyslogd throttles the data element submitter. If that, for example, is a reliable input (TCP, local log socket), that will slow down the message originator which is a good resolution for this scenario.rr}r(h6jh7jubaubhS)r}r(h6XDuring throttling, a disk-assisted queue continues to write to disk and messages are also discarded based on severity as well as regular dequeuing and processing continues. So chances are good the situation will be resolved by simply throttling. Note, though, that throttling is highly undesirable for unreliable sources, like UDP message reception. So it is not a good thing to run into throttling mode at all.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXDuring throttling, a disk-assisted queue continues to write to disk and messages are also discarded based on severity as well as regular dequeuing and processing continues. So chances are good the situation will be resolved by simply throttling. Note, though, that throttling is highly undesirable for unreliable sources, like UDP message reception. So it is not a good thing to run into throttling mode at all.rr}r(h6jh7jubaubhS)r}r(h6XWe can not hold processing infinitely, not even when throttling. For example, throttling the local log socket too long would cause the system at whole come to a standstill. To prevent this, rsyslogd times out after a configured period ("*$QueueTimeoutEnqueue*\ ", specified in milliseconds) if no space becomes available. As a last resort, it then discards the newly arrived message.h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOXWe can not hold processing infinitely, not even when throttling. For example, throttling the local log socket too long would cause the system at whole come to a standstill. To prevent this, rsyslogd times out after a configured period ("rr}r(h6XWe can not hold processing infinitely, not even when throttling. For example, throttling the local log socket too long would cause the system at whole come to a standstill. To prevent this, rsyslogd times out after a configured period ("h7jubh)r}r(h6X*$QueueTimeoutEnqueue*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueTimeoutEnqueuerr}r(h6Uh7jubah:hubhOXz", specified in milliseconds) if no space becomes available. As a last resort, it then discards the newly arrived message.rr}r(h6X|\ ", specified in milliseconds) if no space becomes available. As a last resort, it then discards the newly arrived message.h7jubeubhS)r}r(h6XBIf you do not like throttling, set the timeout to 0 - the message will then immediately be discarded. If you use a high timeout, be sure you know what you do. If a high main message queue enqueue timeout is set, it can lead to something like a complete hang of the system. The same problem does not apply to action queues.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXBIf you do not like throttling, set the timeout to 0 - the message will then immediately be discarded. If you use a high timeout, be sure you know what you do. If a high main message queue enqueue timeout is set, it can lead to something like a complete hang of the system. The same problem does not apply to action queues.rr}r(h6jh7jubaubh3)r}r(h6Uh7jh8h9h:h;h<}r(h>]h?]h@]hA]rh"ahC]rhauhEMhFhh1]r(hH)r}r(h6X Rate Limitingrh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOX Rate Limitingrr}r(h6jh7jubaubhS)r}r(h6XRate limiting provides a way to prevent rsyslogd from processing things too fast. It can, for example, prevent overrunning a receiver system.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXRate limiting provides a way to prevent rsyslogd from processing things too fast. It can, for example, prevent overrunning a receiver system.rr}r(h6jh7jubaubhS)r}r(h6XCurrently, there are only limited rate-limiting features available. The "*$QueueDequeueSlowdown*\ "  directive allows to specify how long (in microseconds) dequeueing should be delayed. While simple, it still is powerful. For example, using a DequeueSlowdown delay of 1,000 microseconds on a UDP send action ensures that no more than 1,000 messages can be sent within a second (actually less, as there is also some time needed for the processing itself).h7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOXICurrently, there are only limited rate-limiting features available. The "rr}r(h6XICurrently, there are only limited rate-limiting features available. The "h7jubh)r}r(h6X*$QueueDequeueSlowdown*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueDequeueSlowdownrr}r(h6Uh7jubah:hubhOXe"  directive allows to specify how long (in microseconds) dequeueing should be delayed. While simple, it still is powerful. For example, using a DequeueSlowdown delay of 1,000 microseconds on a UDP send action ensures that no more than 1,000 messages can be sent within a second (actually less, as there is also some time needed for the processing itself).rr}r(h6Xg\ "  directive allows to specify how long (in microseconds) dequeueing should be delayed. While simple, it still is powerful. For example, using a DequeueSlowdown delay of 1,000 microseconds on a UDP send action ensures that no more than 1,000 messages can be sent within a second (actually less, as there is also some time needed for the processing itself).h7jubeubeubh3)r}r(h6Uh7jh8h9h:h;h<}r(h>]h?]h@]hA]rh!ahC]rhauhEMhFhh1]r(hH)r}r(h6XProcessing Timeframesrh7jh8h9h:hLh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXProcessing Timeframesrr}r(h6jh7jubaubhS)r}r(h6XQueues can be set to dequeue (process) messages only during certain timeframes. This is useful if you, for example, would like to transfer the bulk of messages only during off-peak hours, e.g. when you have only limited bandwidth on the network path the the central server.rh7jh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]rhOXQueues can be set to dequeue (process) messages only during certain timeframes. This is useful if you, for example, would like to transfer the bulk of messages only during off-peak hours, e.g. when you have only limited bandwidth on the network path the the central server.rr}r (h6jh7jubaubhS)r }r (h6XCurrently, only a single timeframe is supported and, even worse, it can only be specified by the hour. It is not hard to extend rsyslog's capabilities in this regard - it was just not requested so far. So if you need more fine-grained control, let us know and we'll probably implement it. There are two configuration directives, both should be used together or results are unpredictable:" *$QueueDequeueTimeBegin *" and "*$QueueDequeueTimeEnd *\ ". The hour parameter must be specified in 24-hour format (so 10pm is 22). A use case for this parameter can be found in the `rsyslog wiki `_.h7jh8h9h:hWh<}r (h>]h?]h@]hA]hC]uhEMhFhh1]r (hOXCurrently, only a single timeframe is supported and, even worse, it can only be specified by the hour. It is not hard to extend rsyslog's capabilities in this regard - it was just not requested so far. So if you need more fine-grained control, let us know and we'll probably implement it. There are two configuration directives, both should be used together or results are unpredictable:" rr}r(h6XCurrently, only a single timeframe is supported and, even worse, it can only be specified by the hour. It is not hard to extend rsyslog's capabilities in this regard - it was just not requested so far. So if you need more fine-grained control, let us know and we'll probably implement it. There are two configuration directives, both should be used together or results are unpredictable:" h7j ubh)r}r(h6X'*$QueueDequeueTimeBegin *h<}r(h>]h?]h@]hA]hC]uh7j h1]rhOX%$QueueDequeueTimeBegin rr}r(h6Uh7jubah:hubhOX" and "rr}r(h6X" and "h7j ubh)r}r(h6X%*$QueueDequeueTimeEnd *h<}r(h>]h?]h@]hA]hC]uh7j h1]rhOX#$QueueDequeueTimeEnd rr }r!(h6Uh7jubah:hubhOX}". The hour parameter must be specified in 24-hour format (so 10pm is 22). A use case for this parameter can be found in the r"r#}r$(h6X\ ". The hour parameter must be specified in 24-hour format (so 10pm is 22). A use case for this parameter can be found in the h7j ubjX)r%}r&(h6X@`rsyslog wiki `_h<}r'(UnameX rsyslog wikij\X.http://wiki.rsyslog.com/index.php/OffPeakHoursr(hA]h@]h>]h?]hC]uh7j h1]r)hOX rsyslog wikir*r+}r,(h6Uh7j%ubah:jbubjc)r-}r.(h6X1 jfKh7j h:jgh<}r/(Urefurij(hA]r0h+ah@]h>]h?]hC]r1hauh1]ubhOX.r2}r3(h6X.h7j ubeubeubh3)r4}r5(h6Uh7jh8h9h:h;h<}r6(h>]h?]h@]hA]r7h)ahC]r8hauhEMhFhh1]r9(hH)r:}r;(h6X Performancer<h7j4h8h9h:hLh<}r=(h>]h?]h@]hA]hC]uhEMhFhh1]r>hOX Performancer?r@}rA(h6j<h7j:ubaubhS)rB}rC(h6XThe locking involved with maintaining the queue has a potentially large performance impact. How large this is, and if it exists at all, depends much on the configuration and actual use case. However, the queue is able to work on so-called "batches" when dequeueing data elements. With batches, multiple data elements are dequeued at once (with a single locking call). The queue dequeues all available elements up to a configured upper limit (*DequeueBatchSize *). It is important to note that the actual upper limit is dictated by availability. The queue engine will never wait for a batch to fill. So even if a high upper limit is configured, batches may consist of fewer elements, even just one, if there are no more elements waiting in the queue.h7j4h8h9h:hWh<}rD(h>]h?]h@]hA]hC]uhEMhFhh1]rE(hOXThe locking involved with maintaining the queue has a potentially large performance impact. How large this is, and if it exists at all, depends much on the configuration and actual use case. However, the queue is able to work on so-called "batches" when dequeueing data elements. With batches, multiple data elements are dequeued at once (with a single locking call). The queue dequeues all available elements up to a configured upper limit (rFrG}rH(h6XThe locking involved with maintaining the queue has a potentially large performance impact. How large this is, and if it exists at all, depends much on the configuration and actual use case. However, the queue is able to work on so-called "batches" when dequeueing data elements. With batches, multiple data elements are dequeued at once (with a single locking call). The queue dequeues all available elements up to a configured upper limit (h7jBubh)rI}rJ(h6X#*DequeueBatchSize *h<}rK(h>]h?]h@]hA]hC]uh7jBh1]rLhOX!DequeueBatchSize rMrN}rO(h6Uh7jIubah:hubhOX ). It is important to note that the actual upper limit is dictated by availability. The queue engine will never wait for a batch to fill. So even if a high upper limit is configured, batches may consist of fewer elements, even just one, if there are no more elements waiting in the queue.rPrQ}rR(h6X ). It is important to note that the actual upper limit is dictated by availability. The queue engine will never wait for a batch to fill. So even if a high upper limit is configured, batches may consist of fewer elements, even just one, if there are no more elements waiting in the queue.h7jBubeubhS)rS}rT(h6X,Batching can improve performance considerably. Note, however, that it affects the order in which messages are passed to the queue worker threads, as each worker now receive as batch of messages. Also, the larger the batch size and the higher the maximum number of permitted worker threads, the more main memory is needed. For a busy server, large batch sizes (around 1,000 or even more elements) may be useful. Please note that with batching, the main memory must hold BatchSize \* NumOfWorkers objects in memory (worst-case scenario), even if running in disk-only mode. So if you use the default 5 workers at the main message queue and set the batch size to 1,000, you need to be prepared that the main message queue holds up to 5,000 messages in main memory **in addition** to the configured queue size limits!h7j4h8h9h:hWh<}rU(h>]h?]h@]hA]hC]uhEMhFhh1]rV(hOXBatching can improve performance considerably. Note, however, that it affects the order in which messages are passed to the queue worker threads, as each worker now receive as batch of messages. Also, the larger the batch size and the higher the maximum number of permitted worker threads, the more main memory is needed. For a busy server, large batch sizes (around 1,000 or even more elements) may be useful. Please note that with batching, the main memory must hold BatchSize * NumOfWorkers objects in memory (worst-case scenario), even if running in disk-only mode. So if you use the default 5 workers at the main message queue and set the batch size to 1,000, you need to be prepared that the main message queue holds up to 5,000 messages in main memory rWrX}rY(h6XBatching can improve performance considerably. Note, however, that it affects the order in which messages are passed to the queue worker threads, as each worker now receive as batch of messages. Also, the larger the batch size and the higher the maximum number of permitted worker threads, the more main memory is needed. For a busy server, large batch sizes (around 1,000 or even more elements) may be useful. Please note that with batching, the main memory must hold BatchSize \* NumOfWorkers objects in memory (worst-case scenario), even if running in disk-only mode. So if you use the default 5 workers at the main message queue and set the batch size to 1,000, you need to be prepared that the main message queue holds up to 5,000 messages in main memory h7jSubj)rZ}r[(h6X**in addition**h<}r\(h>]h?]h@]hA]hC]uh7jSh1]r]hOX in additionr^r_}r`(h6Uh7jZubah:j'ubhOX% to the configured queue size limits!rarb}rc(h6X% to the configured queue size limits!h7jSubeubhS)rd}re(h6XThe queue object's default maximum batch size is eight, but there exists different defaults for the actual parts of rsyslog processing that utilize queues. So you need to check these object's defaults.rfh7j4h8h9h:hWh<}rg(h>]h?]h@]hA]hC]uhEMhFhh1]rhhOXThe queue object's default maximum batch size is eight, but there exists different defaults for the actual parts of rsyslog processing that utilize queues. So you need to check these object's defaults.rirj}rk(h6jfh7jdubaubeubh3)rl}rm(h6Uh7jh8h9h:h;h<}rn(h>]h?]h@]hA]roh#ahC]rph auhEMhFhh1]rq(hH)rr}rs(h6XTerminating Queuesrth7jlh8h9h:hLh<}ru(h>]h?]h@]hA]hC]uhEMhFhh1]rvhOXTerminating Queuesrwrx}ry(h6jth7jrubaubhS)rz}r{(h6XTerminating a process sounds easy, but can be complex. Terminating a running queue is in fact the most complex operation a queue object can perform. You don't see that from a user's point of view, but its quite hard work for the developer to do everything in the right order.r|h7jlh8h9h:hWh<}r}(h>]h?]h@]hA]hC]uhEMhFhh1]r~hOXTerminating a process sounds easy, but can be complex. Terminating a running queue is in fact the most complex operation a queue object can perform. You don't see that from a user's point of view, but its quite hard work for the developer to do everything in the right order.rr}r(h6j|h7jzubaubhS)r}r(h6XHThe complexity arises when the queue has still data enqueued when it finishes. Rsyslog tries to preserve as much of it as possible. As a first measure, there is a regular queue time out ("*$QueueTimeoutShutdown*\ ", specified in milliseconds): the queue workers are given that time period to finish processing the queue.h7jlh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOXThe complexity arises when the queue has still data enqueued when it finishes. Rsyslog tries to preserve as much of it as possible. As a first measure, there is a regular queue time out ("rr}r(h6XThe complexity arises when the queue has still data enqueued when it finishes. Rsyslog tries to preserve as much of it as possible. As a first measure, there is a regular queue time out ("h7jubh)r}r(h6X*$QueueTimeoutShutdown*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueTimeoutShutdownrr}r(h6Uh7jubah:hubhOXk", specified in milliseconds): the queue workers are given that time period to finish processing the queue.rr}r(h6Xm\ ", specified in milliseconds): the queue workers are given that time period to finish processing the queue.h7jubeubhS)r}r(h6XIf after that period there is still data in the queue, workers are instructed to finish the current data element and then terminate. This essentially means any other data is lost. There is another timeout ("*$QueueTimeoutActionCompletion*\ ", also specified in milliseconds) that specifies how long the workers have to finish the current element. If that timeout expires, any remaining workers are cancelled and the queue is brought down.h7jlh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOXIf after that period there is still data in the queue, workers are instructed to finish the current data element and then terminate. This essentially means any other data is lost. There is another timeout ("rr}r(h6XIf after that period there is still data in the queue, workers are instructed to finish the current data element and then terminate. This essentially means any other data is lost. There is another timeout ("h7jubh)r}r(h6X'*$QueueTimeoutActionCompletion*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX%$QueueTimeoutActionCompletionrr}r(h6Uh7jubah:hubhOX", also specified in milliseconds) that specifies how long the workers have to finish the current element. If that timeout expires, any remaining workers are cancelled and the queue is brought down.rr}r(h6X\ ", also specified in milliseconds) that specifies how long the workers have to finish the current element. If that timeout expires, any remaining workers are cancelled and the queue is brought down.h7jubeubhS)r}r(h6XIf you do not like to lose data on shutdown, the "*$QueueSaveOnShutdown*\ " parameter can be set to "on". This requires either a disk or disk-assisted queue. If set, rsyslogd ensures that any queue elements are saved to disk before it terminates. This includes data elements there were begun being processed by workers that needed to be cancelled due to too-long processing. For a large queue, this operation may be lengthy. No timeout applies to a required shutdown save.h7jlh8h9h:hWh<}r(h>]h?]h@]hA]hC]uhEMhFhh1]r(hOX2If you do not like to lose data on shutdown, the "rr}r(h6X2If you do not like to lose data on shutdown, the "h7jubh)r}r(h6X*$QueueSaveOnShutdown*h<}r(h>]h?]h@]hA]hC]uh7jh1]rhOX$QueueSaveOnShutdownrr}r(h6Uh7jubah:hubhOX" parameter can be set to "on". This requires either a disk or disk-assisted queue. If set, rsyslogd ensures that any queue elements are saved to disk before it terminates. This includes data elements there were begun being processed by workers that needed to be cancelled due to too-long processing. For a large queue, this operation may be lengthy. No timeout applies to a required shutdown save.rr}r(h6X\ " parameter can be set to "on". This requires either a disk or disk-assisted queue. If set, rsyslogd ensures that any queue elements are saved to disk before it terminates. This includes data elements there were begun being processed by workers that needed to be cancelled due to too-long processing. For a large queue, this operation may be lengthy. No timeout applies to a required shutdown save.h7jubeubeubeubeubah6UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhFhU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrjU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhLNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh9Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongr Uinput_encoding_error_handlerr jUauto_id_prefixr Uidr Udoctitle_xformr Ustrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(h*hh"jh#jlh/j.h%h4h+j-h(hh,j"h)j4h$jLh jh'jdh!jh&jh-jh.jh0j uUsubstitution_namesr}rh:hFh<}r(h>]hA]h@]Usourceh9h?]hC]uU footnotesr]rUrefidsr}rub.build/.doctrees/concepts/netstrm_drvr.doctree0000664000175000017500000001126113035122641020441 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xcurrent network stream driversqNXnetstream driversqNuUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hUcurrent-network-stream-driversqhUnetstream-driversquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX</home/rger/proj/rsyslog-doc/source/concepts/netstrm_drvr.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hXNetStream Driversq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1XNetStream Driversq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hXNetwork stream drivers are a layer between various parts of rsyslogd (e.g. the imtcp module) and the transport layer. They provide sequenced delivery, authentication and confidentiality to the upper layers. Drivers implement different capabilities.q8hhhhhU paragraphq9h}q:(h ]h!]h"]h#]h%]uh'Kh(hh]q;h1XNetwork stream drivers are a layer between various parts of rsyslogd (e.g. the imtcp module) and the transport layer. They provide sequenced delivery, authentication and confidentiality to the upper layers. Drivers implement different capabilities.q(hh8hh6ubaubh5)q?}q@(hXUsers need to know about netstream drivers because they need to configure the proper driver, and proper driver properties, to achieve desired results (e.g. a :doc:`../tutorials/tls`).hhhhhh9h}qA(h ]h!]h"]h#]h%]uh'K h(hh]qB(h1XUsers need to know about netstream drivers because they need to configure the proper driver, and proper driver properties, to achieve desired results (e.g. a qCqD}qE(hXUsers need to know about netstream drivers because they need to configure the proper driver, and proper driver properties, to achieve desired results (e.g. a hh?ubcsphinx.addnodes pending_xref qF)qG}qH(hX:doc:`../tutorials/tls`qIhh?hhhU pending_xrefqJh}qK(UreftypeXdocqLUrefwarnqMU reftargetqNX../tutorials/tlsU refdomainUh#]h"]U refexplicith ]h!]h%]UrefdocqOXconcepts/netstrm_drvrqPuh'K h]qQcdocutils.nodes literal qR)qS}qT(hhIh}qU(h ]h!]qV(UxrefqWhLeh"]h#]h%]uhhGh]qXh1X../tutorials/tlsqYqZ}q[(hUhhSubahUliteralq\ubaubh1X).q]q^}q_(hX).hh?ubeubh)q`}qa(hUhhhhhhh}qb(h ]h!]h"]h#]qchah%]qdhauh'Kh(hh]qe(h*)qf}qg(hXCurrent Network Stream Driversqhhh`hhhh.h}qi(h ]h!]h"]h#]h%]uh'Kh(hh]qjh1XCurrent Network Stream Driversqkql}qm(hhhhhfubaubcdocutils.nodes compound qn)qo}qp(hUhh`hhhUcompoundqqh}qr(h ]h!]qsUtoctree-wrapperqtah"]h#]h%]uh'Nh(hh]qucsphinx.addnodes toctree qv)qw}qx(hUhhohhhUtoctreeqyh}qz(Unumberedq{KU includehiddenq|hhPUcaptionq}NUglobq~h#]h"]U titlesonlyqh ]h!]h%]Uentriesq]q(NXconcepts/ns_ptcpqqNXconcepts/ns_gtlsqqeUhiddenqU includefilesq]q(hheUmaxdepthqKuh'Kh]ubaubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh(hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh.NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqňUtrim_footnote_reference_spaceqƉUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqʉU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactq؈U generatorqNUdump_internalsqNU smart_quotesqۉU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}q(hhhh`uUsubstitution_namesq}qhh(h}q(h ]h#]h"]Usourcehh!]h%]uU footnotesq]qUrefidsq}qub.build/.doctrees/concepts/ns_ptcp.doctree0000664000175000017500000000720513035122641017361 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXptcp network stream driverqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUptcp-network-stream-driverqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX7/home/rger/proj/rsyslog-doc/source/concepts/ns_ptcp.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXptcp Network Stream Driverq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/Xptcp Network Stream Driverq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXWThis network stream driver implement a plain tcp transport without security properties.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XWThis network stream driver implement a plain tcp transport without security properties.q:q;}q<(hh6hh4ubaubh3)q=}q>(hXSupported Driver Modesq?hhhhhh7h}q@(h]h]h ]h!]h#]uh%Kh&hh]qAh/XSupported Driver ModesqBqC}qD(hh?hh=ubaubcdocutils.nodes bullet_list qE)qF}qG(hUhhhhhU bullet_listqHh}qI(UbulletqJX-h!]h ]h]h]h#]uh%K h&hh]qKcdocutils.nodes list_item qL)qM}qN(hX0 - unencrypted trasmission hhFhhhU list_itemqOh}qP(h]h]h ]h!]h#]uh%Nh&hh]qQh3)qR}qS(hX0 - unencrypted trasmissionqThhMhhhh7h}qU(h]h]h ]h!]h#]uh%K h]qVh/X0 - unencrypted trasmissionqWqX}qY(hhThhRubaubaubaubh3)qZ}q[(hXSupported Authentication Modesq\hhhhhh7h}q](h]h]h ]h!]h#]uh%K h&hh]q^h/XSupported Authentication Modesq_q`}qa(hh\hhZubaubhE)qb}qc(hUhhhhhhHh}qd(hJX-h!]h ]h]h]h#]uh%K h&hh]qehL)qf}qg(hX"anon" - no authenticationqhhhbhhhhOh}qi(h]h]h ]h!]h#]uh%Nh&hh]qjh3)qk}ql(hhhhhfhhhh7h}qm(h]h]h ]h!]h#]uh%K h]qnh/X"anon" - no authenticationqoqp}qq(hhhhhkubaubaubaubeubahUU transformerqrNU footnote_refsqs}qtUrefnamesqu}qvUsymbol_footnotesqw]qxUautofootnote_refsqy]qzUsymbol_footnote_refsq{]q|U citationsq}]q~h&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqÉU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqˉUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqΈU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/concepts/multi_ruleset.doctree0000664000175000017500000013156513035122641020617 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X?why are rulesets important for different parser configurations?qNX-can i use a different ruleset as the default?qNX fewer filtersqNX&what does "to bind to a ruleset" mean?q NXsplit local and remote loggingq NXrainer gerhardsq Xrulesets and queuesq NXadisconq X8split local and remote logging for three different portsqNXwhat is a ruleset?qNXexamplesqNXrsyslogqXmultiple rulesets in rsyslogqNX performanceqNXsee alsoqNXpartitioning of input dataqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU>why-are-rulesets-important-for-different-parser-configurationsqhU,can-i-use-a-different-ruleset-as-the-defaultq hU fewer-filtersq!h U#what-does-to-bind-to-a-ruleset-meanq"h Usplit-local-and-remote-loggingq#h Urainer-gerhardsq$h Urulesets-and-queuesq%h Uadisconq&hU8split-local-and-remote-logging-for-three-different-portsq'hUwhat-is-a-rulesetq(hUexamplesq)hUrsyslogq*hUmultiple-rulesets-in-rsyslogq+hU performanceq,hUsee-alsoq-hUpartitioning-of-input-dataq.uUchildrenq/]q0cdocutils.nodes section q1)q2}q3(U rawsourceq4UUparentq5hUsourceq6X=/home/rger/proj/rsyslog-doc/source/concepts/multi_ruleset.rstq7Utagnameq8Usectionq9U attributesq:}q;(Udupnamesq<]Uclassesq=]Ubackrefsq>]Uidsq?]q@h+aUnamesqA]qBhauUlineqCKUdocumentqDhh/]qE(cdocutils.nodes title qF)qG}qH(h4XMultiple Rulesets in rsyslogqIh5h2h6h7h8UtitleqJh:}qK(h<]h=]h>]h?]hA]uhCKhDhh/]qLcdocutils.nodes Text qMXMultiple Rulesets in rsyslogqNqO}qP(h4hIh5hGubaubcdocutils.nodes paragraph qQ)qR}qS(h4XlStarting with version 4.5.0 and 5.1.1, `rsyslog `_ supports multiple rulesets within a single configuration. This is especially useful for routing the reception of remote messages to a set of specific rules. Note that the input module must support binding to non-standard rulesets, so the functionality may not be available with all inputs.h5h2h6h7h8U paragraphqTh:}qU(h<]h=]h>]h?]hA]uhCKhDhh/]qV(hMX'Starting with version 4.5.0 and 5.1.1, qWqX}qY(h4X'Starting with version 4.5.0 and 5.1.1, h5hRubcdocutils.nodes reference qZ)q[}q\(h4X#`rsyslog `_h:}q](UnamehUrefuriq^Xhttp://www.rsyslog.comq_h?]h>]h<]h=]hA]uh5hRh/]q`hMXrsyslogqaqb}qc(h4Uh5h[ubah8U referenceqdubcdocutils.nodes target qe)qf}qg(h4X U referencedqhKh5hRh8Utargetqih:}qj(Urefurih_h?]qkh*ah>]h<]h=]hA]qlhauh/]ubhMX" supports multiple rulesets within a single configuration. This is especially useful for routing the reception of remote messages to a set of specific rules. Note that the input module must support binding to non-standard rulesets, so the functionality may not be available with all inputs.qmqn}qo(h4X" supports multiple rulesets within a single configuration. This is especially useful for routing the reception of remote messages to a set of specific rules. Note that the input module must support binding to non-standard rulesets, so the functionality may not be available with all inputs.h5hRubeubhQ)qp}qq(h4XIn this document, I am using :doc:`imtcp <../configuration/modules/imtcp>`, an input module that supports binding to non-standard rulesets since rsyslog started to support them.h5h2h6h7h8hTh:}qr(h<]h=]h>]h?]hA]uhCK hDhh/]qs(hMXIn this document, I am using qtqu}qv(h4XIn this document, I am using h5hpubcsphinx.addnodes pending_xref qw)qx}qy(h4X-:doc:`imtcp <../configuration/modules/imtcp>`qzh5hph6h7h8U pending_xrefq{h:}q|(UreftypeXdocq}Urefwarnq~U reftargetqX../configuration/modules/imtcpU refdomainUh?]h>]U refexplicith<]h=]hA]UrefdocqXconcepts/multi_rulesetquhCK h/]qcdocutils.nodes literal q)q}q(h4hzh:}q(h<]h=]q(Uxrefqh}eh>]h?]hA]uh5hxh/]qhMXimtcpqq}q(h4Uh5hubah8UliteralqubaubhMXg, an input module that supports binding to non-standard rulesets since rsyslog started to support them.qq}q(h4Xg, an input module that supports binding to non-standard rulesets since rsyslog started to support them.h5hpubeubh1)q}q(h4Uh5h2h6h7h8h9h:}q(h<]h=]h>]h?]qh(ahA]qhauhCKhDhh/]q(hF)q}q(h4XWhat is a Ruleset?qh5hh6h7h8hJh:}q(h<]h=]h>]h?]hA]uhCKhDhh/]qhMXWhat is a Ruleset?qq}q(h4hh5hubaubhQ)q}q(h4XrIf you have worked with (r)syslog.conf, you know that it is made up of what I call rules (others tend to call them selectors, a sysklogd term). Each rule consist of a filter and one or more actions to be carried out when the filter evaluates to true. A filter may be as simple as a traditional syslog priority based filter (like "\*.\*" or "mail.info" or a as complex as a script-like expression. Details on that are covered in the config file documentation. After the filter come action specifiers, and an action is something that does something to a message, e.g. write it to a file or forward it to a remote logging server.h5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCKhDhh/]qhMXpIf you have worked with (r)syslog.conf, you know that it is made up of what I call rules (others tend to call them selectors, a sysklogd term). Each rule consist of a filter and one or more actions to be carried out when the filter evaluates to true. A filter may be as simple as a traditional syslog priority based filter (like "*.*" or "mail.info" or a as complex as a script-like expression. Details on that are covered in the config file documentation. After the filter come action specifiers, and an action is something that does something to a message, e.g. write it to a file or forward it to a remote logging server.qq}q(h4XrIf you have worked with (r)syslog.conf, you know that it is made up of what I call rules (others tend to call them selectors, a sysklogd term). Each rule consist of a filter and one or more actions to be carried out when the filter evaluates to true. A filter may be as simple as a traditional syslog priority based filter (like "\*.\*" or "mail.info" or a as complex as a script-like expression. Details on that are covered in the config file documentation. After the filter come action specifiers, and an action is something that does something to a message, e.g. write it to a file or forward it to a remote logging server.h5hubaubhQ)q}q(h4XA traditional configuration file is made up of one or more of these rules. When a new message arrives, its processing starts with the first rule (in order of appearance in rsyslog.conf) and continues for each rule until either all rules have been processed or a so-called "discard" action happens, in which case processing stops and the message is thrown away (what also happens after the last rule has been processed).qh5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCKhDhh/]qhMXA traditional configuration file is made up of one or more of these rules. When a new message arrives, its processing starts with the first rule (in order of appearance in rsyslog.conf) and continues for each rule until either all rules have been processed or a so-called "discard" action happens, in which case processing stops and the message is thrown away (what also happens after the last rule has been processed).qq}q(h4hh5hubaubhQ)q}q(h4XKThe **multi-ruleset** support now permits to specify more than one such rule sequence. You can think of a traditional config file just as a single default rule set, which is automatically bound to each of the inputs. This is even what actually happens. When rsyslog.conf is processed, the config file parser looks for the directiveh5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCK#hDhh/]q(hMXThe qq}q(h4XThe h5hubcdocutils.nodes strong q)q}q(h4X**multi-ruleset**h:}q(h<]h=]h>]h?]hA]uh5hh/]qhMX multi-rulesetqq}q(h4Uh5hubah8UstrongqubhMX6 support now permits to specify more than one such rule sequence. You can think of a traditional config file just as a single default rule set, which is automatically bound to each of the inputs. This is even what actually happens. When rsyslog.conf is processed, the config file parser looks for the directiveqq}q(h4X6 support now permits to specify more than one such rule sequence. You can think of a traditional config file just as a single default rule set, which is automatically bound to each of the inputs. This is even what actually happens. When rsyslog.conf is processed, the config file parser looks for the directiveh5hubeubcdocutils.nodes literal_block q)q}q(h4Xruleset(name="rulesetname");h5hh6h7h8U literal_blockqh:}q(U xml:spaceqUpreserveqh?]h>]h<]h=]hA]uhCK+hDhh/]qhMXruleset(name="rulesetname");qɅq}q(h4Uh5hubaubhQ)q}q(h4X?Where name is any name the user likes (but must not start with "RSYSLOG\_", which is the name space reserved for rsyslog use). If it finds this directive, it begins a new rule set (if the name was not yet know) or switches to an already-existing one (if the name was known). All rules defined between this $RuleSet directive and the next one are appended to the named ruleset. Note that the reserved name "RSYSLOG\_DefaultRuleset" is used to specify rsyslogd's default ruleset. You can use that name wherever you can use a ruleset name, including when binding an input to it.h5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCK-hDhh/]qhMX=Where name is any name the user likes (but must not start with "RSYSLOG_", which is the name space reserved for rsyslog use). If it finds this directive, it begins a new rule set (if the name was not yet know) or switches to an already-existing one (if the name was known). All rules defined between this $RuleSet directive and the next one are appended to the named ruleset. Note that the reserved name "RSYSLOG_DefaultRuleset" is used to specify rsyslogd's default ruleset. You can use that name wherever you can use a ruleset name, including when binding an input to it.qЅq}q(h4X?Where name is any name the user likes (but must not start with "RSYSLOG\_", which is the name space reserved for rsyslog use). If it finds this directive, it begins a new rule set (if the name was not yet know) or switches to an already-existing one (if the name was known). All rules defined between this $RuleSet directive and the next one are appended to the named ruleset. Note that the reserved name "RSYSLOG\_DefaultRuleset" is used to specify rsyslogd's default ruleset. You can use that name wherever you can use a ruleset name, including when binding an input to it.h5hubaubhQ)q}q(h4XInside a ruleset, messages are processed as described above: they start with the first rule and rules are processed in the order of appearance of the configuration file until either there are no more rules or the discard action is executed. Note that with multiple rulesets no longer **all** rsyslog.conf rules are executed but **only** those that are contained within the specific ruleset.h5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCK7hDhh/]q(hMXInside a ruleset, messages are processed as described above: they start with the first rule and rules are processed in the order of appearance of the configuration file until either there are no more rules or the discard action is executed. Note that with multiple rulesets no longer qׅq}q(h4XInside a ruleset, messages are processed as described above: they start with the first rule and rules are processed in the order of appearance of the configuration file until either there are no more rules or the discard action is executed. Note that with multiple rulesets no longer h5hubh)q}q(h4X**all**h:}q(h<]h=]h>]h?]hA]uh5hh/]qhMXallqޅq}q(h4Uh5hubah8hubhMX% rsyslog.conf rules are executed but qᅁq}q(h4X% rsyslog.conf rules are executed but h5hubh)q}q(h4X**only**h:}q(h<]h=]h>]h?]hA]uh5hh/]qhMXonlyq腁q}q(h4Uh5hubah8hubhMX6 those that are contained within the specific ruleset.q녁q}q(h4X6 those that are contained within the specific ruleset.h5hubeubhQ)q}q(h4XXInputs must explicitly bind to rulesets. If they don't do, the default ruleset is bound.qh5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCK>hDhh/]qhMXXInputs must explicitly bind to rulesets. If they don't do, the default ruleset is bound.qq}q(h4hh5hubaubhQ)q}q(h4X!This brings up the next question:qh5hh6h7h8hTh:}q(h<]h=]h>]h?]hA]uhCKAhDhh/]qhMX!This brings up the next question:qq}q(h4hh5hubaubeubh1)q}q(h4Uh5h2h6h7h8h9h:}r(h<]h=]h>]h?]rh"ahA]rh auhCKDhDhh/]r(hF)r}r(h4X&What does "To bind to a Ruleset" mean?rh5hh6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCKDhDhh/]rhMX&What does "To bind to a Ruleset" mean?r r }r (h4jh5jubaubhQ)r }r (h4XdThis term is used in the same sense as "to bind an IP address to an interface": it means that a specific input, or part of an input (like a tcp listener) will use a specific ruleset to "pass its messages to". So when a new message arrives, it will be processed via the bound ruleset. Rule from all other rulesets are irrelevant and will never be processed.rh5hh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKFhDhh/]rhMXdThis term is used in the same sense as "to bind an IP address to an interface": it means that a specific input, or part of an input (like a tcp listener) will use a specific ruleset to "pass its messages to". So when a new message arrives, it will be processed via the bound ruleset. Rule from all other rulesets are irrelevant and will never be processed.rr}r(h4jh5j ubaubhQ)r}r(h4XThis makes multiple rulesets very handy to process local and remote message via separate means: bind the respective receivers to different rule sets, and you do not need to separate the messages by any other method.rh5hh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKLhDhh/]rhMXThis makes multiple rulesets very handy to process local and remote message via separate means: bind the respective receivers to different rule sets, and you do not need to separate the messages by any other method.rr}r(h4jh5jubaubhQ)r}r(h4XFBinding to rulesets is input-specific. For imtcp, this is done via therh5hh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKQhDhh/]r hMXFBinding to rulesets is input-specific. For imtcp, this is done via ther!r"}r#(h4jh5jubaubh)r$}r%(h4X6input(type="imptcp" port="514" ruleset="rulesetname");h5hh6h7h8hh:}r&(hhh?]h>]h<]h=]hA]uhCKUhDhh/]r'hMX6input(type="imptcp" port="514" ruleset="rulesetname");r(r)}r*(h4Uh5j$ubaubhQ)r+}r,(h4Xdirective. Note that "name" must be the name of a ruleset that is already defined at the time the bind directive is given. There are many ways to make sure this happens, but I personally think that it is best to define all rule sets at the top of rsyslog.conf and define the inputs at the bottom. This kind of reverses the traditional recommended ordering, but seems to be a really useful and straightforward way of doing things.r-h5hh6h7h8hTh:}r.(h<]h=]h>]h?]hA]uhCKWhDhh/]r/hMXdirective. Note that "name" must be the name of a ruleset that is already defined at the time the bind directive is given. There are many ways to make sure this happens, but I personally think that it is best to define all rule sets at the top of rsyslog.conf and define the inputs at the bottom. This kind of reverses the traditional recommended ordering, but seems to be a really useful and straightforward way of doing things.r0r1}r2(h4j-h5j+ubaubeubh1)r3}r4(h4Uh5h2h6h7h8h9h:}r5(h<]h=]h>]h?]r6hahA]r7hauhCK`hDhh/]r8(hF)r9}r:(h4X?Why are rulesets important for different parser configurations?r;h5j3h6h7h8hJh:}r<(h<]h=]h>]h?]hA]uhCK`hDhh/]r=hMX?Why are rulesets important for different parser configurations?r>r?}r@(h4j;h5j9ubaubhQ)rA}rB(h4XCustom message parsers, used to handle different (and potentially otherwise-invalid) message formats, can be bound to rulesets. So multiple rulesets can be a very useful way to handle devices sending messages in different malformed formats in a consistent way. Unfortunately, this is not uncommon in the syslog world. An in-depth explanation with configuration sample can be found at the :doc:`$RulesetParser <../configuration/ruleset/rsconf1_rulesetparser>` configuration directive.h5j3h6h7h8hTh:}rC(h<]h=]h>]h?]hA]uhCKbhDhh/]rD(hMXCustom message parsers, used to handle different (and potentially otherwise-invalid) message formats, can be bound to rulesets. So multiple rulesets can be a very useful way to handle devices sending messages in different malformed formats in a consistent way. Unfortunately, this is not uncommon in the syslog world. An in-depth explanation with configuration sample can be found at the rErF}rG(h4XCustom message parsers, used to handle different (and potentially otherwise-invalid) message formats, can be bound to rulesets. So multiple rulesets can be a very useful way to handle devices sending messages in different malformed formats in a consistent way. Unfortunately, this is not uncommon in the syslog world. An in-depth explanation with configuration sample can be found at the h5jAubhw)rH}rI(h4XF:doc:`$RulesetParser <../configuration/ruleset/rsconf1_rulesetparser>`rJh5jAh6h7h8h{h:}rK(UreftypeXdocrLh~hX.../configuration/ruleset/rsconf1_rulesetparserU refdomainUh?]h>]U refexplicith<]h=]hA]hhuhCKbh/]rMh)rN}rO(h4jJh:}rP(h<]h=]rQ(hjLeh>]h?]hA]uh5jHh/]rRhMX$RulesetParserrSrT}rU(h4Uh5jNubah8hubaubhMX configuration directive.rVrW}rX(h4X configuration directive.h5jAubeubeubh1)rY}rZ(h4Uh5h2h6h7h8h9h:}r[(h<]h=]h>]h?]r\h ahA]r]hauhCKkhDhh/]r^(hF)r_}r`(h4X-Can I use a different Ruleset as the default?rah5jYh6h7h8hJh:}rb(h<]h=]h>]h?]hA]uhCKkhDhh/]rchMX-Can I use a different Ruleset as the default?rdre}rf(h4jah5j_ubaubhQ)rg}rh(h4XThis is possible by using therih5jYh6h7h8hTh:}rj(h<]h=]h>]h?]hA]uhCKmhDhh/]rkhMXThis is possible by using therlrm}rn(h4jih5jgubaubh)ro}rp(h4X$DefaultRuleset h5jYh6h7h8hh:}rq(hhh?]h>]h<]h=]hA]uhCKqhDhh/]rrhMX$DefaultRuleset rsrt}ru(h4Uh5joubaubhQ)rv}rw(h4X~Directive. Please note, however, that this directive is actually global: that is, it does not modify the ruleset to which the next input is bound but rather provides a system-wide default rule set for those inputs that did not explicitly bind to one. As such, the directive can not be used as a work-around to bind inputs to non-default rulesets that do not support ruleset binding.rxh5jYh6h7h8hTh:}ry(h<]h=]h>]h?]hA]uhCKshDhh/]rzhMX~Directive. Please note, however, that this directive is actually global: that is, it does not modify the ruleset to which the next input is bound but rather provides a system-wide default rule set for those inputs that did not explicitly bind to one. As such, the directive can not be used as a work-around to bind inputs to non-default rulesets that do not support ruleset binding.r{r|}r}(h4jxh5jvubaubeubh1)r~}r(h4Uh5h2h6h7h8h9h:}r(h<]h=]h>]h?]rh%ahA]rh auhCK{hDhh/]r(hF)r}r(h4XRulesets and Queuesrh5j~h6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCK{hDhh/]rhMXRulesets and Queuesrr}r(h4jh5jubaubhQ)r}r(h4XBy default, rulesets do not have their own queue. It must be activated via the $RulesetCreateMainQueue directive, or if using rainerscript format, by specifying queue parameters on the ruleset directive, e.g.rh5j~h6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCK}hDhh/]rhMXBy default, rulesets do not have their own queue. It must be activated via the $RulesetCreateMainQueue directive, or if using rainerscript format, by specifying queue parameters on the ruleset directive, e.g.rr}r(h4jh5jubaubh)r}r(h4X;ruleset(name="whatever" queue.type="fixedArray" queue. ...)h5j~h6h7h8hh:}r(hhh?]h>]h<]h=]hA]uhCKhDhh/]rhMX;ruleset(name="whatever" queue.type="fixedArray" queue. ...)rr}r(h4Uh5jubaubhQ)r}r(h4XSee :doc:`http://www.ryslog.com/doc/master/rainerscript/queue\_parameters.html <../rainerscript/queue_parameters>` for more details.h5j~h6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]r(hMXSee rr}r(h4XSee h5jubhw)r}r(h4Xn:doc:`http://www.ryslog.com/doc/master/rainerscript/queue\_parameters.html <../rainerscript/queue_parameters>`rh5jh6h7h8h{h:}r(UreftypeXdocrh~hX ../rainerscript/queue_parametersU refdomainUh?]h>]U refexplicith<]h=]hA]hhuhCKh/]rh)r}r(h4jh:}r(h<]h=]r(hjeh>]h?]hA]uh5jh/]rhMXChttp://www.ryslog.com/doc/master/rainerscript/queue_parameters.htmlrr}r(h4Uh5jubah8hubaubhMX for more details.rr}r(h4X for more details.h5jubeubhQ)r}r(h4XPlease note that when a ruleset uses its own queue, processing of the ruleset happens **asynchronously** to the rest of processing. As such, any modifications made to the message object (e.g. message or local variables that are set) or discarding of the message object **have no effect outside that ruleset**. So if you want to modify the message object inside the ruleset, you **cannot** define a queue for it. Most importantly, you cannot call it and expect the modified properties to be present when the call returns. Even more so, the call will most probably return before the message is even begun to be processed by the ruleset in question.h5j~h6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]r(hMXVPlease note that when a ruleset uses its own queue, processing of the ruleset happens rr}r(h4XVPlease note that when a ruleset uses its own queue, processing of the ruleset happens h5jubh)r}r(h4X**asynchronously**h:}r(h<]h=]h>]h?]hA]uh5jh/]rhMXasynchronouslyrr}r(h4Uh5jubah8hubhMX to the rest of processing. As such, any modifications made to the message object (e.g. message or local variables that are set) or discarding of the message object rr}r(h4X to the rest of processing. As such, any modifications made to the message object (e.g. message or local variables that are set) or discarding of the message object h5jubh)r}r(h4X'**have no effect outside that ruleset**h:}r(h<]h=]h>]h?]hA]uh5jh/]rhMX#have no effect outside that rulesetrr}r(h4Uh5jubah8hubhMXF. So if you want to modify the message object inside the ruleset, you rr}r(h4XF. So if you want to modify the message object inside the ruleset, you h5jubh)r}r(h4X **cannot**h:}r(h<]h=]h>]h?]hA]uh5jh/]rhMXcannotrr}r(h4Uh5jubah8hubhMX define a queue for it. Most importantly, you cannot call it and expect the modified properties to be present when the call returns. Even more so, the call will most probably return before the message is even begun to be processed by the ruleset in question.rr}r(h4X define a queue for it. Most importantly, you cannot call it and expect the modified properties to be present when the call returns. Even more so, the call will most probably return before the message is even begun to be processed by the ruleset in question.h5jubeubhQ)r}r(h4XNote that in RainerScript format specifying any "queue.\*" can cause the creation of a dedicated queue and as such asynchronous processing. This is because queue parameters cannot be specified without a queue. Note, though, that the actual creation is **guaranteed** only if "queue.type" is specified as above. So if you intentionally want to assing a separate queue to the ruleset, do so as shown above.h5j~h6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]r(hMXNote that in RainerScript format specifying any "queue.*" can cause the creation of a dedicated queue and as such asynchronous processing. This is because queue parameters cannot be specified without a queue. Note, though, that the actual creation is rr}r(h4XNote that in RainerScript format specifying any "queue.\*" can cause the creation of a dedicated queue and as such asynchronous processing. This is because queue parameters cannot be specified without a queue. Note, though, that the actual creation is h5jubh)r}r(h4X**guaranteed**h:}r(h<]h=]h>]h?]hA]uh5jh/]rhMX guaranteedrr}r(h4Uh5jubah8hubhMX only if "queue.type" is specified as above. So if you intentionally want to assing a separate queue to the ruleset, do so as shown above.rr}r(h4X only if "queue.type" is specified as above. So if you intentionally want to assing a separate queue to the ruleset, do so as shown above.h5jubeubeubh1)r}r(h4Uh5h2h6h7h8h9h:}r(h<]h=]h>]h?]rh)ahA]rhauhCKhDhh/]r(hF)r}r(h4XExamplesrh5jh6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]rhMXExamplesrr}r(h4jh5jubaubh1)r}r(h4Uh5jh6h7h8h9h:}r(h<]h=]h>]h?]rh#ahA]rh auhCKhDhh/]r(hF)r}r(h4XSplit local and remote loggingrh5jh6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]rhMXSplit local and remote loggingrr}r(h4jh5jubaubhQ)r}r(h4XLet's say you have a pretty standard system that logs its local messages to the usual bunch of files that are specified in the default rsyslog.conf. As an example, your rsyslog.conf might look like this:rh5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]r hMXLet's say you have a pretty standard system that logs its local messages to the usual bunch of files that are specified in the default rsyslog.conf. As an example, your rsyslog.conf might look like this:r r }r (h4jh5jubaubh)r }r(h4X# ... module loading ... # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...h5jh6h7h8hh:}r(hhh?]h>]h<]h=]hA]uhCKhDhh/]rhMX# ... module loading ... # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...rr}r(h4Uh5j ubaubhQ)r}r(h4X-Now, you want to add receive messages from a remote system and log these to a special file, but you do not want to have these messages written to the files specified above. The traditional approach is to add a rule in front of all others that filters on the message, processes it and then discards it:rh5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCKhDhh/]rhMX-Now, you want to add receive messages from a remote system and log these to a special file, but you do not want to have these messages written to the files specified above. The traditional approach is to add a rule in front of all others that filters on the message, processes it and then discards it:rr}r(h4jh5jubaubh)r}r(h4XI# ... module loading ... # process remote messages if $fromhost-ip == '192.168.152.137' then { action(type="omfile" file="/var/log/remotefile02") stop } # only messages not from 192.0.21 make it past this point # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...h5jh6h7h8hh:}r(hhh?]h>]h<]h=]hA]uhCKhDhh/]rhMXI# ... module loading ... # process remote messages if $fromhost-ip == '192.168.152.137' then { action(type="omfile" file="/var/log/remotefile02") stop } # only messages not from 192.0.21 make it past this point # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...r r!}r"(h4Uh5jubaubhQ)r#}r$(h4XNote that "stop" is the discard action!. Also note that we assume that 192.0.2.1 is the sole remote sender (to keep it simple).r%h5jh6h7h8hTh:}r&(h<]h=]h>]h?]hA]uhCKhDhh/]r'hMXNote that "stop" is the discard action!. Also note that we assume that 192.0.2.1 is the sole remote sender (to keep it simple).r(r)}r*(h4j%h5j#ubaubhQ)r+}r,(h4XWith multiple rulesets, we can simply define a dedicated ruleset for the remote reception case and bind it to the receiver. This may be written as follows:r-h5jh6h7h8hTh:}r.(h<]h=]h>]h?]hA]uhCKhDhh/]r/hMXWith multiple rulesets, we can simply define a dedicated ruleset for the remote reception case and bind it to the receiver. This may be written as follows:r0r1}r2(h4j-h5j+ubaubh)r3}r4(h4XI# ... module loading ... # process remote messages # define new ruleset and add rules to it: ruleset(name="remote"){ action(type="omfile" file="/var/log/remotefile") } # only messages not from 192.0.21 make it past this point # bind ruleset to tcp listener and activate it: input(type="imptcp" port="10514" ruleset="remote")h5jh6h7h8hh:}r5(hhh?]h>]h<]h=]hA]uhCKhDhh/]r6hMXI# ... module loading ... # process remote messages # define new ruleset and add rules to it: ruleset(name="remote"){ action(type="omfile" file="/var/log/remotefile") } # only messages not from 192.0.21 make it past this point # bind ruleset to tcp listener and activate it: input(type="imptcp" port="10514" ruleset="remote")r7r8}r9(h4Uh5j3ubaubeubh1)r:}r;(h4Uh5jh6h7h8h9h:}r<(h<]h=]h>]h?]r=h'ahA]r>hauhCKhDhh/]r?(hF)r@}rA(h4X8Split local and remote logging for three different portsrBh5j:h6h7h8hJh:}rC(h<]h=]h>]h?]hA]uhCKhDhh/]rDhMX8Split local and remote logging for three different portsrErF}rG(h4jBh5j@ubaubhQ)rH}rI(h4XThis example is almost like the first one, but it extends it a little bit. While it is very similar, I hope it is different enough to provide a useful example why you may want to have more than two rulesets.rJh5j:h6h7h8hTh:}rK(h<]h=]h>]h?]hA]uhCKhDhh/]rLhMXThis example is almost like the first one, but it extends it a little bit. While it is very similar, I hope it is different enough to provide a useful example why you may want to have more than two rulesets.rMrN}rO(h4jJh5jHubaubhQ)rP}rQ(h4XAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.\*" priority, shall be written into a specific file and **not** be written to 10516's general log file.h5j:h6h7h8hTh:}rR(h<]h=]h>]h?]hA]uhCKhDhh/]rS(hMXAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.*" priority, shall be written into a specific file and rTrU}rV(h4XAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.\*" priority, shall be written into a specific file and h5jPubh)rW}rX(h4X**not**h:}rY(h<]h=]h>]h?]hA]uh5jPh/]rZhMXnotr[r\}r](h4Uh5jWubah8hubhMX( be written to 10516's general log file.r^r_}r`(h4X( be written to 10516's general log file.h5jPubeubhQ)ra}rb(h4XThis is the config:rch5j:h6h7h8hTh:}rd(h<]h=]h>]h?]hA]uhCKhDhh/]rehMXThis is the config:rfrg}rh(h4jch5jaubaubh)ri}rj(h4X# ... module loading ... # process remote messages ruleset(name="remote10514"){ action(type="omfile" file="/var/log/remote10514") } ruleset(name="remote10515"){ action(type="omfile" file="/var/log/remote10515") } ruleset(name="remote10516"){ if prifilt("mail.*") then { /var/log/mail10516 stop # note that the stop-command will prevent this message from # being written to the remote10516 file - as usual... } /var/log/remote10516 } # and now define listeners bound to the relevant ruleset input(type="imptcp" port="10514" ruleset="remote10514") input(type="imptcp" port="10515" ruleset="remote10515") input(type="imptcp" port="10516" ruleset="remote10516")h5j:h6h7h8hh:}rk(hhh?]h>]h<]h=]hA]uhCKhDhh/]rlhMX# ... module loading ... # process remote messages ruleset(name="remote10514"){ action(type="omfile" file="/var/log/remote10514") } ruleset(name="remote10515"){ action(type="omfile" file="/var/log/remote10515") } ruleset(name="remote10516"){ if prifilt("mail.*") then { /var/log/mail10516 stop # note that the stop-command will prevent this message from # being written to the remote10516 file - as usual... } /var/log/remote10516 } # and now define listeners bound to the relevant ruleset input(type="imptcp" port="10514" ruleset="remote10514") input(type="imptcp" port="10515" ruleset="remote10515") input(type="imptcp" port="10516" ruleset="remote10516")rmrn}ro(h4Uh5jiubaubeubeubh1)rp}rq(h4Uh5h2h6h7h8h9h:}rr(h<]h=]h>]h?]rsh,ahA]rthauhCMhDhh/]ru(hF)rv}rw(h4X Performancerxh5jph6h7h8hJh:}ry(h<]h=]h>]h?]hA]uhCMhDhh/]rzhMX Performancer{r|}r}(h4jxh5jvubaubh1)r~}r(h4Uh5jph6h7h8h9h:}r(h<]h=]h>]h?]rh!ahA]rhauhCMhDhh/]r(hF)r}r(h4X Fewer Filtersrh5j~h6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCMhDhh/]rhMX Fewer Filtersrr}r(h4jh5jubaubhQ)r}r(h4XNo rule processing can be faster than not processing a rule at all. As such, it is useful for a high performance system to identify disjunct actions and try to split these off to different rule sets. In the example section, we had a case where three different tcp listeners need to write to three different files. This is a perfect example of where multiple rule sets are easier to use and offer more performance. The performance is better simply because there is no need to check the reception service - instead messages are automatically pushed to the right rule set and can be processed by very simple rules (maybe even with "\*.\*"-filters, the fastest ones available).h5j~h6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCMhDhh/]rhMXNo rule processing can be faster than not processing a rule at all. As such, it is useful for a high performance system to identify disjunct actions and try to split these off to different rule sets. In the example section, we had a case where three different tcp listeners need to write to three different files. This is a perfect example of where multiple rule sets are easier to use and offer more performance. The performance is better simply because there is no need to check the reception service - instead messages are automatically pushed to the right rule set and can be processed by very simple rules (maybe even with "*.*"-filters, the fastest ones available).rr}r(h4XNo rule processing can be faster than not processing a rule at all. As such, it is useful for a high performance system to identify disjunct actions and try to split these off to different rule sets. In the example section, we had a case where three different tcp listeners need to write to three different files. This is a perfect example of where multiple rule sets are easier to use and offer more performance. The performance is better simply because there is no need to check the reception service - instead messages are automatically pushed to the right rule set and can be processed by very simple rules (maybe even with "\*.\*"-filters, the fastest ones available).h5jubaubeubh1)r}r(h4Uh5jph6h7h8h9h:}r(h<]h=]h>]h?]rh.ahA]rhauhCM hDhh/]r(hF)r}r(h4XPartitioning of Input Datarh5jh6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCM hDhh/]rhMXPartitioning of Input Datarr}r(h4jh5jubaubhQ)r}r(h4XStarting with rsyslog 5.3.4, rulesets permit higher concurrency. They offer the ability to run on their own "main" queue. What that means is that a own queue is associated with a specific rule set. That means that inputs bound to that ruleset do no longer need to compete with each other when they enqueue a data element into the queue. Instead, enqueue operations can be completed in parallel.rh5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCM"hDhh/]rhMXStarting with rsyslog 5.3.4, rulesets permit higher concurrency. They offer the ability to run on their own "main" queue. What that means is that a own queue is associated with a specific rule set. That means that inputs bound to that ruleset do no longer need to compete with each other when they enqueue a data element into the queue. Instead, enqueue operations can be completed in parallel.rr}r(h4jh5jubaubhQ)r}r(h4X*An example: let us assume we have three TCP listeners. Without rulesets, each of them needs to insert messages into the main message queue. So if each of them wants to submit a newly arrived message into the queue at the same time, only one can do so while the others need to wait. With multiple rulesets, its own queue can be created for each ruleset. If now each listener is bound to its own ruleset, concurrent message submission is possible. On a machine with a sufficiently large number of cores, this can result in dramatic performance improvement.rh5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCM)hDhh/]rhMX*An example: let us assume we have three TCP listeners. Without rulesets, each of them needs to insert messages into the main message queue. So if each of them wants to submit a newly arrived message into the queue at the same time, only one can do so while the others need to wait. With multiple rulesets, its own queue can be created for each ruleset. If now each listener is bound to its own ruleset, concurrent message submission is possible. On a machine with a sufficiently large number of cores, this can result in dramatic performance improvement.rr}r(h4jh5jubaubhQ)r}r(h4X}It is highly advised that high-performance systems define a dedicated ruleset, with a dedicated queue for each of the inputs.rh5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCM2hDhh/]rhMX}It is highly advised that high-performance systems define a dedicated ruleset, with a dedicated queue for each of the inputs.rr}r(h4jh5jubaubhQ)r}r(h4XBy default, rulesets do **not** have their own queue. It must be activated via the :doc:`$RulesetCreateMainQueue <../configuration/ruleset/rsconf1_rulesetcreatemainqueue>` directive.h5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCM5hDhh/]r(hMXBy default, rulesets do rr}r(h4XBy default, rulesets do h5jubh)r}r(h4X**not**h:}r(h<]h=]h>]h?]hA]uh5jh/]rhMXnotrr}r(h4Uh5jubah8hubhMX4 have their own queue. It must be activated via the rr}r(h4X4 have their own queue. It must be activated via the h5jubhw)r}r(h4XX:doc:`$RulesetCreateMainQueue <../configuration/ruleset/rsconf1_rulesetcreatemainqueue>`rh5jh6h7h8h{h:}r(UreftypeXdocrh~hX7../configuration/ruleset/rsconf1_rulesetcreatemainqueueU refdomainUh?]h>]U refexplicith<]h=]hA]hhuhCM5h/]rh)r}r(h4jh:}r(h<]h=]r(hjeh>]h?]hA]uh5jh/]rhMX$RulesetCreateMainQueuerr}r(h4Uh5jubah8hubaubhMX directive.rr}r(h4X directive.h5jubeubeubeubh1)r}r(h4Uh5h2h6h7h8h9h:}r(h<]h=]h>]h?]rh-ahA]rhauhCM;hDhh/]r(hF)r}r(h4XSee Alsorh5jh6h7h8hJh:}r(h<]h=]h>]h?]hA]uhCM;hDhh/]rhMXSee Alsorr}r(h4jh5jubaubcdocutils.nodes compound r)r}r(h4Uh5jh6h7h8Ucompoundrh:}r(h<]h=]rUtoctree-wrapperrah>]h?]hA]uhCNhDhh/]rcsphinx.addnodes toctree r)r}r(h4Uh5jh6h7h8Utoctreerh:}r(UnumberedrKU includehiddenrh5hUcaptionrNUglobrh?]h>]U titlesonlyrh<]h=]hA]Uentriesr]rNX.historical/multi_ruleset_legacy_format_samplesrraUhiddenrU includefilesr]rjaUmaxdepthrKuhCM<h/]ubaubhQ)r}r(h4XThis documentation is part of the `rsyslog`_ project. Copyright © 2009-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.h5jh6h7h8hTh:}r(h<]h=]h>]h?]hA]uhCMAhDhh/]r(hMX"This documentation is part of the rr}r (h4X"This documentation is part of the h5jubhZ)r }r (h4X `rsyslog`_Uresolvedr Kh5jh8hdh:}r (UnameXrsyslogrh^h_h?]h>]h<]h=]hA]uh/]rhMXrsyslogrr}r(h4Uh5j ubaubhMX$ project. Copyright © 2009-2014 by rr}r(h4X$ project. Copyright © 2009-2014 by h5jubhZ)r}r(h4X3`Rainer Gerhards `_h:}r(UnameXRainer Gerhardsh^Xhttp://www.gerhards.net/rainerrh?]h>]h<]h=]hA]uh5jh/]rhMXRainer Gerhardsrr}r(h4Uh5jubah8hdubhe)r}r(h4X! hhKh5jh8hih:}r (Urefurijh?]r!h$ah>]h<]h=]hA]r"h auh/]ubhMX and r#r$}r%(h4X and h5jubhZ)r&}r'(h4X$`Adiscon `_h:}r((UnameXAdisconh^Xhttp://www.adiscon.com/r)h?]h>]h<]h=]hA]uh5jh/]r*hMXAdisconr+r,}r-(h4Uh5j&ubah8hdubhe)r.}r/(h4X hhKh5jh8hih:}r0(Urefurij)h?]r1h&ah>]h<]h=]hA]r2h auh/]ubhMX1. Released under the GNU GPL version 3 or higher.r3r4}r5(h4X1. Released under the GNU GPL version 3 or higher.h5jubeubeubeubah4UU transformerr6NU footnote_refsr7}r8Urefnamesr9}r:j]r;j asUsymbol_footnotesr<]r=Uautofootnote_refsr>]r?Usymbol_footnote_refsr@]rAU citationsrB]rChDhU current_linerDNUtransform_messagesrE]rFUreporterrGNUid_startrHKU autofootnotesrI]rJU citation_refsrK}rLUindirect_targetsrM]rNUsettingsrO(cdocutils.frontend Values rPorQ}rR(Ufootnote_backlinksrSKUrecord_dependenciesrTNU rfc_base_urlrUUhttps://tools.ietf.org/html/rVU tracebackrWUpep_referencesrXNUstrip_commentsrYNU toc_backlinksrZUentryr[U language_coder\Uenr]U datestampr^NU report_levelr_KU _destinationr`NU halt_levelraKU strip_classesrbNhJNUerror_encoding_error_handlerrcUbackslashreplacerdUdebugreNUembed_stylesheetrfUoutput_encoding_error_handlerrgUstrictrhU sectnum_xformriKUdump_transformsrjNU docinfo_xformrkKUwarning_streamrlNUpep_file_url_templatermUpep-%04drnUexit_status_levelroKUconfigrpNUstrict_visitorrqNUcloak_email_addressesrrUtrim_footnote_reference_spacersUenvrtNUdump_pseudo_xmlruNUexpose_internalsrvNUsectsubtitle_xformrwU source_linkrxNUrfc_referencesryNUoutput_encodingrzUutf-8r{U source_urlr|NUinput_encodingr}U utf-8-sigr~U_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh7Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]rUfile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hj3h%j~h+h2h#jh!j~h-jh.jh&j.h jYh)jh*hfh,jph$jh"hh(hh'j:uUsubstitution_namesr}rh8hDh:}r(h<]h?]h>]Usourceh7h=]hA]uU footnotesr]rUrefidsr}rub.build/.doctrees/concepts/index.doctree0000664000175000017500000000641113035122641017020 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXconceptsqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUconceptsqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX5/home/rger/proj/rsyslog-doc/source/concepts/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXConceptsq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XConceptsq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXThis chapter describes important rsyslog concepts and objects. Where appropriate, it also refers to configurations settings to affect the respective objects.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XThis chapter describes important rsyslog concepts and objects. Where appropriate, it also refers to configurations settings to affect the respective objects.q:q;}q<(hh6hh4ubaubcdocutils.nodes compound q=)q>}q?(hUhhhhhUcompoundq@h}qA(h]h]qBUtoctree-wrapperqCah ]h!]h#]uh%Nh&hh]qDcsphinx.addnodes toctree qE)qF}qG(hUhh>hhhUtoctreeqHh}qI(UnumberedqJKU includehiddenqKhXconcepts/indexqLUcaptionqMNUglobqNh!]h ]U titlesonlyqOh]h]h#]UentriesqP]qQ(NXconcepts/queuesqRqSNXconcepts/janitorqTqUNXconcepts/messageparserqVqWNXconcepts/multi_rulesetqXqYNXconcepts/netstrm_drvrqZq[eUhiddenq\U includefilesq]]q^(hRhThVhXhZeUmaxdepthq_Kuh%Kh]ubaubeubahUU transformerq`NU footnote_refsqa}qbUrefnamesqc}qdUsymbol_footnotesqe]qfUautofootnote_refsqg]qhUsymbol_footnote_refsqi]qjU citationsqk]qlh&hU current_lineqmNUtransform_messagesqn]qoUreporterqpNUid_startqqKU autofootnotesqr]qsU citation_refsqt}quUindirect_targetsqv]qwUsettingsqx(cdocutils.frontend Values qyoqz}q{(Ufootnote_backlinksq|KUrecord_dependenciesq}NU rfc_base_urlq~Uhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/concepts/ns_gtls.doctree0000664000175000017500000002370613035122641017370 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xgnutls libraryqXptcpqXgtls network stream driverqNuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceq NU decorationqNUautofootnote_startqKUnameidsq}q(hUgnutls-libraryqhUptcpqhUgtls-network-stream-driverquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX7/home/rger/proj/rsyslog-doc/source/concepts/ns_gtls.rstqUtagnameqUsectionqU attributesq }q!(Udupnamesq"]Uclassesq#]Ubackrefsq$]Uidsq%]q&haUnamesq']q(hauUlineq)KUdocumentq*hh]q+(cdocutils.nodes title q,)q-}q.(hXgtls Network Stream Driverq/hhhhhUtitleq0h }q1(h"]h#]h$]h%]h']uh)Kh*hh]q2cdocutils.nodes Text q3Xgtls Network Stream Driverq4q5}q6(hh/hh-ubaubcdocutils.nodes paragraph q7)q8}q9(hXThis network stream driver implements a TLS protected transport via the `GnuTLS library `_.hhhhhU paragraphq:h }q;(h"]h#]h$]h%]h']uh)Kh*hh]q<(h3XHThis network stream driver implements a TLS protected transport via the q=q>}q?(hXHThis network stream driver implements a TLS protected transport via the hh8ubcdocutils.nodes reference q@)qA}qB(hX7`GnuTLS library `_h }qC(UnameXGnuTLS libraryUrefuriqDX#http://www.gnu.org/software/gnutls/qEh%]h$]h"]h#]h']uhh8h]qFh3XGnuTLS libraryqGqH}qI(hUhhAubahU referenceqJubcdocutils.nodes target qK)qL}qM(hX& U referencedqNKhh8hUtargetqOh }qP(UrefurihEh%]qQhah$]h"]h#]h']qRhauh]ubh3X.qS}qT(hX.hh8ubeubh7)qU}qV(hX@**Available since:** 3.19.0 (suggested minimum 3.19.8 and above)qWhhhhhh:h }qX(h"]h#]h$]h%]h']uh)Kh*hh]qY(cdocutils.nodes strong qZ)q[}q\(hX**Available since:**h }q](h"]h#]h$]h%]h']uhhUh]q^h3XAvailable since:q_q`}qa(hUhh[ubahUstrongqbubh3X, 3.19.0 (suggested minimum 3.19.8 and above)qcqd}qe(hX, 3.19.0 (suggested minimum 3.19.8 and above)hhUubeubh7)qf}qg(hXSupported Driver Modesqhhhhhhh:h }qi(h"]h#]h$]h%]h']uh)K h*hh]qjh3XSupported Driver Modesqkql}qm(hhhhhfubaubcdocutils.nodes bullet_list qn)qo}qp(hUhhhhhU bullet_listqqh }qr(UbulletqsX-h%]h$]h"]h#]h']uh)K h*hh]qt(cdocutils.nodes list_item qu)qv}qw(hXE0 - unencrypted trasmission (just like `ptcp `_ driver)qxhhohhhU list_itemqyh }qz(h"]h#]h$]h%]h']uh)Nh*hh]q{h7)q|}q}(hhxhhvhhhh:h }q~(h"]h#]h$]h%]h']uh)K h]q(h3X'0 - unencrypted trasmission (just like qq}q(hX'0 - unencrypted trasmission (just like hh|ubh@)q}q(hX`ptcp `_h }q(UnamehhDX ns_ptcp.htmlqh%]h$]h"]h#]h']uhh|h]qh3Xptcpqq}q(hUhhubahhJubhK)q}q(hX hNKhh|hhOh }q(Urefurihh%]qhah$]h"]h#]h']qhauh]ubh3X driver)qq}q(hX driver)hh|ubeubaubhu)q}q(hX1 - TLS-protected operation hhohhhhyh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hX1 - TLS-protected operationqhhhhhh:h }q(h"]h#]h$]h%]h']uh)K h]qh3X1 - TLS-protected operationqq}q(hhhhubaubaubeubh7)q}q(hXNote: mode 0 does not provide any benefit over the ptcp driver. This mode exists for technical reasons, but should not be used. It may be removed in the future.qhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh*hh]qh3XNote: mode 0 does not provide any benefit over the ptcp driver. This mode exists for technical reasons, but should not be used. It may be removed in the future.qq}q(hhhhubaubh7)q}q(hXSupported Authentication Modesqhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh*hh]qh3XSupported Authentication Modesqq}q(hhhhubaubhn)q}q(hUhhhhhhqh }q(hsX-h%]h$]h"]h#]h']uh)Kh*hh]q(hu)q}q(hXhanon - anonymous authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet drafthhhhhhyh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXhanon - anonymous authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh]qh3Xhanon - anonymous authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqq}q(hhhhubaubaubhu)q}q(hXx509/fingerprint - certificate fingerprint authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet drafthhhhhhyh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXx509/fingerprint - certificate fingerprint authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh]qh3Xx509/fingerprint - certificate fingerprint authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqȅq}q(hhhhubaubaubhu)q}q(hX,x509/certvalid - certificate validation onlyqhhhhhhyh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hhhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh]qh3X,x509/certvalid - certificate validation onlyqԅq}q(hhhhubaubaubhu)q}q(hXx509/name - certificate validation and subject name authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draft hhhhhhyh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXx509/name - certificate validation and subject name authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh]qh3Xx509/name - certificate validation and subject name authentication as described in IETF's draft-ietf-syslog-transport-tls-12 Internet draftqq}q(hhhhubaubaubeubh7)q}q(hXNote: "anon" does not permit to authenticate the remote peer. As such, this mode is vulnerable to man in the middle attacks as well as unauthorized access. It is recommended NOT to use this mode.qhhhhhh:h }q(h"]h#]h$]h%]h']uh)Kh*hh]qh3XNote: "anon" does not permit to authenticate the remote peer. As such, this mode is vulnerable to man in the middle attacks as well as unauthorized access. It is recommended NOT to use this mode.q腁q}q(hhhhubaubh7)q}q(hXx509/certvalid is a nonstandard mode. It validates the remote peers certificate, but does not check the subject name. This is weak authentication that may be useful in scenarios where multiple devices are deployed and it is sufficient proof of authenticity when their certificates are signed by the CA the server trusts. This is better than anon authentication, but still not recommended. **Known Problems**hhhhhh:h }q(h"]h#]h$]h%]h']uh)K!h*hh]q(h3Xx509/certvalid is a nonstandard mode. It validates the remote peers certificate, but does not check the subject name. This is weak authentication that may be useful in scenarios where multiple devices are deployed and it is sufficient proof of authenticity when their certificates are signed by the CA the server trusts. This is better than anon authentication, but still not recommended. qq}q(hXx509/certvalid is a nonstandard mode. It validates the remote peers certificate, but does not check the subject name. This is weak authentication that may be useful in scenarios where multiple devices are deployed and it is sufficient proof of authenticity when their certificates are signed by the CA the server trusts. This is better than anon authentication, but still not recommended. hhubhZ)q}q(hX**Known Problems**h }q(h"]h#]h$]h%]h']uhhh]qh3XKnown Problemsqq}q(hUhhubahhbubeubh7)q}q(hXEven in x509/fingerprint mode, both the client and server certificate currently must be signed by the same root CA. This is an artifact of the underlying GnuTLS library and the way we use it. It is expected that we can resolve this issue in the future.qhhhhhh:h }q(h"]h#]h$]h%]h']uh)K(h*hh]qh3XEven in x509/fingerprint mode, both the client and server certificate currently must be signed by the same root CA. This is an artifact of the underlying GnuTLS library and the way we use it. It is expected that we can resolve this issue in the future.qq}r(hhhhubaubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]r Usymbol_footnote_refsr ]r U citationsr ]r h*hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/r U tracebackr!Upep_referencesr"NUstrip_commentsr#NU toc_backlinksr$Uentryr%U language_coder&Uenr'U datestampr(NU report_levelr)KU _destinationr*NU halt_levelr+KU strip_classesr,Nh0NUerror_encoding_error_handlerr-Ubackslashreplacer.Udebugr/NUembed_stylesheetr0Uoutput_encoding_error_handlerr1Ustrictr2U sectnum_xformr3KUdump_transformsr4NU docinfo_xformr5KUwarning_streamr6NUpep_file_url_templater7Upep-%04dr8Uexit_status_levelr9KUconfigr:NUstrict_visitorr;NUcloak_email_addressesr<Utrim_footnote_reference_spacer=Uenvr>NUdump_pseudo_xmlr?NUexpose_internalsr@NUsectsubtitle_xformrAU source_linkrBNUrfc_referencesrCNUoutput_encodingrDUutf-8rEU source_urlrFNUinput_encodingrGU utf-8-sigrHU_disable_configrINU id_prefixrJUU tab_widthrKKUerror_encodingrLUUTF-8rMU_sourcerNhUgettext_compactrOU generatorrPNUdump_internalsrQNU smart_quotesrRU pep_base_urlrSU https://www.python.org/dev/peps/rTUsyntax_highlightrUUlongrVUinput_encoding_error_handlerrWj2Uauto_id_prefixrXUidrYUdoctitle_xformrZUstrip_elements_with_classesr[NU _config_filesr\]r]Ufile_insertion_enabledr^U raw_enabledr_KU dump_settingsr`NubUsymbol_footnote_startraKUidsrb}rc(hhhhhhLuUsubstitution_namesrd}rehh*h }rf(h"]h%]h$]Usourcehh#]h']uU footnotesrg]rhUrefidsri}rjub.build/.doctrees/concepts/messageparser.doctree0000664000175000017500000015265613035122641020567 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrfc3164qXimtcpqX8can i use different parser chains for different devices?qNX"parser chains and how they operateq NXmessage parsers in rsyslogq NXrainer gerhardsq Xsyslog parsing in rsyslogq X&rsyslog professional services offeringq Xim3195qXwhere are parser chains used?qNXhow to write a message parser?qNXintroqNXrfc5425qXrfc5424qXimudpqXhow are message parsers used?qNXwhat are message parsers?qNX#which message parsers are availableqNX conclusionqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq }q!(hUrfc3164q"hUimtcpq#hU7can-i-use-different-parser-chains-for-different-devicesq$h U"parser-chains-and-how-they-operateq%h Umessage-parsers-in-rsyslogq&h Urainer-gerhardsq'h Usyslog-parsing-in-rsyslogq(h U&rsyslog-professional-services-offeringq)hUim3195q*hUwhere-are-parser-chains-usedq+hUhow-to-write-a-message-parserq,hUintroq-hUrfc5425q.hUrfc5424q/hUimudpq0hUhow-are-message-parsers-usedq1hUwhat-are-message-parsersq2hU#which-message-parsers-are-availableq3hU conclusionq4uUchildrenq5]q6cdocutils.nodes section q7)q8}q9(U rawsourceq:UUparentq;hUsourceqUsectionq?U attributesq@}qA(UdupnamesqB]UclassesqC]UbackrefsqD]UidsqE]qFh&aUnamesqG]qHh auUlineqIKUdocumentqJhh5]qK(cdocutils.nodes title qL)qM}qN(h:XMessage parsers in rsyslogqOh;h8hUtitleqPh@}qQ(hB]hC]hD]hE]hG]uhIKhJhh5]qRcdocutils.nodes Text qSXMessage parsers in rsyslogqTqU}qV(h:hOh;hMubaubcdocutils.nodes paragraph qW)qX}qY(h:XKWritten by `Rainer Gerhards `_ (2009-11-06)h;h8hU paragraphqZh@}q[(hB]hC]hD]hE]hG]uhIKhJhh5]q\(hSX Written by q]q^}q_(h:X Written by h;hXubcdocutils.nodes reference q`)qa}qb(h:X3`Rainer Gerhards `_h@}qc(UnameXRainer GerhardsUrefuriqdXhttp://www.gerhards.net/rainerqehE]hD]hB]hC]hG]uh;hXh5]qfhSXRainer Gerhardsqgqh}qi(h:Uh;haubah>U referenceqjubcdocutils.nodes target qk)ql}qm(h:X! U referencedqnKh;hXh>Utargetqoh@}qp(UrefurihehE]qqh'ahD]hB]hC]hG]qrh auh5]ubhSX (2009-11-06)qsqt}qu(h:X (2009-11-06)h;hXubeubh7)qv}qw(h:Uh;h8hh?h@}qx(hB]hC]hD]hE]qyh-ahG]qzhauhIKhJhh5]q{(hL)q|}q}(h:XIntroq~h;hvhhPh@}q(hB]hC]hD]hE]hG]uhIKhJhh5]qhSXIntroqq}q(h:h~h;h|ubaubhW)q}q(h:X'Message parsers are a feature of rsyslog 5.3.4 and above. In this article, I describe what message parsers are, what they can do and how they relate to the relevant standards. I will also describe what you can not do with time. Finally, I give some advice on implementing your own custom parser.qh;hvhhZh@}q(hB]hC]hD]hE]hG]uhIK hJhh5]qhSX'Message parsers are a feature of rsyslog 5.3.4 and above. In this article, I describe what message parsers are, what they can do and how they relate to the relevant standards. I will also describe what you can not do with time. Finally, I give some advice on implementing your own custom parser.qq}q(h:hh;hubaubeubh7)q}q(h:Uh;h8hh?h@}q(hB]hC]hD]hE]qh2ahG]qhauhIKhJhh5]q(hL)q}q(h:XWhat are message parsers?qh;hhhPh@}q(hB]hC]hD]hE]hG]uhIKhJhh5]qhSXWhat are message parsers?qq}q(h:hh;hubaubhW)q}q(h:X Well, the quick answer is that message parsers are the component of rsyslog that parses the syslog message after it is being received. Prior to rsyslog 5.3.4, message parsers where built in into the rsyslog core itself and could not be modified (other than by modifying the rsyslog code).qh;hhhZh@}q(hB]hC]hD]hE]hG]uhIKhJhh5]qhSX Well, the quick answer is that message parsers are the component of rsyslog that parses the syslog message after it is being received. Prior to rsyslog 5.3.4, message parsers where built in into the rsyslog core itself and could not be modified (other than by modifying the rsyslog code).qq}q(h:hh;hubaubhW)q}q(h:XIn 5.3.4, we changed that: message parsers are now loadable modules (just like input and output modules). That means that new message parsers can be added without modifying the rsyslog core, even without contributing something back to the project.qh;hhhZh@}q(hB]hC]hD]hE]hG]uhIKhJhh5]qhSXIn 5.3.4, we changed that: message parsers are now loadable modules (just like input and output modules). That means that new message parsers can be added without modifying the rsyslog core, even without contributing something back to the project.qq}q(h:hh;hubaubhW)q}q(h:XOBut that doesn't answer what a message parser really is. What does it mean to "parse a message" and, maybe more importantly, what is a message? To answer these questions correctly, we need to dig down into the relevant standards. `RFC5424 `_ specifies a layered architecture for the syslog protocol:h;hhhZh@}q(hB]hC]hD]hE]hG]uhIKhJhh5]q(hSXBut that doesn't answer what a message parser really is. What does it mean to "parse a message" and, maybe more importantly, what is a message? To answer these questions correctly, we need to dig down into the relevant standards. qq}q(h:XBut that doesn't answer what a message parser really is. What does it mean to "parse a message" and, maybe more importantly, what is a message? To answer these questions correctly, we need to dig down into the relevant standards. h;hubh`)q}q(h:X/`RFC5424 `_h@}q(UnameXRFC5424hdX"http://tools.ietf.org/html/rfc5424qhE]hD]hB]hC]hG]uh;hh5]qhSXRFC5424qq}q(h:Uh;hubah>hjubhk)q}q(h:X% hnKh;hh>hoh@}q(UrefurihhE]qh/ahD]hB]hC]hG]qhauh5]ubhSX: specifies a layered architecture for the syslog protocol:qq}q(h:X: specifies a layered architecture for the syslog protocol:h;hubeubcdocutils.nodes figure q)q}q(h:Uh;hhUfigureqh@}q(UalignqXcenterhE]qUid1qahD]hB]hC]hG]uhINhJhh5]q(cdocutils.nodes image q)q}q(h:X{.. figure:: rfc5424layers.png :align: center :alt: RFC5424 syslog protocol layers RFC5424 syslog protocol layers h@}q(UuriXconcepts/rfc5424layers.pngqhE]hD]hB]hC]U candidatesq}qU*hshG]Ualtcdocutils.nodes reprunicode qXRFC5424 syslog protocol layersq҅q}qbuh;hh5]h>Uimagequbcdocutils.nodes caption q)q}q(h:XRFC5424 syslog protocol layersqh;hhUcaptionqh@}q(hB]hC]hD]hE]hG]uhIK(h5]qhSXRFC5424 syslog protocol layersq݅q}q(h:hh;hubaubeubhW)q}q(h:XFor us important is the distinction between the syslog transport and the upper layers. The transport layer specifies how a stream of messages is assembled at the sender side and how this stream of messages is disassembled into the individual messages at the receiver side. In networking terminology, this is called "framing". The core idea is that each message is put into a so-called "frame", which then is transmitted over the communications link.qh;hhhZh@}q(hB]hC]hD]hE]hG]uhIK*hJhh5]qhSXFor us important is the distinction between the syslog transport and the upper layers. The transport layer specifies how a stream of messages is assembled at the sender side and how this stream of messages is disassembled into the individual messages at the receiver side. In networking terminology, this is called "framing". The core idea is that each message is put into a so-called "frame", which then is transmitted over the communications link.q允q}q(h:hh;hubaubhW)q}q(h:XKThe framing used is depending on the protocol. For example, in UDP the "frame"-equivalent is a packet that is being sent (this also means that no two messages can travel within a single UDP packet). In "plain tcp syslog", the industry standard, LF is used as a frame delimiter (which also means that no multi-line message can properly be transmitted, a "design" flaw in plain tcp syslog). In `RFC5425 `_ there is a header in front of each frame that contains the size of the message. With this framing, any message content can properly be transferred.h;hhhZh@}q(hB]hC]hD]hE]hG]uhIK2hJhh5]q(hSXThe framing used is depending on the protocol. For example, in UDP the "frame"-equivalent is a packet that is being sent (this also means that no two messages can travel within a single UDP packet). In "plain tcp syslog", the industry standard, LF is used as a frame delimiter (which also means that no multi-line message can properly be transmitted, a "design" flaw in plain tcp syslog). In q셁q}q(h:XThe framing used is depending on the protocol. For example, in UDP the "frame"-equivalent is a packet that is being sent (this also means that no two messages can travel within a single UDP packet). In "plain tcp syslog", the industry standard, LF is used as a frame delimiter (which also means that no multi-line message can properly be transmitted, a "design" flaw in plain tcp syslog). In h;hubh`)q}q(h:X/`RFC5425 `_h@}q(UnameXRFC5425hdX"http://tools.ietf.org/html/rfc5425qhE]hD]hB]hC]hG]uh;hh5]qhSXRFC5425qq}q(h:Uh;hubah>hjubhk)q}q(h:X% hnKh;hh>hoh@}q(UrefurihhE]qh.ahD]hB]hC]hG]qhauh5]ubhSX there is a header in front of each frame that contains the size of the message. With this framing, any message content can properly be transferred.qq}q(h:X there is a header in front of each frame that contains the size of the message. With this framing, any message content can properly be transferred.h;hubeubhW)q}r(h:X|And now comes the important part: **message parsers do NOT operate at the transport layer**, they operate, as their name implies, on messages. So we can not use message parsers to change the underlying framing. For example, if a sender splits (for whatever reason) a single message into two and encapsulates these into two frames, there is no way a message parser could undo that.h;hhhZh@}r(hB]hC]hD]hE]hG]uhIKUstrongrubhSX!, they operate, as their name implies, on messages. So we can not use message parsers to change the underlying framing. For example, if a sender splits (for whatever reason) a single message into two and encapsulates these into two frames, there is no way a message parser could undo that.rr}r(h:X!, they operate, as their name implies, on messages. So we can not use message parsers to change the underlying framing. For example, if a sender splits (for whatever reason) a single message into two and encapsulates these into two frames, there is no way a message parser could undo that.h;hubeubhW)r}r(h:XA typical example may be a multi-line message: let's assume some originator has generated a message for the format "A\\nB" (where \\n means LF). If that message is being transmitted via plain tcp syslog, the frame delimiter is LF. So the sender will delimit the frame with LF, but otherwise send the message unmodified onto the wire (because that is how things are -unfortunately- done in plain tcp syslog...). So wire will see "A\\nB\\n". When this arrives at the receiver, the transport layer will undo the framing. When it sees the LF after A, it thinks it finds a valid frame delimiter (in fact, this is the correct view!). So the receive will extract one complete message A and one complete message B, not knowing that they once were both part of a large multi-line message. These two messages are then passed to the upper layers, where the message parsers receive them and extract information. However, the message parsers never know (or even have a chance to see) that A and B belonged together. Even further, in rsyslog there is no guarantee that A will be parsed before B - concurrent operations may cause the reverse order (and do so very validly).h;hhhZh@}r(hB]hC]hD]hE]hG]uhIKChJhh5]rhSXA typical example may be a multi-line message: let's assume some originator has generated a message for the format "A\nB" (where \n means LF). If that message is being transmitted via plain tcp syslog, the frame delimiter is LF. So the sender will delimit the frame with LF, but otherwise send the message unmodified onto the wire (because that is how things are -unfortunately- done in plain tcp syslog...). So wire will see "A\nB\n". When this arrives at the receiver, the transport layer will undo the framing. When it sees the LF after A, it thinks it finds a valid frame delimiter (in fact, this is the correct view!). So the receive will extract one complete message A and one complete message B, not knowing that they once were both part of a large multi-line message. These two messages are then passed to the upper layers, where the message parsers receive them and extract information. However, the message parsers never know (or even have a chance to see) that A and B belonged together. Even further, in rsyslog there is no guarantee that A will be parsed before B - concurrent operations may cause the reverse order (and do so very validly).rr}r(h:XA typical example may be a multi-line message: let's assume some originator has generated a message for the format "A\\nB" (where \\n means LF). If that message is being transmitted via plain tcp syslog, the frame delimiter is LF. So the sender will delimit the frame with LF, but otherwise send the message unmodified onto the wire (because that is how things are -unfortunately- done in plain tcp syslog...). So wire will see "A\\nB\\n". When this arrives at the receiver, the transport layer will undo the framing. When it sees the LF after A, it thinks it finds a valid frame delimiter (in fact, this is the correct view!). So the receive will extract one complete message A and one complete message B, not knowing that they once were both part of a large multi-line message. These two messages are then passed to the upper layers, where the message parsers receive them and extract information. However, the message parsers never know (or even have a chance to see) that A and B belonged together. Even further, in rsyslog there is no guarantee that A will be parsed before B - concurrent operations may cause the reverse order (and do so very validly).h;jubaubhW)r}r(h:XThe important lesson is: **message parsers can not be used to fix a broken framing**. You need a full protocol implementation to do that, what is the domain of input and output modules.h;hhhZh@}r(hB]hC]hD]hE]hG]uhIKUhJhh5]r(hSXThe important lesson is: rr}r(h:XThe important lesson is: h;jubj)r }r!(h:X;**message parsers can not be used to fix a broken framing**h@}r"(hB]hC]hD]hE]hG]uh;jh5]r#hSX7message parsers can not be used to fix a broken framingr$r%}r&(h:Uh;j ubah>jubhSXe. You need a full protocol implementation to do that, what is the domain of input and output modules.r'r(}r)(h:Xe. You need a full protocol implementation to do that, what is the domain of input and output modules.h;jubeubhW)r*}r+(h:XI have now told you what you can not do with message parsers. But what they are good for? Thankfully, broken framing is not the primary problem of the syslog world. A wealth of different formats is. Unfortunately, many real-world implementations violate the relevant standards in one way or another. That makes it often very hard to extract meaningful information from a message or to process messages from different sources by the same rules. In my article `syslog parsing in rsyslog `_ I have elaborated on all the real-world evil that you can usually see. So I won't repeat that here. But in short, the real problem is not the framing, but how to make malformed messages well-looking.h;hhhZh@}r,(hB]hC]hD]hE]hG]uhIKYhJhh5]r-(hSXI have now told you what you can not do with message parsers. But what they are good for? Thankfully, broken framing is not the primary problem of the syslog world. A wealth of different formats is. Unfortunately, many real-world implementations violate the relevant standards in one way or another. That makes it often very hard to extract meaningful information from a message or to process messages from different sources by the same rules. In my article r.r/}r0(h:XI have now told you what you can not do with message parsers. But what they are good for? Thankfully, broken framing is not the primary problem of the syslog world. A wealth of different formats is. Unfortunately, many real-world implementations violate the relevant standards in one way or another. That makes it often very hard to extract meaningful information from a message or to process messages from different sources by the same rules. In my article h;j*ubh`)r1}r2(h:X2`syslog parsing in rsyslog `_h@}r3(UnameXsyslog parsing in rsysloghdXsyslog_parsing.htmlr4hE]hD]hB]hC]hG]uh;j*h5]r5hSXsyslog parsing in rsyslogr6r7}r8(h:Uh;j1ubah>hjubhk)r9}r:(h:X hnKh;j*h>hoh@}r;(Urefurij4hE]r<h(ahD]hB]hC]hG]r=h auh5]ubhSX I have elaborated on all the real-world evil that you can usually see. So I won't repeat that here. But in short, the real problem is not the framing, but how to make malformed messages well-looking.r>r?}r@(h:X I have elaborated on all the real-world evil that you can usually see. So I won't repeat that here. But in short, the real problem is not the framing, but how to make malformed messages well-looking.h;j*ubeubhW)rA}rB(h:X **This is what message parsers permit you to do: take a (well-known) malformed message, parse it according to its semantics and generate perfectly valid internal message representations from it.** So as long as messages are consistently in the same wrong format (and they usually are!), a message parser can look at that format, parse it, and make the message processable just like it were well formed in the first place. Plus, one can abuse the interface to do some other "interesting" tricks, but that would take us to far.h;hhhZh@}rC(hB]hC]hD]hE]hG]uhIKehJhh5]rD(j)rE}rF(h:X**This is what message parsers permit you to do: take a (well-known) malformed message, parse it according to its semantics and generate perfectly valid internal message representations from it.**h@}rG(hB]hC]hD]hE]hG]uh;jAh5]rHhSXThis is what message parsers permit you to do: take a (well-known) malformed message, parse it according to its semantics and generate perfectly valid internal message representations from it.rIrJ}rK(h:Uh;jEubah>jubhSXI So as long as messages are consistently in the same wrong format (and they usually are!), a message parser can look at that format, parse it, and make the message processable just like it were well formed in the first place. Plus, one can abuse the interface to do some other "interesting" tricks, but that would take us to far.rLrM}rN(h:XI So as long as messages are consistently in the same wrong format (and they usually are!), a message parser can look at that format, parse it, and make the message processable just like it were well formed in the first place. Plus, one can abuse the interface to do some other "interesting" tricks, but that would take us to far.h;jAubeubhW)rO}rP(h:X3While this functionality may not sound exciting, it actually solves a very big issue (that you only really understand if you have managed a system with various different syslog sources). Note that we were often able to process malformed messages in the past with the help of the property replacer and regular expressions. While this is nice, it has a performance hit. A message parser is a C code, compiled to native language, and thus typically much faster than any regular expression based method (depending, of course, on the quality of the implementation...).rQh;hhhZh@}rR(hB]hC]hD]hE]hG]uhIKnhJhh5]rShSX3While this functionality may not sound exciting, it actually solves a very big issue (that you only really understand if you have managed a system with various different syslog sources). Note that we were often able to process malformed messages in the past with the help of the property replacer and regular expressions. While this is nice, it has a performance hit. A message parser is a C code, compiled to native language, and thus typically much faster than any regular expression based method (depending, of course, on the quality of the implementation...).rTrU}rV(h:jQh;jOubaubeubh7)rW}rX(h:Uh;h8hh?h@}rY(hB]hC]hD]hE]rZh1ahG]r[hauhIKyhJhh5]r\(hL)r]}r^(h:XHow are message parsers used?r_h;jWhhPh@}r`(hB]hC]hD]hE]hG]uhIKyhJhh5]rahSXHow are message parsers used?rbrc}rd(h:j_h;j]ubaubhW)re}rf(h:XIn a simplified view, rsyslogrgh;jWhhZh@}rh(hB]hC]hD]hE]hG]uhIK{hJhh5]rihSXIn a simplified view, rsyslogrjrk}rl(h:jgh;jeubaubcdocutils.nodes enumerated_list rm)rn}ro(h:Uh;jWhUenumerated_listrph@}rq(UsuffixrrU.hE]hD]hB]UprefixrsUhC]hG]UenumtypertUarabicruuhIK}hJhh5]rv(cdocutils.nodes list_item rw)rx}ry(h:X/first receives messages (via the input module),rzh;jnhU list_itemr{h@}r|(hB]hC]hD]hE]hG]uhINhJhh5]r}hW)r~}r(h:jzh;jxhhZh@}r(hB]hC]hD]hE]hG]uhIK}h5]rhSX/first receives messages (via the input module),rr}r(h:jzh;j~ubaubaubjw)r}r(h:X.*then parses them (at the message level!)* andrh;jnhj{h@}r(hB]hC]hD]hE]hG]uhINhJhh5]rhW)r}r(h:jh;jhhZh@}r(hB]hC]hD]hE]hG]uhIK~h5]r(cdocutils.nodes emphasis r)r}r(h:X**then parses them (at the message level!)*h@}r(hB]hC]hD]hE]hG]uh;jh5]rhSX(then parses them (at the message level!)rr}r(h:Uh;jubah>UemphasisrubhSX andrr}r(h:X andh;jubeubaubjw)r}r(h:XHthen processes them (operating on the internal message representation). h;jnhj{h@}r(hB]hC]hD]hE]hG]uhINhJhh5]rhW)r}r(h:XGthen processes them (operating on the internal message representation).rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIKh5]rhSXGthen processes them (operating on the internal message representation).rr}r(h:jh;jubaubaubeubhW)r}r(h:XMessage parsers are utilized in the second step (written in italics). Thus, they take the raw message (NOT frame!) received from the remote system and create the internal structure out of it that the other parts of rsyslog need in order to perform their processing. Parsing is vital, because an unparsed message can not be processed in the third stage, the actual application-level processing (like forwarding or writing to files).rh;jWhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXMessage parsers are utilized in the second step (written in italics). Thus, they take the raw message (NOT frame!) received from the remote system and create the internal structure out of it that the other parts of rsyslog need in order to perform their processing. Parsing is vital, because an unparsed message can not be processed in the third stage, the actual application-level processing (like forwarding or writing to files).rr}r(h:jh;jubaubh7)r}r(h:Uh;jWhh?h@}r(hB]hC]hD]hE]rh%ahG]rh auhIKhJhh5]r(hL)r}r(h:X"Parser Chains and how they Operaterh;jhhPh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSX"Parser Chains and how they Operaterr}r(h:jh;jubaubhW)r}r(h:X:Rsyslog chains parsers together to provide flexibility. A **parser chain** contains all parsers that can potentially be used to parse a message. It is assumed that there is some way a parser can detect if the message it is being presented is supported by it. If so, the parser will tell the rsyslog engine and parse the message. The rsyslog engine now calls each parser inside the chain (in sequence!) until the first parser is able to parse the message. After one parser has been found, the message is considered parsed and no others parsers are called on that message.h;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]r(hSX:Rsyslog chains parsers together to provide flexibility. A rr}r(h:X:Rsyslog chains parsers together to provide flexibility. A h;jubj)r}r(h:X**parser chain**h@}r(hB]hC]hD]hE]hG]uh;jh5]rhSX parser chainrr}r(h:Uh;jubah>jubhSX contains all parsers that can potentially be used to parse a message. It is assumed that there is some way a parser can detect if the message it is being presented is supported by it. If so, the parser will tell the rsyslog engine and parse the message. The rsyslog engine now calls each parser inside the chain (in sequence!) until the first parser is able to parse the message. After one parser has been found, the message is considered parsed and no others parsers are called on that message.rr}r(h:X contains all parsers that can potentially be used to parse a message. It is assumed that there is some way a parser can detect if the message it is being presented is supported by it. If so, the parser will tell the rsyslog engine and parse the message. The rsyslog engine now calls each parser inside the chain (in sequence!) until the first parser is able to parse the message. After one parser has been found, the message is considered parsed and no others parsers are called on that message.h;jubeubhW)r}r(h:XSide-note: this method implies there are some "not-so-dirty" tricks available to modify the message by a parser module that declares itself as "unable to parse" but still does some message modification. This was not a primary design goal, but may be utilized, and the interface probably extended, to support generic filter modules. These would need to go to the root of the parser chain. As mentioned, the current system already supports this.rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXSide-note: this method implies there are some "not-so-dirty" tricks available to modify the message by a parser module that declares itself as "unable to parse" but still does some message modification. This was not a primary design goal, but may be utilized, and the interface probably extended, to support generic filter modules. These would need to go to the root of the parser chain. As mentioned, the current system already supports this.rr}r(h:jh;jubaubhW)r}r(h:XThe position inside the parser chain can be thought of as a priority: parser sitting earlier in the chain take precedence over those sitting later in it. So more specific parser should go earlier in the chain. A good example of how this works is the default parser set provided by rsyslog: rsyslog.rfc5424 and rsyslog.rfc3164, each one parses according to the rfc that has named it. RFC5424 was designed to be distinguishable from RFC3164 message by the sequence "1 " immediately after the so-called PRI-part (don't worry about these words, it is sufficient if you understand there is a well-defined sequence used to identify RFC5424 messages). In contrary, RFC3164 actually permits everything as a valid message. Thus the RFC3164 parser will always parse a message, sometimes with quite unexpected outcome (there is a lot of guesswork involved in that parser, which unfortunately is unavoidable due to existing technology limits). So the default parser chain is to try the RFC5424 parser first and after it the RFC3164 parser. If we have a 5424-formatted message, that parser will identify and parse it and the rsyslog engine will stop processing. But if we receive a legacy syslog message, the RFC5424 will detect that it can not parse it, return this status to the engine which then calls the next parser inside the chain. That usually happens to be the RFC3164 parser, which will always process the message. But there could also be any other parser inside the chain, and then each one would be called unless one that is able to parse can be found.rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXThe position inside the parser chain can be thought of as a priority: parser sitting earlier in the chain take precedence over those sitting later in it. So more specific parser should go earlier in the chain. A good example of how this works is the default parser set provided by rsyslog: rsyslog.rfc5424 and rsyslog.rfc3164, each one parses according to the rfc that has named it. RFC5424 was designed to be distinguishable from RFC3164 message by the sequence "1 " immediately after the so-called PRI-part (don't worry about these words, it is sufficient if you understand there is a well-defined sequence used to identify RFC5424 messages). In contrary, RFC3164 actually permits everything as a valid message. Thus the RFC3164 parser will always parse a message, sometimes with quite unexpected outcome (there is a lot of guesswork involved in that parser, which unfortunately is unavoidable due to existing technology limits). So the default parser chain is to try the RFC5424 parser first and after it the RFC3164 parser. If we have a 5424-formatted message, that parser will identify and parse it and the rsyslog engine will stop processing. But if we receive a legacy syslog message, the RFC5424 will detect that it can not parse it, return this status to the engine which then calls the next parser inside the chain. That usually happens to be the RFC3164 parser, which will always process the message. But there could also be any other parser inside the chain, and then each one would be called unless one that is able to parse can be found.rr}r(h:jh;jubaubhW)r}r(h:XWIf we reversed the parser order, RFC5424 messages would incorrectly parsed. Why? Because the RFC3164 parser will always parse every message, so if it were asked first, it would parse (and misinterpret) the 5424-formatted message, return it did so and the rsyslog engine would never call the 5424 parser. So order of sequence is very important.rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXWIf we reversed the parser order, RFC5424 messages would incorrectly parsed. Why? Because the RFC3164 parser will always parse every message, so if it were asked first, it would parse (and misinterpret) the 5424-formatted message, return it did so and the rsyslog engine would never call the 5424 parser. So order of sequence is very important.rr}r(h:jh;jubaubhW)r}r(h:X~What happens if no parser in the chain could parse a message? Well, then we could not obtain the in-memory representation that is needed to further process the message. In that case, rsyslog has no other choice than to discard the message. If it does so, it will emit a warning message, but only in the first 1,000 incidents. This limit is a safety measure against message-loops, which otherwise could quickly result from a parser chain misconfiguration. **If you do not tolerate loss of unparsable messages, you must ensure that each message can be parsed.** You can easily achieve this by always using the "rsyslog-rfc3164" parser as the *last* parser inside parser chains. That may result in invalid parsing, but you will have a chance to see the invalid message (in debug mode, a warning message will be written to the debug log each time a message is dropped due to inability to parse it).h;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]r(hSXWhat happens if no parser in the chain could parse a message? Well, then we could not obtain the in-memory representation that is needed to further process the message. In that case, rsyslog has no other choice than to discard the message. If it does so, it will emit a warning message, but only in the first 1,000 incidents. This limit is a safety measure against message-loops, which otherwise could quickly result from a parser chain misconfiguration. rr}r(h:XWhat happens if no parser in the chain could parse a message? Well, then we could not obtain the in-memory representation that is needed to further process the message. In that case, rsyslog has no other choice than to discard the message. If it does so, it will emit a warning message, but only in the first 1,000 incidents. This limit is a safety measure against message-loops, which otherwise could quickly result from a parser chain misconfiguration. h;jubj)r}r(h:Xh**If you do not tolerate loss of unparsable messages, you must ensure that each message can be parsed.**h@}r(hB]hC]hD]hE]hG]uh;jh5]rhSXdIf you do not tolerate loss of unparsable messages, you must ensure that each message can be parsed.rr}r(h:Uh;jubah>jubhSXQ You can easily achieve this by always using the "rsyslog-rfc3164" parser as the rr}r(h:XQ You can easily achieve this by always using the "rsyslog-rfc3164" parser as the h;jubj)r}r(h:X*last*h@}r(hB]hC]hD]hE]hG]uh;jh5]rhSXlastrr}r(h:Uh;jubah>jubhSX parser inside parser chains. That may result in invalid parsing, but you will have a chance to see the invalid message (in debug mode, a warning message will be written to the debug log each time a message is dropped due to inability to parse it).rr}r(h:X parser inside parser chains. That may result in invalid parsing, but you will have a chance to see the invalid message (in debug mode, a warning message will be written to the debug log each time a message is dropped due to inability to parse it).h;jubeubeubh7)r}r(h:Uh;jWhh?h@}r(hB]hC]hD]hE]rh+ahG]rhauhIKhJhh5]r(hL)r}r(h:XWhere are parser chains used?rh;jhhPh@}r (hB]hC]hD]hE]hG]uhIKhJhh5]r hSXWhere are parser chains used?r r }r (h:jh;jubaubhW)r}r(h:X|We now know what parser chains are and how they operate. The question is now how many parser chains can be active and how it is decided which parser chain is used on which message. This is controlled via :doc:`rsyslog's rulesets `. In short, multiple rulesets can be defined and there always exist at least one ruleset. A parser chain is bound to a specific ruleset. This is done by virtue of defining parsers via the :doc:`$RulesetParser <../configuration/ruleset/rsconf1_rulesetparser>` configuration directive (for specifics, see there). If no such directive is specified, the default parser chain is used. As of this writing, the default parser chain always consists of "rsyslog.rfc5424", "rsyslog.rfc3164", in that order. As soon as a parser is configured, the default list is cleared and the new parser is added to the end of the (initially empty) ruleset's parser chain.h;jhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]r(hSXWe now know what parser chains are and how they operate. The question is now how many parser chains can be active and how it is decided which parser chain is used on which message. This is controlled via rr}r(h:XWe now know what parser chains are and how they operate. The question is now how many parser chains can be active and how it is decided which parser chain is used on which message. This is controlled via h;jubcsphinx.addnodes pending_xref r)r}r(h:X):doc:`rsyslog's rulesets `rh;jhU pending_xrefrh@}r(UreftypeXdocrUrefwarnrU reftargetrX multi_rulesetU refdomainUhE]hD]U refexplicithB]hC]hG]UrefdocrXconcepts/messageparserruhIKh5]r cdocutils.nodes literal r!)r"}r#(h:jh@}r$(hB]hC]r%(Uxrefr&jehD]hE]hG]uh;jh5]r'hSXrsyslog's rulesetsr(r)}r*(h:Uh;j"ubah>Uliteralr+ubaubhSX. In short, multiple rulesets can be defined and there always exist at least one ruleset. A parser chain is bound to a specific ruleset. This is done by virtue of defining parsers via the r,r-}r.(h:X. In short, multiple rulesets can be defined and there always exist at least one ruleset. A parser chain is bound to a specific ruleset. This is done by virtue of defining parsers via the h;jubj)r/}r0(h:XF:doc:`$RulesetParser <../configuration/ruleset/rsconf1_rulesetparser>`r1h;jhjh@}r2(UreftypeXdocr3jjX.../configuration/ruleset/rsconf1_rulesetparserU refdomainUhE]hD]U refexplicithB]hC]hG]jjuhIKh5]r4j!)r5}r6(h:j1h@}r7(hB]hC]r8(j&j3ehD]hE]hG]uh;j/h5]r9hSX$RulesetParserr:r;}r<(h:Uh;j5ubah>j+ubaubhSX configuration directive (for specifics, see there). If no such directive is specified, the default parser chain is used. As of this writing, the default parser chain always consists of "rsyslog.rfc5424", "rsyslog.rfc3164", in that order. As soon as a parser is configured, the default list is cleared and the new parser is added to the end of the (initially empty) ruleset's parser chain.r=r>}r?(h:X configuration directive (for specifics, see there). If no such directive is specified, the default parser chain is used. As of this writing, the default parser chain always consists of "rsyslog.rfc5424", "rsyslog.rfc3164", in that order. As soon as a parser is configured, the default list is cleared and the new parser is added to the end of the (initially empty) ruleset's parser chain.h;jubeubhW)r@}rA(h:XUThe important point to know is that parser chains are defined on a per-ruleset basis.rBh;jhhZh@}rC(hB]hC]hD]hE]hG]uhIKhJhh5]rDhSXUThe important point to know is that parser chains are defined on a per-ruleset basis.rErF}rG(h:jBh;j@ubaubeubh7)rH}rI(h:Uh;jWhh?h@}rJ(hB]hC]hD]hE]rKh$ahG]rLhauhIKhJhh5]rM(hL)rN}rO(h:X8Can I use different parser chains for different devices?rPh;jHhhPh@}rQ(hB]hC]hD]hE]hG]uhIKhJhh5]rRhSX8Can I use different parser chains for different devices?rSrT}rU(h:jPh;jNubaubhW)rV}rW(h:XThe correct answer is: generally yes, but it depends. First of all, remember that input modules (and specific listeners) may be bound to specific rulesets. As parser chains "reside" in rulesets, binding to a ruleset also binds to the parser chain that is bound to that ruleset. As a number one prerequisite, the input module must support binding to different rulesets. Not all do, but their number is growing. For example, the important `imudp `_ and `imtcp `_ input modules support that functionality. Those that do not (for example `im3195 `_) can only utilize the default ruleset and thus the parser chain defined in that ruleset.h;jHhhZh@}rX(hB]hC]hD]hE]hG]uhIKhJhh5]rY(hSXThe correct answer is: generally yes, but it depends. First of all, remember that input modules (and specific listeners) may be bound to specific rulesets. As parser chains "reside" in rulesets, binding to a ruleset also binds to the parser chain that is bound to that ruleset. As a number one prerequisite, the input module must support binding to different rulesets. Not all do, but their number is growing. For example, the important rZr[}r\(h:XThe correct answer is: generally yes, but it depends. First of all, remember that input modules (and specific listeners) may be bound to specific rulesets. As parser chains "reside" in rulesets, binding to a ruleset also binds to the parser chain that is bound to that ruleset. As a number one prerequisite, the input module must support binding to different rulesets. Not all do, but their number is growing. For example, the important h;jVubh`)r]}r^(h:X`imudp `_h@}r_(UnamehhdX imudp.htmlr`hE]hD]hB]hC]hG]uh;jVh5]rahSXimudprbrc}rd(h:Uh;j]ubah>hjubhk)re}rf(h:X hnKh;jVh>hoh@}rg(Urefurij`hE]rhh0ahD]hB]hC]hG]rihauh5]ubhSX and rjrk}rl(h:X and h;jVubh`)rm}rn(h:X`imtcp `_h@}ro(UnamehhdX imtcp.htmlrphE]hD]hB]hC]hG]uh;jVh5]rqhSXimtcprrrs}rt(h:Uh;jmubah>hjubhk)ru}rv(h:X hnKh;jVh>hoh@}rw(UrefurijphE]rxh#ahD]hB]hC]hG]ryhauh5]ubhSXJ input modules support that functionality. Those that do not (for example rzr{}r|(h:XJ input modules support that functionality. Those that do not (for example h;jVubh`)r}}r~(h:X`im3195 `_h@}r(UnamehhdXim3195rhE]hD]hB]hC]hG]uh;jVh5]rhSXim3195rr}r(h:Uh;j}ubah>hjubhk)r}r(h:X hnKh;jVh>hoh@}r(UrefurijhE]rh*ahD]hB]hC]hG]rhauh5]ubhSXY) can only utilize the default ruleset and thus the parser chain defined in that ruleset.rr}r(h:XY) can only utilize the default ruleset and thus the parser chain defined in that ruleset.h;jVubeubhW)r}r(h:XIf you do not know if the input module in question supports ruleset binding, check its documentation page. Those that support it have the required directives.rh;jHhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXIf you do not know if the input module in question supports ruleset binding, check its documentation page. Those that support it have the required directives.rr}r(h:jh;jubaubhW)r}r(h:XNote that it is currently under evaluation if rsyslog will support binding parser chains to specific inputs directly, without depending on the ruleset. There are some concerns that this may not be necessary but adds considerable complexity to the configuration. So this may or may not be possible in the future. In any case, if we decide to add it, input modules need to support it, so this functionality would require some time to implement.rh;jHhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]rhSXNote that it is currently under evaluation if rsyslog will support binding parser chains to specific inputs directly, without depending on the ruleset. There are some concerns that this may not be necessary but adds considerable complexity to the configuration. So this may or may not be possible in the future. In any case, if we decide to add it, input modules need to support it, so this functionality would require some time to implement.rr}r(h:jh;jubaubhW)r}r(h:X The cookbook recipe for using different parsers for different devices is given as an actual in-depth example in the `$RulesetParser` configuration directive doc page. In short, it is accomplished by defining specific rulesets for the required parser chains, defining different listener ports for each of the devices with different format and binding these listeners to the correct ruleset (and thus parser chains). Using that approach, a variety of different message formats can be supported via a single rsyslog instance.h;jHhhZh@}r(hB]hC]hD]hE]hG]uhIKhJhh5]r(hSXtThe cookbook recipe for using different parsers for different devices is given as an actual in-depth example in the rr}r(h:XtThe cookbook recipe for using different parsers for different devices is given as an actual in-depth example in the h;jubcdocutils.nodes title_reference r)r}r(h:X`$RulesetParser`h@}r(hB]hC]hD]hE]hG]uh;jh5]rhSX$RulesetParserrr}r(h:Uh;jubah>Utitle_referencerubhSX configuration directive doc page. In short, it is accomplished by defining specific rulesets for the required parser chains, defining different listener ports for each of the devices with different format and binding these listeners to the correct ruleset (and thus parser chains). Using that approach, a variety of different message formats can be supported via a single rsyslog instance.rr}r(h:X configuration directive doc page. In short, it is accomplished by defining specific rulesets for the required parser chains, defining different listener ports for each of the devices with different format and binding these listeners to the correct ruleset (and thus parser chains). Using that approach, a variety of different message formats can be supported via a single rsyslog instance.h;jubeubeubeubh7)r}r(h:Uh;h8hh?h@}r(hB]hC]hD]hE]rh3ahG]rhauhIMhJhh5]r(hL)r}r(h:X#Which message parsers are availablerh;jhhPh@}r(hB]hC]hD]hE]hG]uhIMhJhh5]rhSX#Which message parsers are availablerr}r(h:jh;jubaubhW)r}r(h:X}As of this writing, there exist only two message parsers, one for RFC5424 format and one for legacy syslog (loosely described in `RFC3164 `_). These parsers are built-in and must not be explicitly loaded. However, message parsers can be added with relative ease by anyone knowing to code in C. Then, they can be loaded via $ModLoad just like any other loadable module. It is expected that the rsyslog project will be contributed additional message parsers over time, so that at some point there hopefully is a rich choice of them (I intend to add a browsable repository as soon as new parsers pop up).h;jhhZh@}r(hB]hC]hD]hE]hG]uhIMhJhh5]r(hSXAs of this writing, there exist only two message parsers, one for RFC5424 format and one for legacy syslog (loosely described in rr}r(h:XAs of this writing, there exist only two message parsers, one for RFC5424 format and one for legacy syslog (loosely described in h;jubh`)r}r(h:X/`RFC3164 `_h@}r(UnameXRFC3164hdX"http://tools.ietf.org/html/rfc3164rhE]hD]hB]hC]hG]uh;jh5]rhSXRFC3164rr}r(h:Uh;jubah>hjubhk)r}r(h:X% hnKh;jh>hoh@}r(UrefurijhE]rh"ahD]hB]hC]hG]rhauh5]ubhSX). These parsers are built-in and must not be explicitly loaded. However, message parsers can be added with relative ease by anyone knowing to code in C. Then, they can be loaded via $ModLoad just like any other loadable module. It is expected that the rsyslog project will be contributed additional message parsers over time, so that at some point there hopefully is a rich choice of them (I intend to add a browsable repository as soon as new parsers pop up).rr}r(h:X). These parsers are built-in and must not be explicitly loaded. However, message parsers can be added with relative ease by anyone knowing to code in C. Then, they can be loaded via $ModLoad just like any other loadable module. It is expected that the rsyslog project will be contributed additional message parsers over time, so that at some point there hopefully is a rich choice of them (I intend to add a browsable repository as soon as new parsers pop up).h;jubeubh7)r}r(h:Uh;jhh?h@}r(hB]hC]hD]hE]rh,ahG]rhauhIMhJhh5]r(hL)r}r(h:XHow to write a message parser?rh;jhhPh@}r(hB]hC]hD]hE]hG]uhIMhJhh5]rhSXHow to write a message parser?rr}r(h:jh;jubaubhW)r}r(h:XAs a prerequisite, you need to know the exact format that the device is sending. Then, you need moderate C coding skills, and a little bit of rsyslog internals. I guess the rsyslog specific part should not be that hard, as almost all information can be gained from the existing parsers. They are rather simple in structure and can be found under the "./tools" directory. They are named pmrfc3164.c and pmrfc5424.c. You need to follow the usual loadable module guidelines. It is my expectation that writing a parser should typically not take longer than a single day, with maybe a day more to get acquainted with rsyslog. Of course, I am not sure if the number is actually right.rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIMhJhh5]rhSXAs a prerequisite, you need to know the exact format that the device is sending. Then, you need moderate C coding skills, and a little bit of rsyslog internals. I guess the rsyslog specific part should not be that hard, as almost all information can be gained from the existing parsers. They are rather simple in structure and can be found under the "./tools" directory. They are named pmrfc3164.c and pmrfc5424.c. You need to follow the usual loadable module guidelines. It is my expectation that writing a parser should typically not take longer than a single day, with maybe a day more to get acquainted with rsyslog. Of course, I am not sure if the number is actually right.rr}r(h:jh;jubaubhW)r}r(h:XIf you can not program or have no time to do it, Adiscon can also write a message parser for you as part of the `rsyslog professional services offering `_.h;jhhZh@}r(hB]hC]hD]hE]hG]uhIM!hJhh5]r(hSXpIf you can not program or have no time to do it, Adiscon can also write a message parser for you as part of the rr}r(h:XpIf you can not program or have no time to do it, Adiscon can also write a message parser for you as part of the h;jubh`)r}r(h:XX`rsyslog professional services offering `_h@}r(UnameX&rsyslog professional services offeringhdX,http://www.rsyslog.com/professional-servicesrhE]hD]hB]hC]hG]uh;jh5]rhSX&rsyslog professional services offeringrr}r(h:Uh;jubah>hjubhk)r}r(h:X/ hnKh;jh>hoh@}r(UrefurijhE]rh)ahD]hB]hC]hG]rh auh5]ubhSX.r}r(h:X.h;jubeubeubeubh7)r}r(h:Uh;h8hh?h@}r(hB]hC]hD]hE]rh4ahG]rhauhIM&hJhh5]r(hL)r}r(h:X Conclusionr h;jhhPh@}r (hB]hC]hD]hE]hG]uhIM&hJhh5]r hSX Conclusionr r }r(h:j h;jubaubhW)r}r(h:XIMalformed syslog messages are a pain and unfortunately often seen in practice. Message parsers provide a fast and efficient solution for this problem. Different parsers can be defined for different devices, and they all convert message information into rsyslog's well-defined internal format. Message parsers were first introduced in rsyslog 5.3.4 and also offer some interesting ideas that may be explored in the future - up to full message normalization capabilities. It is strongly recommended that anyone with a heterogeneous environment take a look at message parser capabilities.rh;jhhZh@}r(hB]hC]hD]hE]hG]uhIM(hJhh5]rhSXIMalformed syslog messages are a pain and unfortunately often seen in practice. Message parsers provide a fast and efficient solution for this problem. Different parsers can be defined for different devices, and they all convert message information into rsyslog's well-defined internal format. Message parsers were first introduced in rsyslog 5.3.4 and also offer some interesting ideas that may be explored in the future - up to full message normalization capabilities. It is strongly recommended that anyone with a heterogeneous environment take a look at message parser capabilities.rr}r(h:jh;jubaubeubeubah:UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr ]r!U citationsr"]r#hJhU current_liner$NUtransform_messagesr%]r&Ureporterr'NUid_startr(KU autofootnotesr)]r*U citation_refsr+}r,Uindirect_targetsr-]r.Usettingsr/(cdocutils.frontend Values r0or1}r2(Ufootnote_backlinksr3KUrecord_dependenciesr4NU rfc_base_urlr5Uhttps://tools.ietf.org/html/r6U tracebackr7Upep_referencesr8NUstrip_commentsr9NU toc_backlinksr:Uentryr;U language_coder<Uenr=U datestampr>NU report_levelr?KU _destinationr@NU halt_levelrAKU strip_classesrBNhPNUerror_encoding_error_handlerrCUbackslashreplacerDUdebugrENUembed_stylesheetrFUoutput_encoding_error_handlerrGUstrictrHU sectnum_xformrIKUdump_transformsrJNU docinfo_xformrKKUwarning_streamrLNUpep_file_url_templaterMUpep-%04drNUexit_status_levelrOKUconfigrPNUstrict_visitorrQNUcloak_email_addressesrRUtrim_footnote_reference_spacerSUenvrTNUdump_pseudo_xmlrUNUexpose_internalsrVNUsectsubtitle_xformrWU source_linkrXNUrfc_referencesrYNUoutput_encodingrZUutf-8r[U source_urlr\NUinput_encodingr]U utf-8-sigr^U_disable_configr_NU id_prefixr`UU tab_widthraKUerror_encodingrbUUTF-8rcU_sourcerdh=Ugettext_compactreU generatorrfNUdump_internalsrgNU smart_quotesrhU pep_base_urlriU https://www.python.org/dev/peps/rjUsyntax_highlightrkUlongrlUinput_encoding_error_handlerrmjHUauto_id_prefixrnUidroUdoctitle_xformrpUstrip_elements_with_classesrqNU _config_filesrr]Ufile_insertion_enabledrsU raw_enabledrtKU dump_settingsruNubUsymbol_footnote_startrvKUidsrw}rx(h)jh"jh1jWh%jh$jHh+jh&h8hhh,jh3jh-hvh.hh/hh0jeh(j9h*jh2hh4jh#juh'hluUsubstitution_namesry}rzh>hJh@}r{(hB]hE]hD]Usourceh=hC]hG]uU footnotesr|]r}Urefidsr~}rub.build/.doctrees/environment.pickle0000664000175000017500000132621413035122644016273 0ustar rgerrger(csphinx.environment BuildEnvironment qoq}q(Udlfilesqcsphinx.util FilenameUniqDict q)qXE/home/rger/proj/rsyslog-doc/source/configuration/rsyslog-example.confqc__builtin__ set q]q Xconfiguration/indexq aRq Xrsyslog-example.confq q sh]qh aRqbUappqNU _warnfuncqNUtitlesq}q(Xconfiguration/modules/gssapiqcdocutils.nodes title q)q}q(U rawsourceqUU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq]Uidsq]Unamesq]uUchildrenq ]q!cdocutils.nodes Text q"X#GSSAPI module support in rsyslog v3q#q$}q%(hX#GSSAPI module support in rsyslog v3q&Uparentq'hubaUtagnameq(Utitleq)ubXconfiguration/modules/ommailq*h)q+}q,(hUh}q-(h]h]h]h]h]uh ]q.h"Xommail: Mail Output Moduleq/q0}q1(hXommail: Mail Output Moduleq2h'h+ubah(h)ubX,configuration/global/options/rsconf1_modloadq3h)q4}q5(hUh}q6(h]h]h]h]h]uh ]q7h"X$ModLoadq8q9}q:(hX$ModLoadq;h'h4ubah(h)ubXconfiguration/modules/mmcountq(hUh}q?(h]h]h]h]h]uh ]q@h"XmmcountqAqB}qC(hXmmcountqDh'h=ubah(h)ubXconfiguration/modules/omhttpfsqEh)qF}qG(hUh}qH(h]h]h]h]h]uh ]qIh"X%omhttpfs: Hadoop HTTPFS Output ModuleqJqK}qL(hX%omhttpfs: Hadoop HTTPFS Output ModuleqMh'hFubah(h)ubX!configuration/modules/mmnormalizeqNh)qO}qP(hUh}qQ(h]h]h]h]h]uh ]qRh"X.Log Message Normalization Module (mmnormalize)qSqT}qU(hX.Log Message Normalization Module (mmnormalize)qVh'hOubah(h)ubXtutorials/databaseqWh)qX}qY(hUh}qZ(h]h]h]h]h]uh ]q[h"XLWriting syslog messages to MySQL, PostgreSQL or any other supported Databaseq\q]}q^(hXLWriting syslog messages to MySQL, PostgreSQL or any other supported Databaseq_h'hXubah(h)ubXconfiguration/modules/imfileq`h)qa}qb(hUh}qc(h]h]h]h]h]uh ]qdh"Ximfile: Text File Input Moduleqeqf}qg(hXimfile: Text File Input Moduleqhh'haubah(h)ubXconcepts/queuesqih)qj}qk(hUh}ql(h]h]h]h]h]uh ]qmh"XUnderstanding rsyslog Queuesqnqo}qp(hXUnderstanding rsyslog Queuesqqh'hjubah(h)ubX5configuration/global/options/rsconf1_mainmsgqueuesizeqrh)qs}qt(hUh}qu(h]h]h]h]h]uh ]qvh"X$MainMsgQueueSizeqwqx}qy(hX$MainMsgQueueSizeqzh'hsubah(h)ubX-configuration/action/rsconf1_omfileforcechownq{h)q|}q}(hUh}q~(h]h]h]h]h]uh ]qh"X$omfileForceChownqq}q(hX$omfileForceChownqh'h|ubah(h)ubXconfiguration/dropprivqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XDropping privileges in rsyslogqq}q(hXDropping privileges in rsyslogqh'hubah(h)ubX$configuration/modules/idx_messagemodqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XMessage Modification Modulesqq}q(hXMessage Modification Modulesqh'hubah(h)ubX$configuration/input_directives/indexqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X)Legacy Directives affecting Input Modulesqq}q(hX)Legacy Directives affecting Input Modulesqh'hubah(h)ubXconfiguration/modules/ommysqlqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X%ommysql: MySQL Database Output Moduleqq}q(hX%ommysql: MySQL Database Output Moduleqh'hubah(h)ubX configuration/modules/omudpspoofqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X&omudpspoof: UDP spoofing output moduleqq}q(hX&omudpspoof: UDP spoofing output moduleqh'hubah(h)ubXconfiguration/parserqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XParserqq}q(hXParserqh'hubah(h)ubXdevelopment/indexqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X Developmentqq}q(hX Developmentqh'hubah(h)ubX'rainerscript/rainerscript_call_indirectqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X%The rsyslog "call_indirect" statementqȅq}q(hX%The rsyslog "call_indirect" statementqh'hubah(h)ubXrainerscript/queue_parametersqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XGeneral Queue Parametersqхq}q(hXGeneral Queue Parametersqh'hubah(h)ubX9configuration/global/options/rsconf1_debugprintmodulelistqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X$DebugPrintModuleListqڅq}q(hX$DebugPrintModuleListqh'hubah(h)ubXconfiguration/modules/imtcpqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"Ximtcp: TCP Syslog Input Moduleqㅁq}q(hXimtcp: TCP Syslog Input Moduleqh'hubah(h)ubXconfiguration/basic_structureqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XBasic Structureq셁q}q(hXBasic Structureqh'hubah(h)ubX configuration/config_param_typesqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"XConfiguration Parameter Typesqq}q(hXConfiguration Parameter Typesqh'hubah(h)ubX8configuration/global/options/rsconf1_generateconfiggraphqh)q}q(hUh}q(h]h]h]h]h]uh ]qh"X$GenerateConfigGraphqq}r(hX$GenerateConfigGraphrh'hubah(h)ubXconfiguration/global/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X&Legacy Global Configuration Statementsrr}r (hX&Legacy Global Configuration Statementsr h'jubah(h)ubXconcepts/indexr h)r }r (hUh}r(h]h]h]h]h]uh ]rh"XConceptsrr}r(hXConceptsrh'j ubah(h)ubX"rainerscript/configuration_objectsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xconfiguration objectsrr}r(hXconfiguration objectsrh'jubah(h)ubXrainerscript/lookup_tablesrh)r}r(hUh}r (h]h]h]h]h]uh ]r!h"X Lookup Tablesr"r#}r$(hX Lookup Tablesr%h'jubah(h)ubXdevelopment/generic_designr&h)r'}r((hUh}r)(h]h]h]h]h]uh ]r*h"XGeneric design of a syslogdr+r,}r-(hXGeneric design of a syslogdr.h'j'ubah(h)ubX!configuration/modules/mmjsonparser/h)r0}r1(hUh}r2(h]h]h]h]h]uh ]r3h"X;JSON/CEE Structured Content Extraction Module (mmjsonparse)r4r5}r6(hX;JSON/CEE Structured Content Extraction Module (mmjsonparse)r7h'j0ubah(h)ubX"configuration/modules/mmpstrucdatar8h)r9}r:(hUh}r;(h]h]h]h]h]uh ]r<h"X5RFC5424 structured data parsing module (mmpstrucdata)r=r>}r?(hX5RFC5424 structured data parsing module (mmpstrucdata)r@h'j9ubah(h)ubXinstallation/build_from_reporAh)rB}rC(hUh}rD(h]h]h]h]h]uh ]rEh"X-Installing rsyslog from the source repositoryrFrG}rH(hX-Installing rsyslog from the source repositoryrIh'jBubah(h)ubX+configuration/global/options/rsconf1_moddirrJh)rK}rL(hUh}rM(h]h]h]h]h]uh ]rNh"X$ModDirrOrP}rQ(hX$ModDirrRh'jKubah(h)ubXwhitepapers/preserve_in_natrSh)rT}rU(hUh}rV(h]h]h]h]h]uh ]rWh"X!Preserving syslog sender over NATrXrY}rZ(hX!Preserving syslog sender over NATr[h'jTubah(h)ubXconfiguration/modules/omsnmpr\h)r]}r^(hUh}r_(h]h]h]h]h]uh ]r`h"Xomsnmp: SNMP Trap Output Modulerarb}rc(hXomsnmp: SNMP Trap Output Modulerdh'j]ubah(h)ubXconfiguration/property_replacerreh)rf}rg(hUh}rh(h]h]h]h]h]uh ]rih"XThe Property Replacerrjrk}rl(hXThe Property Replacerrmh'jfubah(h)ubXtroubleshooting/troubleshootrnh)ro}rp(hUh}rq(h]h]h]h]h]uh ]rrh"Xtroubleshooting problemsrsrt}ru(hXtroubleshooting problemsrvh'joubah(h)ubX&configuration/action/rsconf1_fileownerrwh)rx}ry(hUh}rz(h]h]h]h]h]uh ]r{h"X $FileOwnerr|r}}r~(hX $FileOwnerrh'jxubah(h)ubXtutorials/reliable_forwardingrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X3Reliable Forwarding of syslog Messages with Rsyslogrr}r(hX3Reliable Forwarding of syslog Messages with Rsyslogrh'jubah(h)ubXcompatibility/v6compatibilityrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X"Compatibility Notes for rsyslog v6rr}r(hX"Compatibility Notes for rsyslog v6rh'jubah(h)ubX configuration/modules/mmsequencerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X0Number generator and counter module (mmsequence)rr}r(hX0Number generator and counter module (mmsequence)rh'jubah(h)ubXtroubleshooting/debugrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XRsyslog Debug Supportrr}r(hXRsyslog Debug Supportrh'jubah(h)ubX!configuration/modules/sigprov_ksirh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X/Keyless Signature Infrastructure Provider (ksi)rr}r(hX/Keyless Signature Infrastructure Provider (ksi)rh'jubah(h)ubX tutorials/tlsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X8Encrypting Syslog Traffic with TLS (SSL) [short version]rr}r(hX8Encrypting Syslog Traffic with TLS (SSL) [short version]rh'jubah(h)ubXconfiguration/modules/imgssapirh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$imgssapi: GSSAPI Syslog Input Modulerr}r(hX$imgssapi: GSSAPI Syslog Input Modulerh'jubah(h)ubX4configuration/ruleset/rsconf1_rulesetcreatemainqueuerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$RulesetCreateMainQueuerr}r(hX$RulesetCreateMainQueuerh'jubah(h)ubXconfiguration/modules/omjournalrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X!omjournal: Systemd Journal Outputrr}r(hX!omjournal: Systemd Journal Outputrh'jubah(h)ubXCconfiguration/global/options/rsconf1_debugprintcfsyslinehandlerlistrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$DebugPrintCFSyslineHandlerListrr}r(hX$DebugPrintCFSyslineHandlerListrh'jubah(h)ubX tutorials/failover_syslog_serverrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XFailover Syslog Serverrr}r(hXFailover Syslog Serverrh'jubah(h)ubXcompatibility/v3compatibilityrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X"Compatibility Notes for rsyslog v3rr}r(hX"Compatibility Notes for rsyslog v3rh'jubah(h)ubXtutorials/tls_cert_udp_relayrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XSetting up the UDP syslog relayrr}r(hXSetting up the UDP syslog relayrh'jubah(h)ubXconfiguration/modules/imudprh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Ximudp: UDP Syslog Input Modulerr}r(hXimudp: UDP Syslog Input Modulerh'jubah(h)ubX%configuration/modules/omelasticsearchrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X,omelasticsearch: Elasticsearch Output Modulerr}r(hX,omelasticsearch: Elasticsearch Output Modulerh'jubah(h)ubXproposals/indexrh)r}r (hUh}r (h]h]h]h]h]uh ]r h"X Proposalsr r }r(hX Proposalsrh'jubah(h)ubX1configuration/action/rsconf1_actionresumeintervalrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$ActionResumeIntervalrr}r(hX$ActionResumeIntervalrh'jubah(h)ubXwhitepapers/reliable_loggingrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X(How reliable should reliable logging be?rr}r (hX(How reliable should reliable logging be?r!h'jubah(h)ubXrainerscript/constant_stringsr"h)r#}r$(hUh}r%(h]h]h]h]h]uh ]r&h"XConstant Stringsr'r(}r)(hXConstant Stringsr*h'j#ubah(h)ubXcompatibility/v4compatibilityr+h)r,}r-(hUh}r.(h]h]h]h]h]uh ]r/h"X"Compatibility Notes for rsyslog v4r0r1}r2(hX"Compatibility Notes for rsyslog v4r3h'j,ubah(h)ubXconfiguration/modules/omrelpr4h)r5}r6(hUh}r7(h]h]h]h]h]uh ]r8h"Xomrelp: RELP Output Moduler9r:}r;(hXomrelp: RELP Output Moduler<h'j5ubah(h)ubXconfiguration/modules/imsolarisr=h)r>}r?(hUh}r@(h]h]h]h]h]uh ]rAh"Ximsolaris: Solaris Input ModulerBrC}rD(hXimsolaris: Solaris Input ModulerEh'j>ubah(h)ubXconfiguration/modules/mmfieldsrFh)rG}rH(hUh}rI(h]h]h]h]h]uh ]rJh"X#Fields Extraction Module (mmfields)rKrL}rM(hX#Fields Extraction Module (mmfields)rNh'jGubah(h)ubXconfiguration/actionsrOh)rP}rQ(hUh}rR(h]h]h]h]h]uh ]rSh"XActionsrTrU}rV(hXActionsrWh'jPubah(h)ubh h)rX}rY(hUh}rZ(h]h]h]h]h]uh ]r[h"X Configurationr\r]}r^(hX Configurationr_h'jXubah(h)ubXconfiguration/ruleset/indexr`h)ra}rb(hUh}rc(h]h]h]h]h]uh ]rdh"X0Ruleset-Specific Legacy Configuration Statementsrerf}rg(hX0Ruleset-Specific Legacy Configuration Statementsrhh'jaubah(h)ubXGconfiguration/input_directives/rsconf1_escapecontrolcharactersonreceiverih)rj}rk(hUh}rl(h]h]h]h]h]uh ]rmh"X!$EscapeControlCharactersOnReceivernro}rp(hX!$EscapeControlCharactersOnReceiverqh'jjubah(h)ubXhistorical/stunnelrrh)rs}rt(hUh}ru(h]h]h]h]h]uh ]rvh"X"SSL Encrypting Syslog with Stunnelrwrx}ry(hX"SSL Encrypting Syslog with Stunnelrzh'jsubah(h)ubXwhitepapers/syslog_parsingr{h)r|}r}(hUh}r~(h]h]h]h]h]uh ]rh"Xsyslog parsing in rsyslogrr}r(hXsyslog parsing in rsyslogrh'j|ubah(h)ubXconcepts/multi_rulesetrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XMultiple Rulesets in rsyslogrr}r(hXMultiple Rulesets in rsyslogrh'jubah(h)ubXrainerscript/control_structuresrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XControl Structuresrr}r(hXControl Structuresrh'jubah(h)ubXcompatibility/v8compatibilityrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X"Compatibility Notes for rsyslog v8rr}r(hX"Compatibility Notes for rsyslog v8rh'jubah(h)ubX!configuration/modules/idx_libraryrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XLibrary Modulesrr}r(hXLibrary Modulesrh'jubah(h)ubXinstallation/packagesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XInstalling rsyslog from Packagerr}r(hXInstalling rsyslog from Packagerh'jubah(h)ubXinstallation/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Installationrr}r(hX Installationrh'jubah(h)ubX%configuration/action/rsconf1_dirownerrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X $DirOwnerrr}r(hX $DirOwnerrh'jubah(h)ubXtutorials/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Tutorialsrr}r(hX Tutorialsrh'jubah(h)ubXconfiguration/modules/pmrfc3164rh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X+pmrfc3164: Parse RFC3164-formatted messagesrr}r(hX+pmrfc3164: Parse RFC3164-formatted messagesrh'jubah(h)ubXconfiguration/modules/omfilerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xomfile: File Output Modulerr}r(hXomfile: File Output Modulerh'jubah(h)ubXtutorials/tls_cert_clientrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XSetting up a clientrr}r(hXSetting up a clientrh'jubah(h)ubXconfiguration/modules/impstatsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X;impstats: Generate Periodic Statistics of Internal Countersrr}r(hX;impstats: Generate Periodic Statistics of Internal Countersrh'jubah(h)ubXdevelopment/dev_queuerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XThe rsyslog queue objectrr}r(hXThe rsyslog queue objectrh'jubah(h)ubXconfiguration/modules/imptcprh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Ximptcp: Plain TCP Syslogrr}r(hXimptcp: Plain TCP Syslogrh'jubah(h)ubXIconfiguration/input_directives/rsconf1_dropmsgswithmaliciousdnsptrrecordsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X#$DropMsgsWithMaliciousDnsPTRRecordsrr}r (hX#$DropMsgsWithMaliciousDnsPTRRecordsr h'jubah(h)ubXwhitepapers/syslog_protocolr h)r }r (hUh}r(h]h]h]h]h]uh ]rh"X"syslog-protocol support in rsyslogrr}r(hX"syslog-protocol support in rsyslogrh'j ubah(h)ubX configuration/modules/idx_parserrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XParser Modulesrr}r(hXParser Modulesrh'jubah(h)ubXdevelopment/dev_opluginsrh)r}r(hUh}r (h]h]h]h]h]uh ]r!h"XWriting Rsyslog Output Pluginsr"r#}r$(hXWriting Rsyslog Output Pluginsr%h'jubah(h)ubXconfiguration/modules/omhiredisr&h)r'}r((hUh}r)(h]h]h]h]h]uh ]r*h"Xomhiredis: Redis Output Moduler+r,}r-(hXomhiredis: Redis Output Moduler.h'j'ubah(h)ubXexamples/indexr/h)r0}r1(hUh}r2(h]h]h]h]h]uh ]r3h"XExample Use Casesr4r5}r6(hXExample Use Casesr7h'j0ubah(h)ubXconfiguration/index_directivesr8h)r9}r:(hUh}r;(h]h]h]h]h]uh ]r<h"XLegacy Configuration Directivesr=r>}r?(hXLegacy Configuration Directivesr@h'j9ubah(h)ubXconfiguration/modules/workflowrAh)rB}rC(hUh}rD(h]h]h]h]h]uh ]rEh"X7Where are the modules integrated into the Message Flow?rFrG}rH(hX7Where are the modules integrated into the Message Flow?rIh'jBubah(h)ubXconfiguration/modules/ompgsqlrJh)rK}rL(hUh}rM(h]h]h]h]h]uh ]rNh"X*ompgsql: PostgreSQL Database Output ModulerOrP}rQ(hX*ompgsql: PostgreSQL Database Output ModulerRh'jKubah(h)ubXtutorials/tls_cert_machinerSh)rT}rU(hUh}rV(h]h]h]h]h]uh ]rWh"X"Generating the machine certificaterXrY}rZ(hX"Generating the machine certificater[h'jTubah(h)ubXconfiguration/output_channelsr\h)r]}r^(hUh}r_(h]h]h]h]h]uh ]r`h"XOutput Channelsrarb}rc(hXOutput Channelsrdh'j]ubah(h)ubX@configuration/input_directives/rsconf1_droptrailinglfonreceptionreh)rf}rg(hUh}rh(h]h]h]h]h]uh ]rih"X$DropTrailingLFOnReceptionrjrk}rl(hX$DropTrailingLFOnReceptionrmh'jfubah(h)ubXtutorials/tls_cert_errmsgsrnh)ro}rp(hUh}rq(h]h]h]h]h]uh ]rrh"XError Messagesrsrt}ru(hXError Messagesrvh'joubah(h)ubXconfiguration/nomatchrwh)rx}ry(hUh}rz(h]h]h]h]h]uh ]r{h"XProperty Replacer nomatch moder|r}}r~(hXProperty Replacer nomatch moderh'jxubah(h)ubX8configuration/input_directives/rsconf1_markmessageperiodrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$MarkMessagePeriodrr}r(hX$MarkMessagePeriodrh'jubah(h)ubXconfiguration/propertiesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xrsyslog Propertiesrr}r(hXrsyslog Propertiesrh'jubah(h)ubX troubleshooting/file_not_writtenrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Output File is not Being Writtenrr}r(hX Output File is not Being Writtenrh'jubah(h)ubXcompatibility/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Compatibilityrr}r(hX Compatibilityrh'jubah(h)ubXrainerscript/data_typesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Data Typesrr}r(hX Data Typesrh'jubah(h)ubX&configuration/modules/mmrfc5424addhmacrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xmmrfc5424addhmacrr}r(hXmmrfc5424addhmacrh'jubah(h)ubXBconfiguration/action/rsconf1_actionexeconlywhenpreviousissuspendedrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X&$ActionExecOnlyWhenPreviousIsSuspendedrr}r(hX&$ActionExecOnlyWhenPreviousIsSuspendedrh'jubah(h)ubX.configuration/action/rsconf1_dynafilecachesizerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$DynaFileCacheSizerr}r(hX$DynaFileCacheSizerh'jubah(h)ubXcompatibility/v5compatibilityrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X"Compatibility Notes for rsyslog v5rr}r(hX"Compatibility Notes for rsyslog v5rh'jubah(h)ubXhistoryrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XRSyslog - Historyrr}r(hXRSyslog - Historyrh'jubah(h)ubXhistorical/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XHistorical Documentsrr}r(hXHistorical Documentsrh'jubah(h)ubX!configuration/modules/pmrfc3164sdrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XBpmrfc3164sd: Parse RFC5424 structured data inside RFC3164 messagesrr}r(hXBpmrfc3164sd: Parse RFC5424 structured data inside RFC3164 messagesrh'jubah(h)ubXtutorials/high_database_raterh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X;Handling a massive syslog database insert rate with Rsyslogrr}r(hX;Handling a massive syslog database insert rate with Rsyslogrh'jubah(h)ubXconfiguration/modules/imklogrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Ximklog: Kernel Log Input Modulerr}r(hXimklog: Kernel Log Input Modulerh'jubah(h)ubXfeaturesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XRSyslog - Featuresrr}r(hXRSyslog - Featuresrh'jubah(h)ubX$configuration/action/rsconf1_gssmoderh)r}r (hUh}r (h]h]h]h]h]uh ]r h"X$GssModer r }r(hX$GssModerh'jubah(h)ubX communityrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XCommunity Resourcesrr}r(hXCommunity Resourcesrh'jubah(h)ubXdevelopment/config_data_modelrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XThe rsyslog config data modelrr}r (hXThe rsyslog config data modelr!h'jubah(h)ubXconfiguration/modules/ommongodbr"h)r#}r$(hUh}r%(h]h]h]h]h]uh ]r&h"X ommongodb: MongoDB Output Moduler'r(}r)(hX ommongodb: MongoDB Output Moduler*h'j#ubah(h)ubXrainerscript/globalr+h)r,}r-(hUh}r.(h]h]h]h]h]uh ]r/h"Xglobal() configuration objectr0r1}r2(hXglobal() configuration objectr3h'j,ubah(h)ubXconfiguration/action/indexr4h)r5}r6(hUh}r7(h]h]h]h]h]uh ]r8h"X/Legacy Action-Specific Configuration Statementsr9r:}r;(hX/Legacy Action-Specific Configuration Statementsr<h'j5ubah(h)ubX licensingr=h)r>}r?(hUh}r@(h]h]h]h]h]uh ]rAh"X LicensingrBrC}rD(hX LicensingrEh'j>ubah(h)ubXconfiguration/inputrFh)rG}rH(hUh}rI(h]h]h]h]h]uh ]rJh"XInputrKrL}rM(hXInputrNh'jGubah(h)ubXproposals/version_namingrOh)rP}rQ(hUh}rR(h]h]h]h]h]uh ]rSh"XVersion NamingrTrU}rV(hXVersion NamingrWh'jPubah(h)ubX1configuration/action/rsconf1_repeatedmsgreductionrXh)rY}rZ(hUh}r[(h]h]h]h]h]uh ]r\h"X$RepeatedMsgReductionr]r^}r_(hX$RepeatedMsgReductionr`h'jYubah(h)ubXtroubleshooting/selinuxrah)rb}rc(hUh}rd(h]h]h]h]h]uh ]reh"X&Troubleshooting SELinux-Related Issuesrfrg}rh(hX&Troubleshooting SELinux-Related Issuesrih'jbubah(h)ubXconfiguration/modules/mmanonrjh)rk}rl(hUh}rm(h]h]h]h]h]uh ]rnh"X(IP Address Anonymization Module (mmanon)rorp}rq(hX(IP Address Anonymization Module (mmanon)rrh'jkubah(h)ubXrainerscript/indexrsh)rt}ru(hUh}rv(h]h]h]h]h]uh ]rwh"X RainerScriptrxry}rz(hX RainerScriptr{h'jtubah(h)ubXconfiguration/modules/indexr|h)r}}r~(hUh}r(h]h]h]h]h]uh ]rh"XModulesrr}r(hXModulesrh'j}ubah(h)ubXtutorials/tls_cert_summaryrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X(Encrypting Syslog Traffic with TLS (SSL)rr}r(hX(Encrypting Syslog Traffic with TLS (SSL)rh'jubah(h)ubXrainerscript/functionsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Functionsrr}r(hX Functionsrh'jubah(h)ubXconfiguration/modules/ompiperh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xompipe: Pipe Output Modulerr}r(hXompipe: Pipe Output Modulerh'jubah(h)ubXconfiguration/timezonerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xtimezonerr}r(hXtimezonerh'jubah(h)ubXtutorials/tls_cert_carh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XSetting up the CArr}r(hXSetting up the CArh'jubah(h)ubX.historical/multi_ruleset_legacy_format_samplesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X+Legacy Format Samples for Multiple Rulesetsrr}r(hX+Legacy Format Samples for Multiple Rulesetsrh'jubah(h)ubXconcepts/ns_gtlsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xgtls Network Stream Driverrr}r(hXgtls Network Stream Driverrh'jubah(h)ubXconfiguration/examplesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XExamplesrr}r(hXExamplesrh'jubah(h)ubXconcepts/netstrm_drvrrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XNetStream Driversrr}r(hXNetStream Driversrh'jubah(h)ubX?configuration/input_directives/rsconf1_escape8bitcharsonreceiverh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$Escape8BitCharactersOnReceiverr}r(hX$Escape8BitCharactersOnReceiverh'jubah(h)ubXconcepts/janitorrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XThe Janitor Processrr}r(hXThe Janitor Processrh'jubah(h)ubXtutorials/recording_prirh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X)Recording the Priority of Syslog Messagesrr}r(hX)Recording the Priority of Syslog Messagesrh'jubah(h)ubX&configuration/action/rsconf1_filegrouprh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X $FileGrouprr}r(hX $FileGrouprh'jubah(h)ubXconfiguration/modules/pmrfc5424rh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X+pmrfc5424: Parse RFC5424-formatted messagesrr}r(hX+pmrfc5424: Parse RFC5424-formatted messagesrh'jubah(h)ubXdevelopment/dev_codestylerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xrsylog code stylerr }r (hXrsylog code styler h'jubah(h)ubXconfiguration/modules/pmlastmsgr h)r }r(hUh}r(h]h]h]h]h]uh ]rh"X(pmlastmsg: last message repeated n timesrr}r(hX(pmlastmsg: last message repeated n timesrh'j ubah(h)ubX2configuration/global/options/rsconf1_includeconfigrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$IncludeConfigrr}r(hX$IncludeConfigrh'jubah(h)ubXconfiguration/filtersrh)r}r (hUh}r!(h]h]h]h]h]uh ]r"h"XFilter Conditionsr#r$}r%(hXFilter Conditionsr&h'jubah(h)ubXconfiguration/modules/omfwdr'h)r(}r)(hUh}r*(h]h]h]h]h]uh ]r+h"X&omfwd: syslog Forwarding Output Moduler,r-}r.(hX&omfwd: syslog Forwarding Output Moduler/h'j(ubah(h)ubXcompatibility/v7compatibilityr0h)r1}r2(hUh}r3(h]h]h]h]h]uh ]r4h"X"Compatibility Notes for rsyslog v7r5r6}r7(hX"Compatibility Notes for rsyslog v7r8h'j1ubah(h)ubX$rainerscript/variable_property_typesr9h)r:}r;(hUh}r<(h]h]h]h]h]uh ]r=h"XVariable (Property) typesr>r?}r@(hXVariable (Property) typesrAh'j:ubah(h)ubXtutorials/tls_cert_serverrBh)rC}rD(hUh}rE(h]h]h]h]h]uh ]rFh"XSetting up the Central ServerrGrH}rI(hXSetting up the Central ServerrJh'jCubah(h)ubX*configuration/global/options/rsconf1_umaskrKh)rL}rM(hUh}rN(h]h]h]h]h]uh ]rOh"X$UMASKrPrQ}rR(hX$UMASKrSh'jLubah(h)ubXconcepts/ns_ptcprTh)rU}rV(hUh}rW(h]h]h]h]h]uh ]rXh"Xptcp Network Stream DriverrYrZ}r[(hXptcp Network Stream Driverr\h'jUubah(h)ubXconfiguration/ipv6r]h)r^}r_(hUh}r`(h]h]h]h]h]uh ]rah"X!Notes on IPv6 Handling in Rsyslogrbrc}rd(hX!Notes on IPv6 Handling in Rsyslogreh'j^ubah(h)ubXtutorials/tls_cert_scenariorfh)rg}rh(hUh}ri(h]h]h]h]h]uh ]rjh"X*Sample Use Case: Single Central Log Serverrkrl}rm(hX*Sample Use Case: Single Central Log Serverrnh'jgubah(h)ubX9configuration/global/options/rsconf1_abortonuncleanconfigroh)rp}rq(hUh}rr(h]h]h]h]h]uh ]rsh"X$AbortOnUncleanConfigrtru}rv(hX$AbortOnUncleanConfigrwh'jpubah(h)ubX9configuration/global/options/rsconf1_resetconfigvariablesrxh)ry}rz(hUh}r{(h]h]h]h]h]uh ]r|h"X$ResetConfigVariablesr}r~}r(hX$ResetConfigVariablesrh'jyubah(h)ubX7configuration/global/options/rsconf1_failonchownfailurerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$FailOnChownFailurerr}r(hX$FailOnChownFailurerh'jubah(h)ubXconfiguration/modules/omprogrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X)omprog: Program integration Output modulerr}r(hX)omprog: Program integration Output modulerh'jubah(h)ubXtroubleshooting/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XTroubleshootingrr}r(hXTroubleshootingrh'jubah(h)ubXhistorical/module_develrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X%Developing rsyslog modules (outdated)rr}r(hX%Developing rsyslog modules (outdated)rh'jubah(h)ubX+configuration/action/rsconf1_filecreatemoderh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$FileCreateModerr}r(hX$FileCreateModerh'jubah(h)ubXhistorical/php_syslog_ngrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Using php-syslog-ng with rsyslogrr}r(hX Using php-syslog-ng with rsyslogrh'jubah(h)ubXconfiguration/modules/omuxsockrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$omuxsock: Unix sockets Output Modulerr}r(hX$omuxsock: Unix sockets Output Modulerh'jubah(h)ubX1configuration/global/options/rsconf1_maxopenfilesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X $MaxOpenFilesrr}r(hX $MaxOpenFilesrh'jubah(h)ubX#configuration/modules/idx_stringgenrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XString Generator Modulesrr}r(hXString Generator Modulesrh'jubah(h)ubX configuration/modules/mmdblookuprh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$MaxMind/GeoIP DB lookup (mmdblookup)rr}r(hX$MaxMind/GeoIP DB lookup (mmdblookup)rh'jubah(h)ubXconfiguration/modules/omkafkarh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Xomkafka: write to Apache Kafkarr}r(hXomkafka: write to Apache Kafkarh'jubah(h)ubX installation/install_from_sourcerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XInstalling rsyslog from Sourcerr}r(hXInstalling rsyslog from Sourcerh'jubah(h)ubXconfiguration/modules/idx_inputrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Input Modulesrr}r(hX Input Modulesrh'jubah(h)ubXconfiguration/modules/imkmsgrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X"imkmsg: /dev/kmsg Log Input Modulerr}r(hX"imkmsg: /dev/kmsg Log Input Modulerh'jubah(h)ubXconfiguration/modules/omstdoutrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X/omstdout: stdout output module (testbench tool)rr}r(hX/omstdout: stdout output module (testbench tool)rh'jubah(h)ubXconfiguration/dyn_statsrh)r }r (hUh}r (h]h]h]h]h]uh ]r h"X Dynamic Statsr r}r(hX Dynamic Statsrh'j ubah(h)ubX configuration/modules/mmexternalrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X8Support module for external message modification modulesrr}r(hX8Support module for external message modification modulesrh'jubah(h)ubX"configuration/modules/mmrm1stspacerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X-mmrm1stspace: First Space Modification Modulerr }r!(hX-mmrm1stspace: First Space Modification Moduler"h'jubah(h)ubX free_supportr#h)r$}r%(hUh}r&(h]h]h]h]h]uh ]r'h"XFree Services for Rsyslogr(r)}r*(hXFree Services for Rsyslogr+h'j$ubah(h)ubXwhitepapers/queues_analogyr,h)r-}r.(hUh}r/(h]h]h]h]h]uh ]r0h"X Turning Lanes and Rsyslog Queuesr1r2}r3(hX Turning Lanes and Rsyslog Queuesr4h'j-ubah(h)ubXconfiguration/modules/imjournalr5h)r6}r7(hUh}r8(h]h]h]h]h]uh ]r9h"X'imjournal: Systemd Journal Input Moduler:r;}r<(hX'imjournal: Systemd Journal Input Moduler=h'j6ubah(h)ubX%configuration/action/rsconf1_dirgroupr>h)r?}r@(hUh}rA(h]h]h]h]h]uh ]rBh"X $DirGrouprCrD}rE(hX $DirGrouprFh'j?ubah(h)ubX!configuration/modules/mmsnmptrapdrGh)rH}rI(hUh}rJ(h]h]h]h]h]uh ]rKh"X'mmsnmptrapd message modification modulerLrM}rN(hX'mmsnmptrapd message modification modulerOh'jHubah(h)ubX configuration/modules/pmciscoiosrPh)rQ}rR(hUh}rS(h]h]h]h]h]uh ]rTh"X pmciscoiosrUrV}rW(hX pmciscoiosrXh'jQubah(h)ubXconfiguration/modules/imuxsockrYh)rZ}r[(hUh}r\(h]h]h]h]h]uh ]r]h"Ximuxsock: Unix Socket Inputr^r_}r`(hXimuxsock: Unix Socket Inputrah'jZubah(h)ubXconfiguration/modules/omlibdbirbh)rc}rd(hUh}re(h]h]h]h]h]uh ]rfh"X(omlibdbi: Generic Database Output Modulergrh}ri(hX(omlibdbi: Generic Database Output Modulerjh'jcubah(h)ubX configuration/modules/sigprov_gtrkh)rl}rm(hUh}rn(h]h]h]h]h]uh ]roh"X%GuardTime Log Signature Provider (gt)rprq}rr(hX%GuardTime Log Signature Provider (gt)rsh'jlubah(h)ubXconfiguration/modules/omamqp1rth)ru}rv(hUh}rw(h]h]h]h]h]uh ]rxh"X)omamqp1: AMQP 1.0 Messaging Output Moduleryrz}r{(hX)omamqp1: AMQP 1.0 Messaging Output Moduler|h'juubah(h)ubXexamples/high_performancer}h)r~}r(hUh}r(h]h]h]h]h]uh ]rh"X;Receiving massive amounts of messages with high performancerr}r(hX;Receiving massive amounts of messages with high performancerh'j~ubah(h)ubXconfiguration/modules/omhdfsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X'omhdfs: Hadoop Filesystem Output Modulerr}r(hX'omhdfs: Hadoop Filesystem Output Modulerh'jubah(h)ubX;configuration/global/options/rsconf1_debugprinttemplatelistrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$DebugPrintTemplateListrr}r(hX$DebugPrintTemplateListrh'jubah(h)ubXconfiguration/modules/mmutf8fixrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X'Fix invalid UTF-8 Sequences (mmutf8fix)rr}r(hX'Fix invalid UTF-8 Sequences (mmutf8fix)rh'jubah(h)ubXconfiguration/modules/imrelprh)r}r(hUh}r(h]h]h]h]h]uh ]rh"Ximrelp: RELP Input Modulerr}r(hXimrelp: RELP Input Modulerh'jubah(h)ubXindexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XWelcome to Rsyslogrr}r(hXWelcome to Rsyslogrh'jubah(h)ubXconfiguration/modules/pmnullrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X!pmnull: Syslog Null Parser Modulerr}r(hX!pmnull: Syslog Null Parser Modulerh'jubah(h)ubXwhitepapers/indexrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XRsyslog Whitepapersrr}r(hXRsyslog Whitepapersrh'jubah(h)ubXconfiguration/cryprov_gcryrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$libgcrypt Log Crypto Provider (gcry)rr}r(hX$libgcrypt Log Crypto Provider (gcry)rh'jubah(h)ubXconfiguration/modules/omrulesetrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X*omruleset: ruleset output/including modulerr}r(hX*omruleset: ruleset output/including modulerh'jubah(h)ubXconfiguration/templatesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Templatesrr}r(hX Templatesrh'jubah(h)ubXCconfiguration/input_directives/rsconf1_controlcharacterescapeprefixrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X$ControlCharacterEscapePrefixrr}r(hX$ControlCharacterEscapePrefixrh'jubah(h)ubXrainerscript/rainerscript_callrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XThe rsyslog "call" statementrr}r(hXThe rsyslog "call" statementrh'jubah(h)ubXconfiguration/modules/omoraclerh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X'omoracle: Oracle Database Output Modulerr}r(hX'omoracle: Oracle Database Output Modulerh'jubah(h)ubXconcepts/messageparserrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"XMessage parsers in rsyslogrr}r(hXMessage parsers in rsyslogrh'jubah(h)ubXproposals/lookup_tablesrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Lookup Tablesr r }r (hX Lookup Tablesr h'jubah(h)ubXtutorials/log_rotation_fix_sizer h)r}r(hUh}r(h]h]h]h]h]uh ]rh"XLog rotation with rsyslogrr}r(hXLog rotation with rsyslogrh'jubah(h)ubXrainerscript/expressionsrh)r}r(hUh}r(h]h]h]h]h]uh ]rh"X Expressionsrr}r(hX Expressionsrh'jubah(h)ubXconfiguration/lookup_tablesrh)r }r!(hUh}r"(h]h]h]h]h]uh ]r#h"X Lookup Tablesr$r%}r&(hX Lookup Tablesr'h'j ubah(h)ubXconfiguration/modules/im3195r(h)r)}r*(hUh}r+(h]h]h]h]h]uh ]r,h"Xim3195: RFC3195 Input Moduler-r.}r/(hXim3195: RFC3195 Input Moduler0h'j)ubah(h)ubX2configuration/action/rsconf1_gssforwardservicenamer1h)r2}r3(hUh}r4(h]h]h]h]h]uh ]r5h"X$GssForwardServiceNamer6r7}r8(hX$GssForwardServiceNamer9h'j2ubah(h)ubXhow2helpr:h)r;}r<(hUh}r=(h]h]h]h]h]uh ]r>h"XHow you can Helpr?r@}rA(hXHow you can HelprBh'j;ubah(h)ubX4configuration/input_directives/rsconf1_allowedsenderrCh)rD}rE(hUh}rF(h]h]h]h]h]uh ]rGh"X$AllowedSenderrHrI}rJ(hX$AllowedSenderrKh'jDubah(h)ubX configuration/modules/idx_outputrLh)rM}rN(hUh}rO(h]h]h]h]h]uh ]rPh"XOutput ModulesrQrR}rS(hXOutput ModulesrTh'jMubah(h)ubX+configuration/ruleset/rsconf1_rulesetparserrUh)rV}rW(hUh}rX(h]h]h]h]h]uh ]rYh"X$RulesetParserrZr[}r\(hX$RulesetParserr]h'jVubah(h)ubXtutorials/gelf_forwardingr^h)r_}r`(hUh}ra(h]h]h]h]h]uh ]rbh"XGELF forwarding in rsyslogrcrd}re(hXGELF forwarding in rsyslogrfh'j_ubah(h)ubuU domaindatarg}rh(Ustdri}rj(UversionrkKU anonlabelsrl}rm(XuidjUuidX searchtypejU searchtypeUmodindexrnU py-modindexUXdynsearchindexjUdynsearchindexXserverjUserverXglobal_janitorintervalroj+Uglobal-janitorintervalrpXtemplatejUtemplateUgenindexrqjqUX serverportjU serverportXparentjUparentXusehttpsjUusehttpsX dynsearchtypejU dynsearchtypeXpwdjUpwdX asyncrepljU asyncreplX dynparentjU dynparentUsearchrrUsearchUX searchindexjU searchindexXhealthchecktimeoutjUhealthchecktimeoutX cfgobj_inputjU cfgobj-inputXmaxbytesjUmaxbytesXlegacy-action-orderjOUlegacy-action-orderXtimeoutjUtimeoutX errorfilejU errorfileXbulkmodejUbulkmodeuUlabelsrs}rt(jnU py-modindexUcsphinx.locale _TranslationProxy rucsphinx.locale mygettext rvU Module IndexrwrxjvjwrybjqjqUjujvUIndexrzr{jvjzr|bjrjrUjujvU Search Pager}r~jvj}rbuU progoptionsr}rUobjectsr}ruUc}r(j}rjkKuUpyr}r(j}rXtls.permittedPeerrjXfunctionsUmodulesr}rjkKuUjsr}r(j}rjkKuUrstr}r(j}rjkKuUcppr}r(j}rjkKuuU glob_toctreesrh]r(hhjhjj4jLj`jjeRrU reread_alwaysrh]RrU doctreedirrX+/home/rger/proj/rsyslog-doc/build/.doctreesrUversioning_conditionrUtoc_fignumbersr}U citationsr}jkK.UsrcdirrX"/home/rger/proj/rsyslog-doc/sourcerUconfigrcsphinx.config Config r)r}r(Uhtml_show_sphinxrUpygments_stylerUsphinxrUhtmlhelp_basenamerU rsyslogdocUedit_on_github_projectrUrsyslog/rsyslog-docU html_themerUdefaultrUnitpickyrU master_docrUindexrU source_suffixr]rU.rstraUtexinfo_documentsr]r(UindexrU RsyslogDocrXRsyslog Doc DocumentationrXfoo barrjU One line description of project.U MiscellaneoustraU copyrightrX&2008-2016, Rainer Gerhards and AdisconUexclude_patternsr]jkU8.24U man_pagesr]r((UqueuesUrsyslog-queuesXRsyslog Documentation: Queues]rXRainer GerhardsraKtr(Uconfiguration/actionsUrsyslog-actionsXRsyslog Documentation: Actions]rjaKtreUtemplates_pathr]rU _templatesraUlatex_documentsr]r(jURsyslogDoc.texjjUmanualtraUedit_on_github_branchrUmasterrUhtml_static_pathr]rU_staticraUlatex_elementsr}U overridesr}UprojectrXrsyslogU extensionsr]r(Uedit_on_githubrU alabasterreUreleaserU8.24.0UsetuprNubUmetadatar}r(h}h*}h3}h<}hE}hN}hW}h`}hi}hr}h{}h}h}h}h}h}h}h}h}h}h}h}h}h}h}j}j }j}j}j&}j/}j8}jA}jJ}jS}j\}je}jn}jw}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j"}j+}j4}j=}jF}jO}h }j`}ji}jr}j{}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j }j}j}j&}j/}j8}jA}jJ}jS}j\}je}jn}jw}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j"}j+}j4}j=}jF}jO}jX}ja}jj}js}j|}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j }j}j}j'}j0}j9}jB}jK}jT}j]}jf}jo}jx}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j#}j,}j5}j>}jG}jP}jY}jb}jk}jt}j}}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j}j }j}j}j(}j1}j:}jC}jL}jU}j^}uUversionchangesr}Utoc_num_entriesr}r(hKh*Kh3KhKjGKjPKjYKjbKjkKjtKj}KjKjKjKjKjKjKjKjKjKjKjKjKjKjK jKj KjKjK j(Kj1Kj:KjCKjLKjUKj^KuUimagesrh)r(X:configuration/global/options/rsyslog_confgraph_complex.pngrh]rhaRrXrsyslog_confgraph_complex.pngrrXtutorials/tls_cert_100.jpgrh]r(jjjjfjBeRrXtls_cert_100.jpgrrX%whitepapers/direct_queue_rsyslog2.pngrh]rj,aRrXdirect_queue_rsyslog2.pngrrXconcepts/rfc5424layers.pngrh]rjaRrXrfc5424layers.pngrrX$whitepapers/direct_queue_rsyslog.pngrh]rj,aRrXdirect_queue_rsyslog.pngrrX configuration/modules/gssapi.pngrh]rhaRrX gssapi.pngrrX6configuration/global/options/rsyslog_confgraph_std.pngrh]rhaRrXrsyslog_confgraph_std.pngrrXtutorials/tls_cert.jpgrh]rjaRrX tls_cert.jpgrrXwhitepapers/direct_queue0.pngrh]rj,aRrXdirect_queue0.pngrr Xwhitepapers/direct_queue1.pngr h]r j,aRr Xdirect_queue1.pngr rXwhitepapers/direct_queue2.pngrh]rj,aRrXdirect_queue2.pngrrXwhitepapers/direct_queue3.pngrh]rj,aRrXdirect_queue3.pngrrX whitepapers/queue_analogy_tv.pngrh]rj,aRrXqueue_analogy_tv.pngrrX development/queueWorkerLogic.jpgrh]rjaRr XqueueWorkerLogic.jpgr!r"X$whitepapers/direct_queue_directq.pngr#h]r$j,aRr%Xdirect_queue_directq.pngr&r'Xtutorials/tls_cert_ca.jpgr(h]r)jaRr*Xtls_cert_ca.jpgr+r,Xwhitepapers/dataflow.pngr-h]r.j,aRr/X dataflow.pngr0r1X)configuration/modules/module_workflow.pngr2h]r3jAaRr4Xmodule_workflow.pngr5r6uh]r7(j!jjjjj0j5jjj&j+jjjj jjjeRr8bUnumbered_toctreesr9h]Rr:U found_docsr;h]r<(hh*h3hjGjPjYjbjejtj}jjjjjijjjjjjwjjjjj jjj(j1jjCjLjUj^eRr=U longtitlesr>}r?(hhh*h+h3h4hjFjGjOjPh jXj`jajijjjrjsj{j|jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj j jjjjj&j'j/j0j8j9jAjBjJjKjSjTj\j]jejfjnjojwjxjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj"j#j+j,j4j5j=j>jFjGjOjPjXjYjajbjjjkjsjtj|j}jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj j jjjjj'j(j0j1j9j:jBjCjKjLjTjUj]j^jfjgjojpjxjyjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj jjjjj#j$j,j-j5j6j>j?jGjHjPjQjYjZjbjcjkjljtjuj}j~jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj jjjjj j(j)j1j2j:j;jCjDjLjMjUjVj^j_uU dependenciesr@}rA(hh]rBjaRrCj,h]rD(jjjj jjjj#j-eRrEjh]rF(jXtutorials/tls_cert_100.jpgrGeRrHjfh]rIXtutorials/tls_cert_100.jpgrJaRrKjh]rLjaRrMhh]rN(jjeRrOjh]rPj(aRrQjh]rRXtutorials/tls_cert_100.jpgrSaRrTjh]rUjaRrVjh]rWjaRrXh h]rYX"configuration/rsyslog-example.confrZaRr[jAh]r\j2aRr]jBh]r^Xtutorials/tls_cert_100.jpgr_aRr`uUtoctree_includesra}rb(h]rc(jjjjj&ej4]rd(jjjXh{j>jjjjjwj1jeh ]re(Xconfiguration/basic_structurerfXconfiguration/templatesrgXconfiguration/propertiesrhXconfiguration/property_replacerriXconfiguration/filtersrjXrainerscript/indexrkXconfiguration/actionsrlXconfiguration/inputrmXconfiguration/parserrnXconfiguration/timezoneroXconfiguration/examplesrpXconfiguration/index_directivesrqXconfiguration/modules/indexrrXconfiguration/output_channelsrsXconfiguration/dropprivrtXconfiguration/ipv6ruXconfiguration/cryprov_gcryrvXconfiguration/dyn_statsrwXconfiguration/lookup_tablesrxej]ry(j(h`jj5jjjjjj=hjjYej`]rz(jjUej]r{(Xconfiguration/indexr|Xinstallation/indexr}Xtroubleshooting/indexr~Xconcepts/indexrXexamples/indexrXtutorials/indexrXdevelopment/indexrXhistorical/indexrXhistoryrX licensingrXhow2helprX communityrXfeaturesrXproposals/indexrXwhitepapers/indexrX free_supportrXcompatibility/indexrej]rX.historical/multi_ruleset_legacy_format_samplesrah]r(X4configuration/input_directives/rsconf1_allowedsenderrXIconfiguration/input_directives/rsconf1_dropmsgswithmaliciousdnsptrrecordsrXCconfiguration/input_directives/rsconf1_controlcharacterescapeprefixrX@configuration/input_directives/rsconf1_droptrailinglfonreceptionrX?configuration/input_directives/rsconf1_escape8bitcharsonreceiverXGconfiguration/input_directives/rsconf1_escapecontrolcharactersonreceiverX8configuration/input_directives/rsconf1_markmessageperiodrejs]r(Xrainerscript/data_typesrXrainerscript/expressionsrXrainerscript/functionsrXrainerscript/control_structuresrX"rainerscript/configuration_objectsrXrainerscript/constant_stringsrX$rainerscript/variable_property_typesrXrainerscript/lookup_tablesrXrainerscript/queue_parametersrXrainerscript/rainerscript_callrX'rainerscript/rainerscript_call_indirectrXrainerscript/globalrej|]r(X configuration/modules/idx_outputrXconfiguration/modules/idx_inputrX configuration/modules/idx_parserrX$configuration/modules/idx_messagemodrX#configuration/modules/idx_stringgenrX!configuration/modules/idx_libraryrXconfiguration/modules/workflowrej]r(Xinstallation/packagesrX installation/install_from_sourcerXinstallation/build_from_reporej]r(Xtutorials/tls_cert_summaryrX tutorials/tlsrXtutorials/databaserXtutorials/high_database_raterXtutorials/reliable_forwardingrXtutorials/recording_prirX tutorials/failover_syslog_serverrXtutorials/log_rotation_fix_sizerXtutorials/gelf_forwardingreje]rXconfiguration/nomatchraj]r(Xconcepts/ns_ptcprXconcepts/ns_gtlsrej ]r(Xconcepts/queuesrXconcepts/janitorrXconcepts/messageparserrXconcepts/multi_rulesetrXconcepts/netstrm_drvrrej]r(jPj jjjjej]r(Xtutorials/tls_cert_scenariorXtutorials/tls_cert_carXtutorials/tls_cert_machinerXtutorials/tls_cert_serverrXtutorials/tls_cert_clientrXtutorials/tls_cert_udp_relayrXtutorials/tls_cert_errmsgsrej]r(Xwhitepapers/syslog_parsingrXwhitepapers/syslog_protocolrXwhitepapers/queues_analogyrXwhitepapers/preserve_in_natrXwhitepapers/reliable_loggingrej/]rXexamples/high_performanceraj8]r(X configuration/config_param_typesrXconfiguration/global/indexrX$configuration/input_directives/indexrXconfiguration/action/indexrXconfiguration/ruleset/indexreh]r(jjh (hUh}r? (h]h]h]h]h]uh'j9 h ]r@ j )rA }rB (hUh}rC (U anchornameU#configuration-parametersUrefurih*h]h]h]h]h]Uinternaluh'j= h ]rD h"XConfiguration ParametersrE rF }rG (hXConfiguration Parametersh'jA ubah(j ubah(j ubj )rH }rI (hUh}rJ (h]h]h]h]h]uh'j9 h ]rK j )rL }rM (hUh}rN (h]h]h]h]h]uh'jH h ]rO j )rP }rQ (hUh}rR (h]h]h]h]h]uh'jL h ]rS j )rT }rU (hUh}rV (U anchornameU#action-parametersUrefurih*h]h]h]h]h]Uinternaluh'jP h ]rW h"XAction ParametersrX rY }rZ (hXAction Parametersh'jT ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r[ }r\ (hUh}r] (h]h]h]h]h]uh'j5 h ]r^ j )r_ }r` (hUh}ra (h]h]h]h]h]uh'j[ h ]rb j )rc }rd (hUh}re (U anchornameU#caveats-known-bugsUrefurih*h]h]h]h]h]Uinternaluh'j_ h ]rf h"XCaveats/Known Bugsrg rh }ri (hXCaveats/Known Bugsh'jc ubah(j ubah(j ubah(j ubj )rj }rk (hUh}rl (h]h]h]h]h]uh'j5 h ]rm j )rn }ro (hUh}rp (h]h]h]h]h]uh'jj h ]rq j )rr }rs (hUh}rt (U anchornameU #examplesUrefurih*h]h]h]h]h]Uinternaluh'jn h ]ru h"XExamplesrv rw }rx (hXExamplesh'jr ubah(j ubah(j ubah(j ubj )ry }rz (hUh}r{ (h]h]h]h]h]uh'j5 h ]r| (j )r} }r~ (hUh}r (h]h]h]h]h]uh'jy h ]r j )r }r (hUh}r (U anchornameU #legacy-configuration-directivesUrefurih*h]h]h]h]h]Uinternaluh'j} h ]r h"XLegacy Configuration Directivesr r }r (hXLegacy Configuration Directivesh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'jy h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#legacy-examplesUrefurih*h]h]h]h]h]Uinternaluh'j h ]r h"XLegacy Examplesr r }r (hXLegacy Examplesh'j ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubh3j )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurih3h]h]h]h]h]Uinternaluh'j h ]r h"X$ModLoadr r }r (hh;h'j ubah(j ubah(j ubah(j ubah(j! ubh }r? (hUh}r@ (h]h]h]h]h]uh'j: h ]rA j )rB }rC (hUh}rD (U anchornameU#on-reliabilityUrefurihWh]h]h]h]h]Uinternaluh'j> h ]rE h"XOn Reliability...rF rG }rH (hXOn Reliability...h'jB ubah(j ubah(j ubah(j ubj )rI }rJ (hUh}rK (h]h]h]h]h]uh'j h ]rL (j )rM }rN (hUh}rO (h]h]h]h]h]uh'jI h ]rP j )rQ }rR (hUh}rS (U anchornameU #conclusionUrefurihWh]h]h]h]h]Uinternaluh'jM h ]rT h"X ConclusionrU rV }rW (hX Conclusionh'jQ ubah(j ubah(j ubj )rX }rY (hUh}rZ (h]h]h]h]h]uh'jI h ]r[ j )r\ }r] (hUh}r^ (h]h]h]h]h]uh'jX h ]r_ j )r` }ra (hUh}rb (h]h]h]h]h]uh'j\ h ]rc j )rd }re (hUh}rf (U anchornameU#feedback-requestedUrefurihWh]h]h]h]h]Uinternaluh'j` h ]rg h"XFeedback Requestedrh ri }rj (hXFeedback Requestedh'jd ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )rk }rl (hUh}rm (h]h]h]h]h]uh'j h ]rn j )ro }rp (hUh}rq (h]h]h]h]h]uh'jk h ]rr j )rs }rt (hUh}ru (U anchornameU##references-and-additional-materialUrefurihWh]h]h]h]h]Uinternaluh'jo h ]rv h"X"References and Additional Materialrw rx }ry (hX"References and Additional Materialh'js ubah(j ubah(j ubah(j ubj )rz }r{ (hUh}r| (h]h]h]h]h]uh'j h ]r} j )r~ }r (hUh}r (h]h]h]h]h]uh'jz h ]r j )r }r (hUh}r (U anchornameU#revision-historyUrefurihWh]h]h]h]h]Uinternaluh'j~ h ]r h"XRevision Historyr r }r (hXRevision Historyh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #copyrightUrefurihWh]h]h]h]h]Uinternaluh'j h ]r h"X Copyrightr r }r (hX Copyrighth'j ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubh`j )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"Ximfile: Text File Input Moduler r }r (hhhh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #see-alsoUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XSee Alsor r }r (hXSee Alsoh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #metadataUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XMetadatar r }r (hXMetadatah'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #state-filesUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"X State Filesr r }r (hX State Filesh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#module-parametersUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XModule Parametersr r }r (hXModule Parametersh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#input-parametersUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XInput Parametersr r }r (hXInput Parametersh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#caveats-known-bugsUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XCaveats/Known Bugsr r }r (hXCaveats/Known Bugsh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#configuration-exampleUrefurih`h]h]h]h]h]Uinternaluh'j h ]r h"XConfiguration Exampler r }r (hXConfiguration Exampleh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r! (hUh}r" (h]h]h]h]h]uh'j h ]r# j )r$ }r% (hUh}r& (U anchornameU#legacy-configurationUrefurih`h]h]h]h]h]Uinternaluh'j h ]r' h"XLegacy Configurationr( r) }r* (hXLegacy Configurationh'j$ ubah(j ubah(j ubj )r+ }r, (hUh}r- (h]h]h]h]h]uh'j h ]r. (j )r/ }r0 (hUh}r1 (h]h]h]h]h]uh'j+ h ]r2 j )r3 }r4 (hUh}r5 (h]h]h]h]h]uh'j/ h ]r6 j )r7 }r8 (hUh}r9 (U anchornameU #legacy-configuration-directivesUrefurih`h]h]h]h]h]Uinternaluh'j3 h ]r: h"XLegacy Configuration Directivesr; r< }r= (hXLegacy Configuration Directivesh'j7 ubah(j ubah(j ubah(j ubj )r> }r? (hUh}r@ (h]h]h]h]h]uh'j+ h ]rA j )rB }rC (hUh}rD (h]h]h]h]h]uh'j> h ]rE j )rF }rG (hUh}rH (U anchornameU#legacy-exampleUrefurih`h]h]h]h]h]Uinternaluh'jB h ]rI h"XLegacy ExamplerJ rK }rL (hXLegacy Exampleh'jF ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubhij )rM }rN (hUh}rO (h]h]h]h]h]uh ]rP j )rQ }rR (hUh}rS (h]h]h]h]h]uh'jM h ]rT (j )rU }rV (hUh}rW (h]h]h]h]h]uh'jQ h ]rX j )rY }rZ (hUh}r[ (U anchornameUUrefurihih]h]h]h]h]Uinternaluh'jU h ]r\ h"XUnderstanding rsyslog Queuesr] r^ }r_ (hhqh'jY ubah(j ubah(j ubj )r` }ra (hUh}rb (h]h]h]h]h]uh'jQ h ]rc (j )rd }re (hUh}rf (h]h]h]h]h]uh'j` h ]rg j )rh }ri (hUh}rj (h]h]h]h]h]uh'jd h ]rk j )rl }rm (hUh}rn (U anchornameU#where-are-queues-usedUrefurihih]h]h]h]h]Uinternaluh'jh h ]ro h"XWhere are Queues Used?rp rq }rr (hXWhere are Queues Used?h'jl ubah(j ubah(j ubah(j ubj )rs }rt (hUh}ru (h]h]h]h]h]uh'j` h ]rv (j )rw }rx (hUh}ry (h]h]h]h]h]uh'js h ]rz j )r{ }r| (hUh}r} (U anchornameU #queue-modesUrefurihih]h]h]h]h]Uinternaluh'jw h ]r~ h"X Queue Modesr r }r (hX Queue Modesh'j{ ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'js h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#direct-queuesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"X Direct Queuesr r }r (hX Direct Queuesh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #disk-queuesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"X Disk Queuesr r }r (hX Disk Queuesh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#in-memory-queuesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XIn-Memory Queuesr r }r (hXIn-Memory Queuesh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#disk-assisted-memory-queuesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XDisk-Assisted Memory Queuesr r }r (hXDisk-Assisted Memory Queuesh'j ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j` h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#limiting-the-queue-sizeUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XLimiting the Queue Sizer r }r (hXLimiting the Queue Sizeh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j` h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#worker-thread-poolsUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XWorker Thread Poolsr r }r (hXWorker Thread Poolsh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#discarding-messagesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XDiscarding Messagesr r }r (hXDiscarding Messagesh'j ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j` h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#filled-up-queuesUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"XFilled-Up Queuesr r }r (hXFilled-Up Queuesh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#rate-limitingUrefurihih]h]h]h]h]Uinternaluh'j h ]r h"X Rate Limitingr r }r (hX Rate Limitingh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r! }r" (hUh}r# (U anchornameU#processing-timeframesUrefurihih]h]h]h]h]Uinternaluh'j h ]r$ h"XProcessing Timeframesr% r& }r' (hXProcessing Timeframesh'j! ubah(j ubah(j ubah(j ubj )r( }r) (hUh}r* (h]h]h]h]h]uh'j h ]r+ j )r, }r- (hUh}r. (h]h]h]h]h]uh'j( h ]r/ j )r0 }r1 (hUh}r2 (U anchornameU #performanceUrefurihih]h]h]h]h]Uinternaluh'j, h ]r3 h"X Performancer4 r5 }r6 (hX Performanceh'j0 ubah(j ubah(j ubah(j ubj )r7 }r8 (hUh}r9 (h]h]h]h]h]uh'j h ]r: j )r; }r< (hUh}r= (h]h]h]h]h]uh'j7 h ]r> j )r? }r@ (hUh}rA (U anchornameU#terminating-queuesUrefurihih]h]h]h]h]Uinternaluh'j; h ]rB h"XTerminating QueuesrC rD }rE (hXTerminating Queuesh'j? ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubhrj )rF }rG (hUh}rH (h]h]h]h]h]uh ]rI j )rJ }rK (hUh}rL (h]h]h]h]h]uh'jF h ]rM j )rN }rO (hUh}rP (h]h]h]h]h]uh'jJ h ]rQ j )rR }rS (hUh}rT (U anchornameUUrefurihrh]h]h]h]h]Uinternaluh'jN h ]rU h"X$MainMsgQueueSizerV rW }rX (hhzh'jR ubah(j ubah(j ubah(j ubah(j! ubh{j )rY }rZ (hUh}r[ (h]h]h]h]h]uh ]r\ j )r] }r^ (hUh}r_ (h]h]h]h]h]uh'jY h ]r` j )ra }rb (hUh}rc (h]h]h]h]h]uh'j] h ]rd j )re }rf (hUh}rg (U anchornameUUrefurih{h]h]h]h]h]Uinternaluh'ja h ]rh h"X$omfileForceChownri rj }rk (hhh'je ubah(j ubah(j ubah(j ubah(j! ubhj )rl }rm (hUh}rn (h]h]h]h]h]uh ]ro j )rp }rq (hUh}rr (h]h]h]h]h]uh'jl h ]rs j )rt }ru (hUh}rv (h]h]h]h]h]uh'jp h ]rw j )rx }ry (hUh}rz (U anchornameUUrefurihh]h]h]h]h]Uinternaluh'jt h ]r{ h"XDropping privileges in rsyslogr| r} }r~ (hhh'jx ubah(j ubah(j ubah(j ubah(j! ubhj )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"XMessage Modification Modulesr r }r (hhh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r csphinx.addnodes toctree r )r }r (hUh'j Usourcer XK/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_messagemod.rsth(Utoctreer h}r (UnumberedKUparenthU titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r (Njjr Nh (U anchornameU#action-parametersUrefurihh]h]h]h]h]Uinternaluh'j8 h ]r? h"XAction Parametersr@ rA }rB (hXAction Parametersh'j< ubah(j ubah(j ubah(j ubj )rC }rD (hUh}rE (h]h]h]h]h]uh'j! h ]rF j )rG }rH (hUh}rI (h]h]h]h]h]uh'jC h ]rJ j )rK }rL (hUh}rM (U anchornameU #legacy-configuration-directivesUrefurihh]h]h]h]h]Uinternaluh'jG h ]rN h"XLegacy Configuration DirectivesrO rP }rQ (hXLegacy Configuration Directivesh'jK ubah(j ubah(j ubah(j ubj )rR }rS (hUh}rT (h]h]h]h]h]uh'j! h ]rU j )rV }rW (hUh}rX (h]h]h]h]h]uh'jR h ]rY j )rZ }r[ (hUh}r\ (U anchornameU#caveats-known-bugsUrefurihh]h]h]h]h]Uinternaluh'jV h ]r] h"XCaveats/Known Bugsr^ r_ }r` (hXCaveats/Known Bugsh'jZ ubah(j ubah(j ubah(j ubj )ra }rb (hUh}rc (h]h]h]h]h]uh'j! h ]rd j )re }rf (hUh}rg (h]h]h]h]h]uh'ja h ]rh j )ri }rj (hUh}rk (U anchornameU#sampleUrefurihh]h]h]h]h]Uinternaluh'je h ]rl h"XSamplerm rn }ro (hXSampleh'ji ubah(j ubah(j ubah(j ubj )rp }rq (hUh}rr (h]h]h]h]h]uh'j! h ]rs j )rt }ru (hUh}rv (h]h]h]h]h]uh'jp h ]rw j )rx }ry (hUh}rz (U anchornameU#legacy-sampleUrefurihh]h]h]h]h]Uinternaluh'jt h ]r{ h"X Legacy Sampler| r} }r~ (hX Legacy Sampleh'jx ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubhj )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"XParserr r }r (hhh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#general-parser-parametersUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"XGeneral Parser Parametersr r }r (hXGeneral Parser Parametersh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#samplesUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"XSamplesr r }r (hXSamplesh'j ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubhj )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"X Developmentr r }r (hhh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh'j j X8/home/rger/proj/rsyslog-doc/source/development/index.rsth(j h}r (UnumberedKUparenthU titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r (Njr Njr Njr Njr Nj&r eUhiddenUcaptionNU includefiles]r (jjjjj&eU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubhj )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"X%The rsyslog "call_indirect" statementr r }r (hhh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#syntaxUrefurihh]h]h]h]h]Uinternaluh'j h ]r h"Xsyntaxr r }r (hXsyntaxh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU #examplesUrefurihh]h]h]h]h]Uinternaluh'j h ]rh"Xexamplesrr}r (hXexamplesh'jubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU#additional-informationUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"Xadditional informationrr}r(hXadditional informationh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubhj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r j )r!}r"(hUh}r#(h]h]h]h]h]uh'jh ]r$j )r%}r&(hUh}r'(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j!h ]r(h"XGeneral Queue Parametersr)r*}r+(hhh'j%ubah(j ubah(j ubah(j ubah(j! ubhj )r,}r-(hUh}r.(h]h]h]h]h]uh ]r/j )r0}r1(hUh}r2(h]h]h]h]h]uh'j,h ]r3j )r4}r5(hUh}r6(h]h]h]h]h]uh'j0h ]r7j )r8}r9(hUh}r:(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'j4h ]r;h"X$DebugPrintModuleListr<r=}r>(hhh'j8ubah(j ubah(j ubah(j ubah(j! ubhj )r?}r@(hUh}rA(h]h]h]h]h]uh ]rBj )rC}rD(hUh}rE(h]h]h]h]h]uh'j?h ]rF(j )rG}rH(hUh}rI(h]h]h]h]h]uh'jCh ]rJj )rK}rL(hUh}rM(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'jGh ]rNh"Ximtcp: TCP Syslog Input ModulerOrP}rQ(hhh'jKubah(j ubah(j ubj )rR}rS(hUh}rT(h]h]h]h]h]uh'jCh ]rU(j )rV}rW(hUh}rX(h]h]h]h]h]uh'jRh ]rY(j )rZ}r[(hUh}r\(h]h]h]h]h]uh'jVh ]r]j )r^}r_(hUh}r`(U anchornameU#configuration-parametersUrefurihh]h]h]h]h]Uinternaluh'jZh ]rah"XConfiguration Parametersrbrc}rd(hXConfiguration Parametersh'j^ubah(j ubah(j ubj )re}rf(hUh}rg(h]h]h]h]h]uh'jVh ]rh(j )ri}rj(hUh}rk(h]h]h]h]h]uh'jeh ]rlj )rm}rn(hUh}ro(h]h]h]h]h]uh'jih ]rpj )rq}rr(hUh}rs(U anchornameU#module-parametersUrefurihh]h]h]h]h]Uinternaluh'jmh ]rth"XModule Parametersrurv}rw(hXModule Parametersh'jqubah(j ubah(j ubah(j ubj )rx}ry(hUh}rz(h]h]h]h]h]uh'jeh ]r{j )r|}r}(hUh}r~(h]h]h]h]h]uh'jxh ]rj )r}r(hUh}r(U anchornameU#input-parametersUrefurihh]h]h]h]h]Uinternaluh'j|h ]rh"XInput Parametersrr}r(hXInput Parametersh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #see-alsoUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XSee alsorr}r(hXSee alsoh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#exampleUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XExamplerr}r(hXExampleh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #legacy-configuration-directivesUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XLegacy Configuration Directivesrr}r(hXLegacy Configuration Directivesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#id2Urefurihh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jRh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#id4Urefurihh]h]h]h]h]Uinternaluh'jh ]rh"XExamplerr}r(hXExampleh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubhj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XBasic Structurerr}r(hhh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU+#quick-overview-of-message-flow-and-objectsUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"X*Quick overview of message flow and objectsrr}r(hX*Quick overview of message flow and objectsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh}r (h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#processing-principlesUrefurihh]h]h]h]h]Uinternaluh'j h ]rh"XProcessing Principlesrr}r(hXProcessing Principlesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (U anchornameU#configuration-fileUrefurihh]h]h]h]h]Uinternaluh'jh ]r!h"XConfiguration Filer"r#}r$(hXConfiguration Fileh'jubah(j ubah(j ubah(j ubj )r%}r&(hUh}r'(h]h]h]h]h]uh'jh ]r((j )r)}r*(hUh}r+(h]h]h]h]h]uh'j%h ]r,j )r-}r.(hUh}r/(U anchornameU#statement-typesUrefurihh]h]h]h]h]Uinternaluh'j)h ]r0h"XStatement Typesr1r2}r3(hXStatement Typesh'j-ubah(j ubah(j ubj )r4}r5(hUh}r6(h]h]h]h]h]uh'j%h ]r7j )r8}r9(hUh}r:(h]h]h]h]h]uh'j4h ]r;j )r<}r=(hUh}r>(h]h]h]h]h]uh'j8h ]r?j )r@}rA(hUh}rB(U anchornameU##recommended-use-of-statement-typesUrefurihh]h]h]h]h]Uinternaluh'j<h ]rCh"X"Recommended use of Statement TypesrDrE}rF(hX"Recommended use of Statement Typesh'j@ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )rG}rH(hUh}rI(h]h]h]h]h]uh'jh ]rJj )rK}rL(hUh}rM(h]h]h]h]h]uh'jGh ]rNj )rO}rP(hUh}rQ(U anchornameU #commentsUrefurihh]h]h]h]h]Uinternaluh'jKh ]rRh"XCommentsrSrT}rU(hXCommentsh'jOubah(j ubah(j ubah(j ubj )rV}rW(hUh}rX(h]h]h]h]h]uh'jh ]rY(j )rZ}r[(hUh}r\(h]h]h]h]h]uh'jVh ]r]j )r^}r_(hUh}r`(U anchornameU#processing-orderUrefurihh]h]h]h]h]Uinternaluh'jZh ]rah"XProcessing Orderrbrc}rd(hXProcessing Orderh'j^ubah(j ubah(j ubj )re}rf(hUh}rg(h]h]h]h]h]uh'jVh ]rh(j )ri}rj(hUh}rk(h]h]h]h]h]uh'jeh ]rlj )rm}rn(hUh}ro(h]h]h]h]h]uh'jih ]rpj )rq}rr(hUh}rs(U anchornameU#flow-control-statementsUrefurihh]h]h]h]h]Uinternaluh'jmh ]rth"XFlow Control Statementsrurv}rw(hXFlow Control Statementsh'jqubah(j ubah(j ubah(j ubj )rx}ry(hUh}rz(h]h]h]h]h]uh'jeh ]r{j )r|}r}(hUh}r~(h]h]h]h]h]uh'jxh ]rj )r}r(hUh}r(U anchornameU#data-manipulation-statementsUrefurihh]h]h]h]h]Uinternaluh'j|h ]rh"XData Manipulation Statementsrr}r(hXData Manipulation Statementsh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#inputsUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XInputsrr}r(hXInputsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#outputsUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XOutputsrr}r(hXOutputsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#rulesets-and-rulesUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XRulesets and Rulesrr}r(hXRulesets and Rulesh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubhj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"XConfiguration Parameter Typesrr}r(hhh'jubah(j ubah(j ubah(j ubah(j! ubhj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurihh]h]h]h]h]Uinternaluh'jh ]rh"X$GenerateConfigGraphrr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X&Legacy Global Configuration Statementsrr}r(hj h'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#true-global-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XTrue Global Directivesrr}r(hXTrue Global Directivesh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh'jj XA/home/rger/proj/rsyslog-doc/source/configuration/global/index.rsth(j h}r(UnumberedKUparentjU titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r(NjrNjr Njr Njr Njr Njr NjrNjrNjrNjrNjrNjrNjreUhiddenUcaptionNU includefiles]r(jjjjjjjjjjjjjeU includehiddenuj K h ]ubah(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (U anchornameU#main-queue-specific-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]r!h"Xmain queue specific Directivesr"r#}r$(hXmain queue specific Directivesh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj j )r%}r&(hUh}r'(h]h]h]h]h]uh ]r(j )r)}r*(hUh}r+(h]h]h]h]h]uh'j%h ]r,(j )r-}r.(hUh}r/(h]h]h]h]h]uh'j)h ]r0j )r1}r2(hUh}r3(U anchornameUUrefurij h]h]h]h]h]Uinternaluh'j-h ]r4h"XConceptsr5r6}r7(hjh'j1ubah(j ubah(j ubj )r8}r9(hUh}r:(h]h]h]h]h]uh'j)h ]r;j )r<}r=(hUh'j8j X5/home/rger/proj/rsyslog-doc/source/concepts/index.rsth(j h}r>(UnumberedKUparentj U titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r?(Njr@NjrANjrBNjrCNjrDeUhiddenUcaptionNU includefiles]rE(jjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )rF}rG(hUh}rH(h]h]h]h]h]uh ]rIj )rJ}rK(hUh}rL(h]h]h]h]h]uh'jFh ]rM(j )rN}rO(hUh}rP(h]h]h]h]h]uh'jJh ]rQj )rR}rS(hUh}rT(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jNh ]rUh"Xconfiguration objectsrVrW}rX(hjh'jRubah(j ubah(j ubj )rY}rZ(hUh}r[(h]h]h]h]h]uh'jJh ]r\(j )r]}r^(hUh}r_(h]h]h]h]h]uh'jYh ]r`j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rdj )re}rf(hUh}rg(U anchornameU#actionUrefurijh]h]h]h]h]Uinternaluh'jah ]rhh"Xaction()rirj}rk(hXaction()h'jeubah(j ubah(j ubah(j ubj )rl}rm(hUh}rn(h]h]h]h]h]uh'jYh ]roj )rp}rq(hUh}rr(h]h]h]h]h]uh'jlh ]rsj )rt}ru(hUh}rv(U anchornameU#globalUrefurijh]h]h]h]h]Uinternaluh'jph ]rwh"Xglobal()rxry}rz(hXglobal()h'jtubah(j ubah(j ubah(j ubj )r{}r|(hUh}r}(h]h]h]h]h]uh'jYh ]r~j )r}r(hUh}r(h]h]h]h]h]uh'j{h ]rj )r}r(hUh}r(U anchornameU#inputUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xinput()rr}r(hXinput()h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jYh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#moduleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xmodule()rr}r(hXmodule()h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jYh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#parserUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xparser()rr}r(hXparser()h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jYh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #timezoneUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X timezone()rr}r(hX timezone()h'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Lookup Tablesrr}r(hj%h'jubah(j ubah(j ubah(j ubah(j! ubj&j )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurij&h]h]h]h]h]Uinternaluh'jh ]rh"XGeneric design of a syslogdrr}r(hj.h'jubah(j ubah(j ubah(j ubah(j! ubj/j )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurij/h]h]h]h]h]Uinternaluh'jh ]rh"X;JSON/CEE Structured Content Extraction Module (mmjsonparse)rr}r(hj7h'jubah(j ubah(j ubah(j ubah(j! ubj8j )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurij8h]h]h]h]h]Uinternaluh'jh ]rh"X5RFC5424 structured data parsing module (mmpstrucdata)rr}r(hj@h'jubah(j ubah(j ubah(j ubah(j! ubjAj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r (j )r }r (hUh}r (h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijAh]h]h]h]h]Uinternaluh'j h ]rh"X-Installing rsyslog from the source repositoryrr}r(hjIh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r!j )r"}r#(hUh}r$(U anchornameU#obtaining-the-sourceUrefurijAh]h]h]h]h]Uinternaluh'jh ]r%h"XObtaining the Sourcer&r'}r((hXObtaining the Sourcer)h'j"ubah(j ubah(j ubah(j ubj )r*}r+(hUh}r,(h]h]h]h]h]uh'jh ]r-j )r.}r/(hUh}r0(h]h]h]h]h]uh'j*h ]r1j )r2}r3(hUh}r4(U anchornameU #prequisitesUrefurijAh]h]h]h]h]Uinternaluh'j.h ]r5h"X Prequisitesr6r7}r8(hX Prequisitesr9h'j2ubah(j ubah(j ubah(j ubj )r:}r;(hUh}r<(h]h]h]h]h]uh'jh ]r=j )r>}r?(hUh}r@(h]h]h]h]h]uh'j:h ]rAj )rB}rC(hUh}rD(U anchornameU#creating-the-build-environmentUrefurijAh]h]h]h]h]Uinternaluh'j>h ]rEh"XCreating the Build EnvironmentrFrG}rH(hXCreating the Build EnvironmentrIh'jBubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjJj )rJ}rK(hUh}rL(h]h]h]h]h]uh ]rMj )rN}rO(hUh}rP(h]h]h]h]h]uh'jJh ]rQj )rR}rS(hUh}rT(h]h]h]h]h]uh'jNh ]rUj )rV}rW(hUh}rX(U anchornameUUrefurijJh]h]h]h]h]Uinternaluh'jRh ]rYh"X$ModDirrZr[}r\(hjRh'jVubah(j ubah(j ubah(j ubah(j! ubjSj )r]}r^(hUh}r_(h]h]h]h]h]uh ]r`j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rdj )re}rf(hUh}rg(h]h]h]h]h]uh'jah ]rhj )ri}rj(hUh}rk(U anchornameUUrefurijSh]h]h]h]h]Uinternaluh'jeh ]rlh"X!Preserving syslog sender over NATrmrn}ro(hj[h'jiubah(j ubah(j ubah(j ubah(j! ubj\j )rp}rq(hUh}rr(h]h]h]h]h]uh ]rsj )rt}ru(hUh}rv(h]h]h]h]h]uh'jph ]rwj )rx}ry(hUh}rz(h]h]h]h]h]uh'jth ]r{j )r|}r}(hUh}r~(U anchornameUUrefurij\h]h]h]h]h]Uinternaluh'jxh ]rh"Xomsnmp: SNMP Trap Output Modulerr}r(hjdh'j|ubah(j ubah(j ubah(j ubah(j! ubjej )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"XThe Property Replacerrr}r(hjmh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#accessing-propertiesUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"XAccessing Propertiesrr}r(hXAccessing Propertiesh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#available-propertiesUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"XAvailable Propertiesrr}r(hXAvailable Propertiesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#character-positionsUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"XCharacter Positionsrr}r(hXCharacter Positionsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#property-optionsUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"XProperty Optionsrr}r(hXProperty Optionsh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#further-linksUrefurijeh]h]h]h]h]Uinternaluh'jh ]rh"X Further Linksrr}r(hX Further Linksh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh'jj XF/home/rger/proj/rsyslog-doc/source/configuration/property_replacer.rsth(j h}r(UnumberedKUparentjeU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rNjraUhiddenUcaptionNU includefiles]rjaU includehiddenuj Mnh ]ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjnj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijnh]h]h]h]h]Uinternaluh'jh ]rh"Xtroubleshooting problemsrr}r(hjvh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r (j )r }r (hUh}r (h]h]h]h]h]uh'jh ]r j )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU*#malformed-messages-and-message-propertiesUrefurijnh]h]h]h]h]Uinternaluh'jh ]rh"X)Malformed Messages and Message Propertiesrr}r(hX)Malformed Messages and Message Propertiesrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r!j )r"}r#(hUh}r$(U anchornameU#configuration-problemsUrefurijnh]h]h]h]h]Uinternaluh'jh ]r%h"XConfiguration Problemsr&r'}r((hXConfiguration Problemsr)h'j"ubah(j ubah(j ubah(j ubj )r*}r+(hUh}r,(h]h]h]h]h]uh'jh ]r-j )r.}r/(hUh}r0(h]h]h]h]h]uh'j*h ]r1j )r2}r3(hUh}r4(U anchornameU#checking-connection-problemsUrefurijnh]h]h]h]h]Uinternaluh'j.h ]r5h"XChecking Connection Problemsr6r7}r8(hXChecking Connection Problemsr9h'j2ubah(j ubah(j ubah(j ubj )r:}r;(hUh}r<(h]h]h]h]h]uh'jh ]r=j )r>}r?(hUh}r@(h]h]h]h]h]uh'j:h ]rAj )rB}rC(hUh}rD(U anchornameU#asking-for-helpUrefurijnh]h]h]h]h]Uinternaluh'j>h ]rEh"XAsking for HelprFrG}rH(hXAsking for HelprIh'jBubah(j ubah(j ubah(j ubj )rJ}rK(hUh}rL(h]h]h]h]h]uh'jh ]rMj )rN}rO(hUh}rP(h]h]h]h]h]uh'jJh ]rQj )rR}rS(hUh}rT(U anchornameU #debug-logUrefurijnh]h]h]h]h]Uinternaluh'jNh ]rUh"X Debug LogrVrW}rX(hX Debug LogrYh'jRubah(j ubah(j ubah(j ubj )rZ}r[(hUh}r\(h]h]h]h]h]uh'jh ]r]j )r^}r_(hUh}r`(h]h]h]h]h]uh'jZh ]raj )rb}rc(hUh}rd(U anchornameU#segmentation-faultsUrefurijnh]h]h]h]h]Uinternaluh'j^h ]reh"XSegmentation Faultsrfrg}rh(hXSegmentation Faultsrih'jbubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjwj )rj}rk(hUh}rl(h]h]h]h]h]uh ]rmj )rn}ro(hUh}rp(h]h]h]h]h]uh'jjh ]rqj )rr}rs(hUh}rt(h]h]h]h]h]uh'jnh ]ruj )rv}rw(hUh}rx(U anchornameUUrefurijwh]h]h]h]h]Uinternaluh'jrh ]ryh"X $FileOwnerrzr{}r|(hjh'jvubah(j ubah(j ubah(j ubah(j! ubjj )r}}r~(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'j}h ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X3Reliable Forwarding of syslog Messages with Rsyslogrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #abstractUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XAbstractrr}r(hXAbstracth'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#the-intentionUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X The Intentionrr}r(hX The Intentionh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #how-to-setupUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X How To Setuprr}r(hX How To Setuph'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU##forwarding-to-more-than-one-serverUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X"Forwarding to More than One Serverrr}r(hX"Forwarding to More than One Serverh'jubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #some-final-words-on-reliabilityUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X#Some Final Words on Reliability ...rr}r(hX#Some Final Words on Reliability ...h'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XFeedback requestedrr}r(hXFeedback requestedh'jubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XRevision Historyrr}r(hXRevision Historyh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r }r (hUh}r (h]h]h]h]h]uh'jh ]r j )r }r(hUh}r(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'j h ]rh"X Copyrightrr}r(hX Copyrighth'j ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r }r!(hUh}r"(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]r#h"X"Compatibility Notes for rsyslog v6r$r%}r&(hjh'j ubah(j ubah(j ubj )r'}r((hUh}r)(h]h]h]h]h]uh'jh ]r*(j )r+}r,(hUh}r-(h]h]h]h]h]uh'j'h ]r.j )r/}r0(hUh}r1(h]h]h]h]h]uh'j+h ]r2j )r3}r4(hUh}r5(U anchornameU#property-pri-textUrefurijh]h]h]h]h]Uinternaluh'j/h ]r6h"XProperty "pri-text"r7r8}r9(hXProperty "pri-text"h'j3ubah(j ubah(j ubah(j ubj )r:}r;(hUh}r<(h]h]h]h]h]uh'j'h ]r=j )r>}r?(hUh}r@(h]h]h]h]h]uh'j:h ]rAj )rB}rC(hUh}rD(U anchornameU #plugin-abiUrefurijh]h]h]h]h]Uinternaluh'j>h ]rEh"X Plugin ABIrFrG}rH(hX Plugin ABIh'jBubah(j ubah(j ubah(j ubj )rI}rJ(hUh}rK(h]h]h]h]h]uh'j'h ]rLj )rM}rN(hUh}rO(h]h]h]h]h]uh'jIh ]rPj )rQ}rR(hUh}rS(U anchornameU #rainerscript-based-rsyslog-confUrefurijh]h]h]h]h]Uinternaluh'jMh ]rTh"XRainerScript based rsyslog.confrUrV}rW(hXRainerScript based rsyslog.confh'jQubah(j ubah(j ubah(j ubj )rX}rY(hUh}rZ(h]h]h]h]h]uh'j'h ]r[j )r\}r](hUh}r^(h]h]h]h]h]uh'jXh ]r_j )r`}ra(hUh}rb(U anchornameU#compatibility-modeUrefurijh]h]h]h]h]Uinternaluh'j\h ]rch"Xcompatibility moderdre}rf(hXcompatibility modeh'j`ubah(j ubah(j ubah(j ubj )rg}rh(hUh}ri(h]h]h]h]h]uh'j'h ]rjj )rk}rl(hUh}rm(h]h]h]h]h]uh'jgh ]rnj )ro}rp(hUh}rq(U anchornameU#abort-on-config-errorsUrefurijh]h]h]h]h]Uinternaluh'jkh ]rrh"Xabort on config errorsrsrt}ru(hXabort on config errorsh'joubah(j ubah(j ubah(j ubj )rv}rw(hUh}rx(h]h]h]h]h]uh'j'h ]ryj )rz}r{(hUh}r|(h]h]h]h]h]uh'jvh ]r}j )r~}r(hUh}r(U anchornameU#default-batch-sizesUrefurijh]h]h]h]h]Uinternaluh'jzh ]rh"XDefault Batch Sizesrr}r(hXDefault Batch Sizesh'j~ubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU%#default-action-queue-enqueue-timeoutUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X$Default action queue enqueue timeoutrr}r(hX$Default action queue enqueue timeouth'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #outchannelsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X outchannelsrr}r(hX outchannelsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#ompipe-default-templateUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xompipe default templaterr}r(hXompipe default templateh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #omusrmsgUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xomusrmsgrr}r(hXomusrmsgh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU)#escape-sequences-in-script-based-filtersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X(Escape Sequences in Script-Based Filtersrr}r(hX(Escape Sequences in Script-Based Filtersh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j'h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Copyrightrr}r(hX Copyrighth'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X0Number generator and counter module (mmsequence)rr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XRsyslog Debug Supportrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r }r (hUh}r (h]h]h]h]h]uh'jh ]r j )r }r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU#signals-supportedUrefurijh]h]h]h]h]Uinternaluh'j h ]rh"XSignals supportedrr}r(hXSignals supportedrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]r j )r!}r"(hUh}r#(U anchornameU#environment-variablesUrefurijh]h]h]h]h]Uinternaluh'jh ]r$h"XEnvironment Variablesr%r&}r'(hXEnvironment Variablesr(h'j!ubah(j ubah(j ubj )r)}r*(hUh}r+(h]h]h]h]h]uh'jh ]r,j )r-}r.(hUh}r/(h]h]h]h]h]uh'j)h ]r0j )r1}r2(hUh}r3(h]h]h]h]h]uh'j-h ]r4j )r5}r6(hUh}r7(U anchornameU#why-environment-variablesUrefurijh]h]h]h]h]Uinternaluh'j1h ]r8h"XWhy Environment Variables?r9r:}r;(hXWhy Environment Variables?r<h'j5ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r=}r>(hUh}r?(h]h]h]h]h]uh'jh ]r@j )rA}rB(hUh}rC(h]h]h]h]h]uh'j=h ]rDj )rE}rF(hUh}rG(U anchornameU #enabling-debug-via-rsyslog-confUrefurijh]h]h]h]h]Uinternaluh'jAh ]rHh"XEnabling Debug via rsyslog.confrIrJ}rK(hXEnabling Debug via rsyslog.confrLh'jEubah(j ubah(j ubah(j ubj )rM}rN(hUh}rO(h]h]h]h]h]uh'jh ]rPj )rQ}rR(hUh}rS(h]h]h]h]h]uh'jMh ]rTj )rU}rV(hUh}rW(U anchornameU2#getting-debug-information-from-a-running-instanceUrefurijh]h]h]h]h]Uinternaluh'jQh ]rXh"X1Getting debug information from a running InstancerYrZ}r[(hX1Getting debug information from a running Instancer\h'jUubah(j ubah(j ubah(j ubj )r]}r^(hUh}r_(h]h]h]h]h]uh'jh ]r`j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rdj )re}rf(hUh}rg(U anchornameU#interpreting-the-logsUrefurijh]h]h]h]h]Uinternaluh'jah ]rhh"XInterpreting the Logsrirj}rk(hXInterpreting the Logsrlh'jeubah(j ubah(j ubah(j ubj )rm}rn(hUh}ro(h]h]h]h]h]uh'jh ]rpj )rq}rr(hUh}rs(h]h]h]h]h]uh'jmh ]rtj )ru}rv(hUh}rw(U anchornameU#security-risksUrefurijh]h]h]h]h]Uinternaluh'jqh ]rxh"XSecurity Risksryrz}r{(hXSecurity Risksr|h'juubah(j ubah(j ubah(j ubj )r}}r~(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'j}h ]rj )r}r(hUh}r(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSee Alsorr}r(hXSee Alsorh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X/Keyless Signature Infrastructure Provider (ksi)rr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X8Encrypting Syslog Traffic with TLS (SSL) [short version]rr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #abstractUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XAbstractrr}r(hXAbstractrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #backgroundUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Backgroundrr}r(hX Backgroundrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#overall-system-setupUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XOverall System Setuprr}r(hXOverall System Setuprh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#setting-up-the-systemUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSetting up the systemrr}r(hXSetting up the systemrh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #server-setupUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Server Setuprr}r (hX Server Setupr h'jubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU #client-setupUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Client Setuprr}r(hX Client Setuprh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r (hUh}r!(h]h]h]h]h]uh'jh ]r"j )r#}r$(hUh}r%(U anchornameU#doneUrefurijh]h]h]h]h]Uinternaluh'jh ]r&h"XDoner'r(}r)(hXDoner*h'j#ubah(j ubah(j ubah(j ubj )r+}r,(hUh}r-(h]h]h]h]h]uh'jh ]r.j )r/}r0(hUh}r1(h]h]h]h]h]uh'j+h ]r2j )r3}r4(hUh}r5(U anchornameU #limitationsUrefurijh]h]h]h]h]Uinternaluh'j/h ]r6h"X Limitationsr7r8}r9(hX Limitationsr:h'j3ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r;}r<(hUh}r=(h]h]h]h]h]uh'jh ]r>(j )r?}r@(hUh}rA(h]h]h]h]h]uh'j;h ]rBj )rC}rD(hUh}rE(U anchornameU #certificatesUrefurijh]h]h]h]h]Uinternaluh'j?h ]rFh"X CertificatesrGrH}rI(hX CertificatesrJh'jCubah(j ubah(j ubj )rK}rL(hUh}rM(h]h]h]h]h]uh'j;h ]rN(j )rO}rP(hUh}rQ(h]h]h]h]h]uh'jKh ]rRj )rS}rT(hUh}rU(h]h]h]h]h]uh'jOh ]rVj )rW}rX(hUh}rY(U anchornameU#ca-certificateUrefurijh]h]h]h]h]Uinternaluh'jSh ]rZh"XCA Certificater[r\}r](hXCA Certificater^h'jWubah(j ubah(j ubah(j ubj )r_}r`(hUh}ra(h]h]h]h]h]uh'jKh ]rbj )rc}rd(hUh}re(h]h]h]h]h]uh'j_h ]rfj )rg}rh(hUh}ri(U anchornameU#individual-peer-certificateUrefurijh]h]h]h]h]Uinternaluh'jch ]rjh"XIndividual Peer Certificaterkrl}rm(hXIndividual Peer Certificaternh'jgubah(j ubah(j ubah(j ubj )ro}rp(hUh}rq(h]h]h]h]h]uh'jKh ]rrj )rs}rt(hUh}ru(h]h]h]h]h]uh'joh ]rvj )rw}rx(hUh}ry(U anchornameU#troubleshooting-certificatesUrefurijh]h]h]h]h]Uinternaluh'jsh ]rzh"XTroubleshooting Certificatesr{r|}r}(hXTroubleshooting Certificatesr~h'jwubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #conclusionUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Conclusionrr}r(hX Conclusionrh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XFeedback requestedrr}r(hXFeedback requestedrh'jubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XRevision Historyrr}r(hXRevision Historyrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Copyrightrr}r(hX Copyrightrh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X$imgssapi: GSSAPI Syslog Input Modulerr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh'jj XE/home/rger/proj/rsyslog-doc/source/configuration/modules/imgssapi.rsth(j h}r(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rNjraUhiddenUcaptionNU includefiles]rjaU includehiddenuj Kh ]ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XConfiguration Directivesrr}r(hXConfiguration Directivesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'jh ]r h"XExampler r }r (hXExampleh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r }r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X$RulesetCreateMainQueuerr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r }r!(hUh}r"(h]h]h]h]h]uh ]r#j )r$}r%(hUh}r&(h]h]h]h]h]uh'j h ]r'j )r(}r)(hUh}r*(h]h]h]h]h]uh'j$h ]r+j )r,}r-(hUh}r.(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j(h ]r/h"X!omjournal: Systemd Journal Outputr0r1}r2(hjh'j,ubah(j ubah(j ubah(j ubah(j! ubjj )r3}r4(hUh}r5(h]h]h]h]h]uh ]r6j )r7}r8(hUh}r9(h]h]h]h]h]uh'j3h ]r:j )r;}r<(hUh}r=(h]h]h]h]h]uh'j7h ]r>j )r?}r@(hUh}rA(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j;h ]rBh"X$DebugPrintCFSyslineHandlerListrCrD}rE(hjh'j?ubah(j ubah(j ubah(j ubah(j! ubjj )rF}rG(hUh}rH(h]h]h]h]h]uh ]rIj )rJ}rK(hUh}rL(h]h]h]h]h]uh'jFh ]rMj )rN}rO(hUh}rP(h]h]h]h]h]uh'jJh ]rQj )rR}rS(hUh}rT(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jNh ]rUh"XFailover Syslog ServerrVrW}rX(hjh'jRubah(j ubah(j ubah(j ubah(j! ubjj )rY}rZ(hUh}r[(h]h]h]h]h]uh ]r\j )r]}r^(hUh}r_(h]h]h]h]h]uh'jYh ]r`(j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rdj )re}rf(hUh}rg(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jah ]rhh"X"Compatibility Notes for rsyslog v3rirj}rk(hjh'jeubah(j ubah(j ubj )rl}rm(hUh}rn(h]h]h]h]h]uh'j]h ]ro(j )rp}rq(hUh}rr(h]h]h]h]h]uh'jlh ]rsj )rt}ru(hUh}rv(h]h]h]h]h]uh'jph ]rwj )rx}ry(hUh}rz(U anchornameU#inputsUrefurijh]h]h]h]h]Uinternaluh'jth ]r{h"XInputsr|r}}r~(hXInputsh'jxubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#command-line-optionsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCommand Line Optionsrr}r(hXCommand Line Optionsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#c-option-compatibility-modeUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X-c option / Compatibility Moderr}r(hX-c option / Compatibility Modeh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #e-optionUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X -e Optionrr}r(hX -e Optionh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #m-optionUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X -m Optionrr}r(hX -m Optionh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #r-optionUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X -r Optionrr}r(hX -r Optionh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU%#default-port-for-udp-and-tcp-serversUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X&Default port for UDP (and TCP) Serversrr}r(hX&Default port for UDP (and TCP) Serversh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#klogdUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xklogdrr}r(hXklogdh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#output-file-syncingUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XOutput File Syncingrr}r(hXOutput File Syncingh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#output-file-formatUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XOutput File Formatrr}r(hXOutput File Formath'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]r j )r }r (hUh}r (h]h]h]h]h]uh'jh ]r j )r}r(hUh}r(U anchornameU#forwarding-formatUrefurijh]h]h]h]h]Uinternaluh'j h ]rh"XForwarding Formatrr}r(hXForwarding Formath'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU'#queue-modes-for-the-main-message-queueUrefurijh]h]h]h]h]Uinternaluh'jh ]r h"X&Queue Modes for the Main Message Queuer!r"}r#(hX&Queue Modes for the Main Message Queueh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r$}r%(hUh}r&(h]h]h]h]h]uh ]r'j )r(}r)(hUh}r*(h]h]h]h]h]uh'j$h ]r+(j )r,}r-(hUh}r.(h]h]h]h]h]uh'j(h ]r/j )r0}r1(hUh}r2(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j,h ]r3h"XSetting up the UDP syslog relayr4r5}r6(hjh'j0ubah(j ubah(j ubj )r7}r8(hUh}r9(h]h]h]h]h]uh'j(h ]r:j )r;}r<(hUh}r=(h]h]h]h]h]uh'j7h ]r>j )r?}r@(hUh}rA(h]h]h]h]h]uh'j;h ]rBj )rC}rD(hUh}rE(U anchornameU#sample-syslog-confUrefurijh]h]h]h]h]Uinternaluh'j?h ]rFh"XSample syslog.confrGrH}rI(hXSample syslog.confh'jCubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjj )rJ}rK(hUh}rL(h]h]h]h]h]uh ]rMj )rN}rO(hUh}rP(h]h]h]h]h]uh'jJh ]rQ(j )rR}rS(hUh}rT(h]h]h]h]h]uh'jNh ]rUj )rV}rW(hUh}rX(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jRh ]rYh"Ximudp: UDP Syslog Input ModulerZr[}r\(hjh'jVubah(j ubah(j ubj )r]}r^(hUh}r_(h]h]h]h]h]uh'jNh ]r`(j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rd(j )re}rf(hUh}rg(h]h]h]h]h]uh'jah ]rhj )ri}rj(hUh}rk(U anchornameU#configuration-parametersUrefurijh]h]h]h]h]Uinternaluh'jeh ]rlh"XConfiguration Parametersrmrn}ro(hXConfiguration Parametersh'jiubah(j ubah(j ubj )rp}rq(hUh}rr(h]h]h]h]h]uh'jah ]rs(j )rt}ru(hUh}rv(h]h]h]h]h]uh'jph ]rwj )rx}ry(hUh}rz(h]h]h]h]h]uh'jth ]r{j )r|}r}(hUh}r~(U anchornameU#module-parametersUrefurijh]h]h]h]h]Uinternaluh'jxh ]rh"XModule Parametersrr}r(hXModule Parametersh'j|ubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jph ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#input-parametersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XInput Parametersrr}r(hXInput Parametersh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j]h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSee Alsorr}r(hXSee Alsoh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j]h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j]h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#samplesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSamplesrr}r(hXSamplesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j]h ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #legacy-configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XLegacy Configuration Directivesrr}r(hXLegacy Configuration Directivesh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#legacy-sampleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Legacy Samplerr}r(hX Legacy Sampleh'jubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X,omelasticsearch: Elasticsearch Output Modulerr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Proposalsrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh'jj X6/home/rger/proj/rsyslog-doc/source/proposals/index.rsth(j h}r (UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r(NjrNjreUhiddenUcaptionNU includefiles]r(jjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]r!h"X$ActionResumeIntervalr"r#}r$(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r%}r&(hUh}r'(h]h]h]h]h]uh ]r(j )r)}r*(hUh}r+(h]h]h]h]h]uh'j%h ]r,(j )r-}r.(hUh}r/(h]h]h]h]h]uh'j)h ]r0j )r1}r2(hUh}r3(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j-h ]r4h"X(How reliable should reliable logging be?r5r6}r7(hj!h'j1ubah(j ubah(j ubj )r8}r9(hUh}r:(h]h]h]h]h]uh'j)h ]r;j )r<}r=(hUh}r>(h]h]h]h]h]uh'j8h ]r?j )r@}rA(hUh}rB(h]h]h]h]h]uh'j<h ]rCj )rD}rE(hUh}rF(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'j@h ]rGh"XSee AlsorHrI}rJ(hXSee Alsoh'jDubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubj"j )rK}rL(hUh}rM(h]h]h]h]h]uh ]rNj )rO}rP(hUh}rQ(h]h]h]h]h]uh'jKh ]rRj )rS}rT(hUh}rU(h]h]h]h]h]uh'jOh ]rVj )rW}rX(hUh}rY(U anchornameUUrefurij"h]h]h]h]h]Uinternaluh'jSh ]rZh"XConstant Stringsr[r\}r](hj*h'jWubah(j ubah(j ubah(j ubah(j! ubj+j )r^}r_(hUh}r`(h]h]h]h]h]uh ]raj )rb}rc(hUh}rd(h]h]h]h]h]uh'j^h ]re(j )rf}rg(hUh}rh(h]h]h]h]h]uh'jbh ]rij )rj}rk(hUh}rl(U anchornameUUrefurij+h]h]h]h]h]Uinternaluh'jfh ]rmh"X"Compatibility Notes for rsyslog v4rnro}rp(hj3h'jjubah(j ubah(j ubj )rq}rr(hUh}rs(h]h]h]h]h]uh'jbh ]rt(j )ru}rv(hUh}rw(h]h]h]h]h]uh'jqh ]rxj )ry}rz(hUh}r{(h]h]h]h]h]uh'juh ]r|j )r}}r~(hUh}r(U anchornameU#hup-processingUrefurij+h]h]h]h]h]Uinternaluh'jyh ]rh"XHUP processingrr}r(hXHUP processingh'j}ubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jqh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #outchannelsUrefurij+h]h]h]h]h]Uinternaluh'jh ]rh"X outchannelsrr}r(hX outchannelsh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj4j )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurij4h]h]h]h]h]Uinternaluh'jh ]rh"Xomrelp: RELP Output Modulerr}r(hj<h'jubah(j ubah(j ubah(j ubah(j! ubj=j )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurij=h]h]h]h]h]Uinternaluh'jh ]rh"Ximsolaris: Solaris Input Modulerr}r(hjEh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#configuration-directivesUrefurij=h]h]h]h]h]Uinternaluh'jh ]rh"XConfiguration Directivesrr}r(hXConfiguration Directivesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurij=h]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #examplesUrefurij=h]h]h]h]h]Uinternaluh'jh ]rh"XExamplesrr}r(hXExamplesh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjFj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijFh]h]h]h]h]Uinternaluh'jh ]rh"X#Fields Extraction Module (mmfields)rr}r(hjNh'jubah(j ubah(j ubah(j ubah(j! ubjOj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r }r (hUh}r (U anchornameUUrefurijOh]h]h]h]h]Uinternaluh'jh ]r h"XActionsr r}r(hjWh'j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#general-action-parametersUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XGeneral Action Parametersr r!}r"(hXGeneral Action Parametersh'jubah(j ubah(j ubah(j ubj )r#}r$(hUh}r%(h]h]h]h]h]uh'jh ]r&j )r'}r((hUh}r)(h]h]h]h]h]uh'j#h ]r*j )r+}r,(hUh}r-(U anchornameU #useful-linksUrefurijOh]h]h]h]h]Uinternaluh'j'h ]r.h"X Useful Linksr/r0}r1(hX Useful Linksh'j+ubah(j ubah(j ubah(j ubj )r2}r3(hUh}r4(h]h]h]h]h]uh'jh ]r5(j )r6}r7(hUh}r8(h]h]h]h]h]uh'j2h ]r9j )r:}r;(hUh}r<(U anchornameU#legacy-formatUrefurijOh]h]h]h]h]Uinternaluh'j6h ]r=h"X Legacy Formatr>r?}r@(hX Legacy Formath'j:ubah(j ubah(j ubj )rA}rB(hUh}rC(h]h]h]h]h]uh'j2h ]rD(j )rE}rF(hUh}rG(h]h]h]h]h]uh'jAh ]rHj )rI}rJ(hUh}rK(h]h]h]h]h]uh'jEh ]rLj )rM}rN(hUh}rO(U anchornameU#legacy-descriptionUrefurijOh]h]h]h]h]Uinternaluh'jIh ]rPh"XLegacy DescriptionrQrR}rS(hXLegacy Descriptionh'jMubah(j ubah(j ubah(j ubj )rT}rU(hUh}rV(h]h]h]h]h]uh'jAh ]rWj )rX}rY(hUh}rZ(h]h]h]h]h]uh'jTh ]r[j )r\}r](hUh}r^(U anchornameU #regular-fileUrefurijOh]h]h]h]h]Uinternaluh'jXh ]r_h"X Regular Filer`ra}rb(hX Regular Fileh'j\ubah(j ubah(j ubah(j ubj )rc}rd(hUh}re(h]h]h]h]h]uh'jAh ]rfj )rg}rh(hUh}ri(h]h]h]h]h]uh'jch ]rjj )rk}rl(hUh}rm(U anchornameU #named-pipesUrefurijOh]h]h]h]h]Uinternaluh'jgh ]rnh"X Named Pipesrorp}rq(hX Named Pipesh'jkubah(j ubah(j ubah(j ubj )rr}rs(hUh}rt(h]h]h]h]h]uh'jAh ]ruj )rv}rw(hUh}rx(h]h]h]h]h]uh'jrh ]ryj )rz}r{(hUh}r|(U anchornameU#terminal-and-consoleUrefurijOh]h]h]h]h]Uinternaluh'jvh ]r}h"XTerminal and Consoler~r}r(hXTerminal and Consoleh'jzubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#remote-machineUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XRemote Machinerr}r(hXRemote Machineh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#list-of-usersUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"X List of Usersrr}r(hX List of Usersh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#everyone-logged-onUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XEveryone logged onrr}r(hXEveryone logged onh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #call-pluginUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"X Call Pluginrr}r(hX Call Pluginh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#database-tableUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XDatabase Tablerr}r(hXDatabase Tableh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#discardUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XDiscardrr}r(hXDiscardh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#output-channelUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"XOutput Channelrr}r(hXOutput Channelh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#shell-executeUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"X Shell Executerr}r(hX Shell Executeh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jAh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#template-nameUrefurijOh]h]h]h]h]Uinternaluh'jh ]rh"X Template Namerr}r(hX Template Nameh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubh j )r}r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameUUrefurih h]h]h]h]h]Uinternaluh'jh ]rh"X Configurationrr}r(hj_h'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r (hUh'jj X:/home/rger/proj/rsyslog-doc/source/configuration/index.rsth(j h}r!(UnumberedKUparenth U titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r"(Njfr#Njgr$Njhr%Njir&Njjr'Njkr(Njlr)Njmr*Njnr+Njor,Njpr-Njqr.Njrr/Njsr0Njtr1Njur2Njvr3Njwr4Njxr5eUhiddenUcaptionNU includefiles]r6(jfjgjhjijjjkjljmjnjojpjqjrjsjtjujvjwjxeU includehiddenuj K h ]ubah(j! ubeh(j ubah(j! ubj`j )r7}r8(hUh}r9(h]h]h]h]h]uh ]r:j )r;}r<(hUh}r=(h]h]h]h]h]uh'j7h ]r>(j )r?}r@(hUh}rA(h]h]h]h]h]uh'j;h ]rBj )rC}rD(hUh}rE(U anchornameUUrefurij`h]h]h]h]h]Uinternaluh'j?h ]rFh"X0Ruleset-Specific Legacy Configuration StatementsrGrH}rI(hjhh'jCubah(j ubah(j ubj )rJ}rK(hUh}rL(h]h]h]h]h]uh'j;h ]rMj )rN}rO(hUh'jJj XB/home/rger/proj/rsyslog-doc/source/configuration/ruleset/index.rsth(j h}rP(UnumberedKUparentj`U titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]rQ(NjrRNjUrSeUhiddenUcaptionNU includefiles]rT(jjUeU includehiddenuj K h ]ubah(j! ubeh(j ubah(j! ubjij )rU}rV(hUh}rW(h]h]h]h]h]uh ]rXj )rY}rZ(hUh}r[(h]h]h]h]h]uh'jUh ]r\j )r]}r^(hUh}r_(h]h]h]h]h]uh'jYh ]r`j )ra}rb(hUh}rc(U anchornameUUrefurijih]h]h]h]h]Uinternaluh'j]h ]rdh"X!$EscapeControlCharactersOnReceivererf}rg(hjqh'jaubah(j ubah(j ubah(j ubah(j! ubjrj )rh}ri(hUh}rj(h]h]h]h]h]uh ]rkj )rl}rm(hUh}rn(h]h]h]h]h]uh'jhh ]ro(j )rp}rq(hUh}rr(h]h]h]h]h]uh'jlh ]rsj )rt}ru(hUh}rv(U anchornameUUrefurijrh]h]h]h]h]Uinternaluh'jph ]rwh"X"SSL Encrypting Syslog with Stunnelrxry}rz(hjzh'jtubah(j ubah(j ubj )r{}r|(hUh}r}(h]h]h]h]h]uh'jlh ]r~(j )r}r(hUh}r(h]h]h]h]h]uh'j{h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #abstractUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"XAbstractrr}r(hXAbstractrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j{h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #backgroundUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"X Backgroundrr}r(hX Backgroundrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j{h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#overall-system-setupUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"XOverall System Setuprr}r(hXOverall System Setuprh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j{h ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#setting-up-the-systemUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"XSetting up the systemrr}r(hXSetting up the systemrh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #server-setupUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"X Server Setuprr}r(hX Server Setuprh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #client-setupUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"X Client Setuprr}r(hX Client Setuprh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#doneUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"XDonerr}r(hXDonerh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j{h ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU?#preventing-systems-from-talking-directly-to-the-rsyslog-serverUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"X>Preventing Systems from talking directly to the rsyslog Serverrr}r(hX>Preventing Systems from talking directly to the rsyslog Serverrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j{h ]r(j )r}r(hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh}r (U anchornameU #conclusionUrefurijrh]h]h]h]h]Uinternaluh'jh ]rh"X Conclusionrr}r(hX Conclusionrh'j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r (hUh}r!(U anchornameU#feedback-requestedUrefurijrh]h]h]h]h]Uinternaluh'jh ]r"h"XFeedback requestedr#r$}r%(hXFeedback requestedr&h'jubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r'}r((hUh}r)(h]h]h]h]h]uh'j{h ]r*j )r+}r,(hUh}r-(h]h]h]h]h]uh'j'h ]r.j )r/}r0(hUh}r1(U anchornameU#revision-historyUrefurijrh]h]h]h]h]Uinternaluh'j+h ]r2h"XRevision Historyr3r4}r5(hXRevision Historyr6h'j/ubah(j ubah(j ubah(j ubj )r7}r8(hUh}r9(h]h]h]h]h]uh'j{h ]r:j )r;}r<(hUh}r=(h]h]h]h]h]uh'j7h ]r>j )r?}r@(hUh}rA(U anchornameU #copyrightUrefurijrh]h]h]h]h]Uinternaluh'j;h ]rBh"X CopyrightrCrD}rE(hX CopyrightrFh'j?ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj{j )rG}rH(hUh}rI(h]h]h]h]h]uh ]rJj )rK}rL(hUh}rM(h]h]h]h]h]uh'jGh ]rN(j )rO}rP(hUh}rQ(h]h]h]h]h]uh'jKh ]rRj )rS}rT(hUh}rU(U anchornameUUrefurij{h]h]h]h]h]Uinternaluh'jOh ]rVh"Xsyslog parsing in rsyslogrWrX}rY(hjh'jSubah(j ubah(j ubj )rZ}r[(hUh}r\(h]h]h]h]h]uh'jKh ]r](j )r^}r_(hUh}r`(h]h]h]h]h]uh'jZh ]raj )rb}rc(hUh}rd(h]h]h]h]h]uh'j^h ]rej )rf}rg(hUh}rh(U anchornameU#syslog-standardizationUrefurij{h]h]h]h]h]Uinternaluh'jbh ]rih"XSyslog Standardizationrjrk}rl(hXSyslog Standardizationh'jfubah(j ubah(j ubah(j ubj )rm}rn(hUh}ro(h]h]h]h]h]uh'jZh ]rpj )rq}rr(hUh}rs(h]h]h]h]h]uh'jmh ]rtj )ru}rv(hUh}rw(U anchornameU#practical-format-requirementsUrefurij{h]h]h]h]h]Uinternaluh'jqh ]rxh"XPractical Format Requirementsryrz}r{(hXPractical Format Requirementsh'juubah(j ubah(j ubah(j ubj )r|}r}(hUh}r~(h]h]h]h]h]uh'jZh ]rj )r}r(hUh}r(h]h]h]h]h]uh'j|h ]rj )r}r(hUh}r(U anchornameU #work-aroundUrefurij{h]h]h]h]h]Uinternaluh'jh ]rh"X Work-Aroundrr}r(hX Work-Aroundh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jZh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#the-ultimate-solutionUrefurij{h]h]h]h]h]Uinternaluh'jh ]rh"XThe Ultimate Solution...rr}r(hXThe Ultimate Solution...h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jZh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#wrap-upUrefurij{h]h]h]h]h]Uinternaluh'jh ]rh"XWrap-Uprr}r(hXWrap-Uph'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XMultiple Rulesets in rsyslogrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#what-is-a-rulesetUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XWhat is a Ruleset?rr}r(hXWhat is a Ruleset?h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU$#what-does-to-bind-to-a-ruleset-meanUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X&What does "To bind to a Ruleset" mean?rr}r(hX&What does "To bind to a Ruleset" mean?h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU?#why-are-rulesets-important-for-different-parser-configurationsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X?Why are rulesets important for different parser configurations?rr}r(hX?Why are rulesets important for different parser configurations?h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU-#can-i-use-a-different-ruleset-as-the-defaultUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X-Can I use a different Ruleset as the default?rr}r(hX-Can I use a different Ruleset as the default?h'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#rulesets-and-queuesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XRulesets and Queuesrr }r (hXRulesets and Queuesh'jubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'j h ]rj )r}r(hUh}r(U anchornameU #examplesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XExamplesrr}r(hXExamplesh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'j h ]r(j )r}r(hUh}r (h]h]h]h]h]uh'jh ]r!j )r"}r#(hUh}r$(h]h]h]h]h]uh'jh ]r%j )r&}r'(hUh}r((U anchornameU#split-local-and-remote-loggingUrefurijh]h]h]h]h]Uinternaluh'j"h ]r)h"XSplit local and remote loggingr*r+}r,(hXSplit local and remote loggingh'j&ubah(j ubah(j ubah(j ubj )r-}r.(hUh}r/(h]h]h]h]h]uh'jh ]r0j )r1}r2(hUh}r3(h]h]h]h]h]uh'j-h ]r4j )r5}r6(hUh}r7(U anchornameU9#split-local-and-remote-logging-for-three-different-portsUrefurijh]h]h]h]h]Uinternaluh'j1h ]r8h"X8Split local and remote logging for three different portsr9r:}r;(hX8Split local and remote logging for three different portsh'j5ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r<}r=(hUh}r>(h]h]h]h]h]uh'jh ]r?(j )r@}rA(hUh}rB(h]h]h]h]h]uh'j<h ]rCj )rD}rE(hUh}rF(U anchornameU #performanceUrefurijh]h]h]h]h]Uinternaluh'j@h ]rGh"X PerformancerHrI}rJ(hX Performanceh'jDubah(j ubah(j ubj )rK}rL(hUh}rM(h]h]h]h]h]uh'j<h ]rN(j )rO}rP(hUh}rQ(h]h]h]h]h]uh'jKh ]rRj )rS}rT(hUh}rU(h]h]h]h]h]uh'jOh ]rVj )rW}rX(hUh}rY(U anchornameU#fewer-filtersUrefurijh]h]h]h]h]Uinternaluh'jSh ]rZh"X Fewer Filtersr[r\}r](hX Fewer Filtersh'jWubah(j ubah(j ubah(j ubj )r^}r_(hUh}r`(h]h]h]h]h]uh'jKh ]raj )rb}rc(hUh}rd(h]h]h]h]h]uh'j^h ]rej )rf}rg(hUh}rh(U anchornameU#partitioning-of-input-dataUrefurijh]h]h]h]h]Uinternaluh'jbh ]rih"XPartitioning of Input Datarjrk}rl(hXPartitioning of Input Datah'jfubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )rm}rn(hUh}ro(h]h]h]h]h]uh'jh ]rp(j )rq}rr(hUh}rs(h]h]h]h]h]uh'jmh ]rtj )ru}rv(hUh}rw(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'jqh ]rxh"XSee Alsoryrz}r{(hXSee Alsoh'juubah(j ubah(j ubj )r|}r}(hUh}r~(h]h]h]h]h]uh'jmh ]rj )r}r(hUh'j|j X=/home/rger/proj/rsyslog-doc/source/concepts/multi_ruleset.rsth(j h}r(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rNjraUhiddenUcaptionNU includefiles]rjaU includehiddenuj M<h ]ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XControl Structuresrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#ifUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xifrr}r(hXifrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#if-else-if-elseUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xif/else-if/elserr}r(hXif/else-if/elserh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#foreachUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xforeachrr}r(hXforeachrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#callUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xcallrr}r(hXcallrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #continueUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xcontinuerr}r(hXcontinuerh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X"Compatibility Notes for rsyslog v8rr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r (hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh}r(U anchornameU#mark-messagesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Mark Messagesrr}r(hX Mark Messagesh'j ubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#untested-modulesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XUntested Modulesrr }r!(hXUntested Modulesh'jubah(j ubah(j ubah(j ubj )r"}r#(hUh}r$(h]h]h]h]h]uh'jh ]r%(j )r&}r'(hUh}r((h]h]h]h]h]uh'j"h ]r)j )r*}r+(hUh}r,(U anchornameU#what-developers-need-to-knowUrefurijh]h]h]h]h]Uinternaluh'j&h ]r-h"XWhat Developers need to Knowr.r/}r0(hXWhat Developers need to Knowh'j*ubah(j ubah(j ubj )r1}r2(hUh}r3(h]h]h]h]h]uh'j"h ]r4(j )r5}r6(hUh}r7(h]h]h]h]h]uh'j1h ]r8j )r9}r:(hUh}r;(h]h]h]h]h]uh'j5h ]r<j )r=}r>(hUh}r?(U anchornameU#output-plugin-interfaceUrefurijh]h]h]h]h]Uinternaluh'j9h ]r@h"Xoutput plugin interfacerArB}rC(hXoutput plugin interfaceh'j=ubah(j ubah(j ubah(j ubj )rD}rE(hUh}rF(h]h]h]h]h]uh'j1h ]rGj )rH}rI(hUh}rJ(h]h]h]h]h]uh'jDh ]rKj )rL}rM(hUh}rN(U anchornameU#string-generator-interfaceUrefurijh]h]h]h]h]Uinternaluh'jHh ]rOh"Xstring generator interfacerPrQ}rR(hXstring generator interfaceh'jLubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )rS}rT(hUh}rU(h]h]h]h]h]uh'jh ]rV(j )rW}rX(hUh}rY(h]h]h]h]h]uh'jSh ]rZj )r[}r\(hUh}r](U anchornameU"#specifics-for-version-8-3-and-8-4Urefurijh]h]h]h]h]Uinternaluh'jWh ]r^h"X!Specifics for Version 8.3 and 8.4r_r`}ra(hX!Specifics for Version 8.3 and 8.4h'j[ubah(j ubah(j ubj )rb}rc(hUh}rd(h]h]h]h]h]uh'jSh ]rej )rf}rg(hUh}rh(h]h]h]h]h]uh'jbh ]rij )rj}rk(hUh}rl(h]h]h]h]h]uh'jfh ]rmj )rn}ro(hUh}rp(U anchornameU)#unsupported-command-line-options-removedUrefurijh]h]h]h]h]Uinternaluh'jjh ]rqh"X(Unsupported Command Line Options Removedrrrs}rt(hX(Unsupported Command Line Options Removedh'jnubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )ru}rv(hUh}rw(h]h]h]h]h]uh'jh ]rx(j )ry}rz(hUh}r{(h]h]h]h]h]uh'juh ]r|j )r}}r~(hUh}r(U anchornameU"#specifics-for-version-8-5-and-8-6Urefurijh]h]h]h]h]Uinternaluh'jyh ]rh"X!Specifics for Version 8.5 and 8.6rr}r(hX!Specifics for Version 8.5 and 8.6h'j}ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'juh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#imfile-changesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Ximfile changesrr}r(hXimfile changesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#command-line-optionsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCommand Line Optionsrr}r(hXCommand Line Optionsh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XLibrary Modulesrr}r(hjh'jubah(j ubah(j ubah(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XInstalling rsyslog from Packagerr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#package-availabilityUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XPackage Availabilityrr}r(hXPackage Availabilityrh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#package-structureUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XPackage Structurerr}r(hXPackage Structurerh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #contributingUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Contributingrr}r(hX Contributingrh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r (hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Installationrr}r(hjh'j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh'jj X9/home/rger/proj/rsyslog-doc/source/installation/index.rstrh(j h}r(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r(NjrNjrNjreUhiddenUcaptionNU includefiles]r(jjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r }r!(hUh}r"(h]h]h]h]h]uh ]r#j )r$}r%(hUh}r&(h]h]h]h]h]uh'j h ]r'j )r(}r)(hUh}r*(h]h]h]h]h]uh'j$h ]r+j )r,}r-(hUh}r.(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j(h ]r/h"X $DirOwnerr0r1}r2(hjh'j,ubah(j ubah(j ubah(j ubah(j! ubjj )r3}r4(hUh}r5(h]h]h]h]h]uh ]r6j )r7}r8(hUh}r9(h]h]h]h]h]uh'j3h ]r:(j )r;}r<(hUh}r=(h]h]h]h]h]uh'j7h ]r>j )r?}r@(hUh}rA(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j;h ]rBh"X TutorialsrCrD}rE(hjh'j?ubah(j ubah(j ubj )rF}rG(hUh}rH(h]h]h]h]h]uh'j7h ]rIj )rJ}rK(hUh'jFj X6/home/rger/proj/rsyslog-doc/source/tutorials/index.rstrLh(j h}rM(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rN(NjrONjrPNjrQNjrRNjrSNjrTNjrUNjrVNjrWeUhiddenUcaptionNU includefiles]rX(jjjjjjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )rY}rZ(hUh}r[(h]h]h]h]h]uh ]r\j )r]}r^(hUh}r_(h]h]h]h]h]uh'jYh ]r`(j )ra}rb(hUh}rc(h]h]h]h]h]uh'j]h ]rdj )re}rf(hUh}rg(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jah ]rhh"X+pmrfc3164: Parse RFC3164-formatted messagesrirj}rk(hjh'jeubah(j ubah(j ubj )rl}rm(hUh}rn(h]h]h]h]h]uh'j]h ]ro(j )rp}rq(hUh}rr(h]h]h]h]h]uh'jlh ]rsj )rt}ru(hUh}rv(h]h]h]h]h]uh'jph ]rwj )rx}ry(hUh}rz(U anchornameU#parser-parametersUrefurijh]h]h]h]h]Uinternaluh'jth ]r{h"XParser Parametersr|r}}r~(hXParser Parametersh'jxubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jlh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XExamplerr}r(hXExampleh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"Xomfile: File Output Modulerr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#configuration-parametersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XConfiguration Parametersrr}r(hXConfiguration Parametersh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#general-notesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X General Notesrr}r(hX General Notesh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#module-parametersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XModule Parametersrr}r(hXModule Parametersh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#action-parametersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XAction Parametersrr}r(hXAction Parametersh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSee Alsorr}r(hXSee Alsoh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r (h]h]h]h]h]uh'jh ]r j )r }r (hUh}r (U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XExamplerr}r(hXExampleh'j ubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #legacy-configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XLegacy Configuration Directivesrr}r (hXLegacy Configuration Directivesh'jubah(j ubah(j ubj )r!}r"(hUh}r#(h]h]h]h]h]uh'jh ]r$j )r%}r&(hUh}r'(h]h]h]h]h]uh'j!h ]r(j )r)}r*(hUh}r+(h]h]h]h]h]uh'j%h ]r,j )r-}r.(hUh}r/(U anchornameU#legacy-sampleUrefurijh]h]h]h]h]Uinternaluh'j)h ]r0h"X Legacy Sampler1r2}r3(hX Legacy Sampleh'j-ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r4}r5(hUh}r6(h]h]h]h]h]uh ]r7j )r8}r9(hUh}r:(h]h]h]h]h]uh'j4h ]r;(j )r<}r=(hUh}r>(h]h]h]h]h]uh'j8h ]r?j )r@}rA(hUh}rB(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j<h ]rCh"XSetting up a clientrDrE}rF(hjh'j@ubah(j ubah(j ubj )rG}rH(hUh}rI(h]h]h]h]h]uh'j8h ]rJj )rK}rL(hUh}rM(h]h]h]h]h]uh'jGh ]rNj )rO}rP(hUh}rQ(h]h]h]h]h]uh'jKh ]rRj )rS}rT(hUh}rU(U anchornameU#sample-syslog-confUrefurijh]h]h]h]h]Uinternaluh'jOh ]rVh"XSample syslog.confrWrX}rY(hXSample syslog.confh'jSubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjj )rZ}r[(hUh}r\(h]h]h]h]h]uh ]r]j )r^}r_(hUh}r`(h]h]h]h]h]uh'jZh ]ra(j )rb}rc(hUh}rd(h]h]h]h]h]uh'j^h ]rej )rf}rg(hUh}rh(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jbh ]rih"X;impstats: Generate Periodic Statistics of Internal Countersrjrk}rl(hjh'jfubah(j ubah(j ubj )rm}rn(hUh}ro(h]h]h]h]h]uh'j^h ]rp(j )rq}rr(hUh}rs(h]h]h]h]h]uh'jmh ]rt(j )ru}rv(hUh}rw(h]h]h]h]h]uh'jqh ]rxj )ry}rz(hUh}r{(U anchornameU#configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'juh ]r|h"XConfiguration Directivesr}r~}r(hXConfiguration Directivesh'jyubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jqh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#module-confguration-parametersUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XModule Confguration Parametersrr}r(hXModule Confguration Parametersh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #legacy-configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XLegacy Configuration Directivesrr}r(hXLegacy Configuration Directivesh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jmh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XCaveats/Known Bugsrr}r(hXCaveats/Known Bugsh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jmh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XExamplerr}r(hXExampleh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jmh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#legacy-sampleUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"X Legacy Samplerr}r(hX Legacy Sampleh'jubah(j ubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jmh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XSee Alsorr}r(hXSee Alsoh'jubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r}r(hUh}r(h]h]h]h]h]uh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jh ]rh"XThe rsyslog queue objectrr}r(hjh'jubah(j ubah(j ubj )r}r(hUh}r(h]h]h]h]h]uh'jh ]r(j )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(h]h]h]h]h]uh'jh ]rj )r}r(hUh}r(U anchornameU#some-definitionsUrefurijh]h]h]h]h]Uinternaluh'jh ]r h"XSome definitionsr r }r (hXSome definitionsh'jubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'jh ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#implementation-detailsUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XImplementation Detailsr r }r (hXImplementation Detailsh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r! (U anchornameU#disk-assisted-modeUrefurijh]h]h]h]h]Uinternaluh'j h ]r" h"XDisk-Assisted Moder# r$ }r% (hXDisk-Assisted Modeh'j ubah(j ubah(j ubah(j ubj )r& }r' (hUh}r( (h]h]h]h]h]uh'j h ]r) j )r* }r+ (hUh}r, (h]h]h]h]h]uh'j& h ]r- j )r. }r/ (hUh}r0 (U anchornameU#da-run-mode-initializationUrefurijh]h]h]h]h]Uinternaluh'j* h ]r1 h"XDA Run Mode Initializationr2 r3 }r4 (hXDA Run Mode Initializationh'j. ubah(j ubah(j ubah(j ubj )r5 }r6 (hUh}r7 (h]h]h]h]h]uh'j h ]r8 j )r9 }r: (hUh}r; (h]h]h]h]h]uh'j5 h ]r< j )r= }r> (hUh}r? (U anchornameU#da-run-mode-shutdownUrefurijh]h]h]h]h]Uinternaluh'j9 h ]r@ h"XDA Run Mode ShutdownrA rB }rC (hXDA Run Mode Shutdownh'j= ubah(j ubah(j ubah(j ubj )rD }rE (hUh}rF (h]h]h]h]h]uh'j h ]rG j )rH }rI (hUh}rJ (h]h]h]h]h]uh'jD h ]rK j )rL }rM (hUh}rN (U anchornameU#queue-destructionUrefurijh]h]h]h]h]Uinternaluh'jH h ]rO h"XQueue DestructionrP rQ }rR (hXQueue Destructionh'jL ubah(j ubah(j ubah(j ubj )rS }rT (hUh}rU (h]h]h]h]h]uh'j h ]rV j )rW }rX (hUh}rY (h]h]h]h]h]uh'jS h ]rZ j )r[ }r\ (hUh}r] (U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'jW h ]r^ h"X Copyrightr_ r` }ra (hX Copyrighth'j[ ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )rb }rc (hUh}rd (h]h]h]h]h]uh ]re j )rf }rg (hUh}rh (h]h]h]h]h]uh'jb h ]ri (j )rj }rk (hUh}rl (h]h]h]h]h]uh'jf h ]rm j )rn }ro (hUh}rp (U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jj h ]rq h"Ximptcp: Plain TCP Syslogrr rs }rt (hjh'jn ubah(j ubah(j ubj )ru }rv (hUh}rw (h]h]h]h]h]uh'jf h ]rx (j )ry }rz (hUh}r{ (h]h]h]h]h]uh'ju h ]r| (j )r} }r~ (hUh}r (h]h]h]h]h]uh'jy h ]r j )r }r (hUh}r (U anchornameU#configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'j} h ]r h"XConfiguration Directivesr r }r (hXConfiguration Directivesh'j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'jy h ]r (j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#module-parametersUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XModule Parametersr r }r (hXModule Parametersh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#input-parametersUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XInput Parametersr r }r (hXInput Parametersh'j ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r }r (hUh}r (h]h]h]h]h]uh'ju h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XCaveats/Known Bugsr r }r (hXCaveats/Known Bugsh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'ju h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XExampler r }r (hXExampleh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'ju h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU #legacy-configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'j h ]r h"XLegacy Configuration Directivesr r }r (hXLegacy Configuration Directivesh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'ju h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#id1Urefurijh]h]h]h]h]Uinternaluh'j h ]r h"XCaveats/Known Bugsr r }r (hXCaveats/Known Bugsh'j ubah(j ubah(j ubah(j ubj )r }r (hUh}r (h]h]h]h]h]uh'ju h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (U anchornameU#id2Urefurijh]h]h]h]h]Uinternaluh'j h ]r h"XExampler r }r (hXExampleh'j ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r }r (hUh}r (h]h]h]h]h]uh ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r j )r }r (hUh}r (h]h]h]h]h]uh'j h ]r!j )r!}r!(hUh}r!(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j h ]r!h"X#$DropMsgsWithMaliciousDnsPTRRecordsr!r!}r!(hj h'j!ubah(j ubah(j ubah(j ubah(j! ubj j )r!}r !(hUh}r !(h]h]h]h]h]uh ]r !j )r !}r !(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j !h ]r!j )r!}r!(hUh}r!(U anchornameUUrefurij h]h]h]h]h]Uinternaluh'j!h ]r!h"X"syslog-protocol support in rsyslogr!r!}r!(hjh'j!ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j !h ]r!(j )r!}r !(hUh}r!!(h]h]h]h]h]uh'j!h ]r"!j )r#!}r$!(hUh}r%!(h]h]h]h]h]uh'j!h ]r&!j )r'!}r(!(hUh}r)!(U anchornameU##currently-supported-message-formatUrefurij h]h]h]h]h]Uinternaluh'j#!h ]r*!h"X"Currently supported message formatr+!r,!}r-!(hX"Currently supported message formatr.!h'j'!ubah(j ubah(j ubah(j ubj )r/!}r0!(hUh}r1!(h]h]h]h]h]uh'j!h ]r2!j )r3!}r4!(hUh}r5!(h]h]h]h]h]uh'j/!h ]r6!j )r7!}r8!(hUh}r9!(U anchornameU#capabilities-implementedUrefurij h]h]h]h]h]Uinternaluh'j3!h ]r:!h"XCapabilities Implementedr;!r!h'j7!ubah(j ubah(j ubah(j ubj )r?!}r@!(hUh}rA!(h]h]h]h]h]uh'j!h ]rB!j )rC!}rD!(hUh}rE!(h]h]h]h]h]uh'j?!h ]rF!j )rG!}rH!(hUh}rI!(U anchornameU #findingsUrefurij h]h]h]h]h]Uinternaluh'jC!h ]rJ!h"XFindingsrK!rL!}rM!(hXFindingsrN!h'jG!ubah(j ubah(j ubah(j ubj )rO!}rP!(hUh}rQ!(h]h]h]h]h]uh'j!h ]rR!j )rS!}rT!(hUh}rU!(h]h]h]h]h]uh'jO!h ]rV!j )rW!}rX!(hUh}rY!(U anchornameU#conlusions-suggestionsUrefurij h]h]h]h]h]Uinternaluh'jS!h ]rZ!h"XConlusions/Suggestionsr[!r\!}r]!(hXConlusions/Suggestionsr^!h'jW!ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r_!}r`!(hUh}ra!(h]h]h]h]h]uh ]rb!j )rc!}rd!(hUh}re!(h]h]h]h]h]uh'j_!h ]rf!(j )rg!}rh!(hUh}ri!(h]h]h]h]h]uh'jc!h ]rj!j )rk!}rl!(hUh}rm!(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jg!h ]rn!h"XParser Modulesro!rp!}rq!(hjh'jk!ubah(j ubah(j ubj )rr!}rs!(hUh}rt!(h]h]h]h]h]uh'jc!h ]ru!j )rv!}rw!(hUh'jr!j XG/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_parser.rsth(j h}rx!(UnumberedKUparentjU titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]ry!(NjPrz!Nj r{!Njr|!Njr}!Njr~!Njr!eUhiddenUcaptionNU includefiles]r!(jPj jjjjeU includehiddenuj K h ]ubah(j! ubeh(j ubah(j! ubjj )r!}r!(hUh}r!(h]h]h]h]h]uh ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"XWriting Rsyslog Output Pluginsr!r!}r!(hj%h'j!ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU#getting-started-and-samplesUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"XGetting Started and Samplesr!r!}r!(hXGetting Started and Samplesh'j!ubah(j ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU#special-topicsUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"XSpecial Topicsr!r!}r!(hXSpecial Topicsh'j!ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU #threadingUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"X Threadingr!r!}r!(hX Threadingh'j!ubah(j ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU#getting-message-dataUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"XGetting Message Datar!r!}r!(hXGetting Message Datah'j!ubah(j ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU#batching-of-messagesUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"XBatching of Messagesr!r!}r!(hXBatching of Messagesh'j!ubah(j ubah(j ubah(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r!(U anchornameU$#output-plugin-transaction-interfaceUrefurijh]h]h]h]h]Uinternaluh'j!h ]r!h"X#Output Plugin Transaction Interfacer!r!}r!(hX#Output Plugin Transaction Interfaceh'j!ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!(j )r!}r!(hUh}r!(h]h]h]h]h]uh'j!h ]r!j )r!}r!(hUh}r"(U anchornameU #open-issuesUrefurijh]h]h]h]h]Uinternaluh'j!h ]r"h"X Open Issuesr"r"}r"(hX Open Issuesh'j!ubah(j ubah(j ubj )r"}r"(hUh}r"(h]h]h]h]h]uh'j!h ]r"j )r "}r "(hUh}r "(h]h]h]h]h]uh'j"h ]r "j )r "}r"(hUh}r"(h]h]h]h]h]uh'j "h ]r"j )r"}r"(hUh}r"(U anchornameU #licensingUrefurijh]h]h]h]h]Uinternaluh'j "h ]r"h"X Licensingr"r"}r"(hX Licensingh'j"ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r"}r"(hUh}r"(h]h]h]h]h]uh'j!h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r "}r!"(hUh}r""(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'j"h ]r#"h"X Copyrightr$"r%"}r&"(hX Copyrighth'j "ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj&j )r'"}r("(hUh}r)"(h]h]h]h]h]uh ]r*"j )r+"}r,"(hUh}r-"(h]h]h]h]h]uh'j'"h ]r."j )r/"}r0"(hUh}r1"(h]h]h]h]h]uh'j+"h ]r2"j )r3"}r4"(hUh}r5"(U anchornameUUrefurij&h]h]h]h]h]Uinternaluh'j/"h ]r6"h"Xomhiredis: Redis Output Moduler7"r8"}r9"(hj.h'j3"ubah(j ubah(j ubah(j ubah(j! ubj/j )r:"}r;"(hUh}r<"(h]h]h]h]h]uh ]r="j )r>"}r?"(hUh}r@"(h]h]h]h]h]uh'j:"h ]rA"(j )rB"}rC"(hUh}rD"(h]h]h]h]h]uh'j>"h ]rE"j )rF"}rG"(hUh}rH"(U anchornameUUrefurij/h]h]h]h]h]Uinternaluh'jB"h ]rI"h"XExample Use CasesrJ"rK"}rL"(hj7h'jF"ubah(j ubah(j ubj )rM"}rN"(hUh}rO"(h]h]h]h]h]uh'j>"h ]rP"j )rQ"}rR"(hUh'jM"j X5/home/rger/proj/rsyslog-doc/source/examples/index.rsth(j h}rS"(UnumberedKUparentj/U titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rT"NjrU"aUhiddenUcaptionNU includefiles]rV"jaU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubj8j )rW"}rX"(hUh}rY"(h]h]h]h]h]uh ]rZ"j )r["}r\"(hUh}r]"(h]h]h]h]h]uh'jW"h ]r^"(j )r_"}r`"(hUh}ra"(h]h]h]h]h]uh'j["h ]rb"j )rc"}rd"(hUh}re"(U anchornameUUrefurij8h]h]h]h]h]Uinternaluh'j_"h ]rf"h"XLegacy Configuration Directivesrg"rh"}ri"(hj@h'jc"ubah(j ubah(j ubj )rj"}rk"(hUh}rl"(h]h]h]h]h]uh'j["h ]rm"j )rn"}ro"(hUh'jj"j XE/home/rger/proj/rsyslog-doc/source/configuration/index_directives.rsth(j h}rp"(UnumberedKUparentj8U titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rq"(Njrr"Njrs"Njrt"Njru"Njrv"eUhiddenUcaptionNU includefiles]rw"(jjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjAj )rx"}ry"(hUh}rz"(h]h]h]h]h]uh ]r{"j )r|"}r}"(hUh}r~"(h]h]h]h]h]uh'jx"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j|"h ]r"j )r"}r"(hUh}r"(U anchornameUUrefurijAh]h]h]h]h]Uinternaluh'j"h ]r"h"X7Where are the modules integrated into the Message Flow?r"r"}r"(hjIh'j"ubah(j ubah(j ubah(j ubah(j! ubjJj )r"}r"(hUh}r"(h]h]h]h]h]uh ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameUUrefurijJh]h]h]h]h]Uinternaluh'j"h ]r"h"X*ompgsql: PostgreSQL Database Output Moduler"r"}r"(hjRh'j"ubah(j ubah(j ubah(j ubah(j! ubjSj )r"}r"(hUh}r"(h]h]h]h]h]uh ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"(j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameUUrefurijSh]h]h]h]h]Uinternaluh'j"h ]r"h"X"Generating the machine certificater"r"}r"(hj[h'j"ubah(j ubah(j ubj )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"(j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameU#sample-screen-sessionUrefurijSh]h]h]h]h]Uinternaluh'j"h ]r"h"XSample Screen Sessionr"r"}r"(hXSample Screen Sessionr"h'j"ubah(j ubah(j ubah(j ubj )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameU#distributing-filesUrefurijSh]h]h]h]h]Uinternaluh'j"h ]r"h"XDistributing Filesr"r"}r"(hXDistributing Filesr"h'j"ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj\j )r"}r"(hUh}r"(h]h]h]h]h]uh ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameUUrefurij\h]h]h]h]h]Uinternaluh'j"h ]r"h"XOutput Channelsr"r"}r"(hjdh'j"ubah(j ubah(j ubah(j ubah(j! ubjej )r"}r"(hUh}r"(h]h]h]h]h]uh ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(h]h]h]h]h]uh'j"h ]r"j )r"}r"(hUh}r"(U anchornameUUrefurijeh]h]h]h]h]Uinternaluh'j"h ]r"h"X$DropTrailingLFOnReceptionr"r"}r"(hjmh'j"ubah(j ubah(j ubah(j ubah(j! ubjnj )r"}r"(hUh}r"(h]h]h]h]h]uh ]r"j )r"}r#(hUh}r#(h]h]h]h]h]uh'j"h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j"h ]r#j )r#}r#(hUh}r #(U anchornameUUrefurijnh]h]h]h]h]Uinternaluh'j#h ]r #h"XError Messagesr #r #}r #(hjvh'j#ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j"h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameU#certificate-invalidUrefurijnh]h]h]h]h]Uinternaluh'j#h ]r#h"Xcertificate invalidr#r#}r #(hXcertificate invalidh'j#ubah(j ubah(j ubj )r!#}r"#(hUh}r##(h]h]h]h]h]uh'j#h ]r$#j )r%#}r&#(hUh}r'#(h]h]h]h]h]uh'j!#h ]r(#j )r)#}r*#(hUh}r+#(h]h]h]h]h]uh'j%#h ]r,#j )r-#}r.#(hUh}r/#(U anchornameU#insecure-algorithUrefurijnh]h]h]h]h]Uinternaluh'j)#h ]r0#h"Xinsecure algorithr1#r2#}r3#(hXinsecure algorithh'j-#ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r4#}r5#(hUh}r6#(h]h]h]h]h]uh'j#h ]r7#j )r8#}r9#(hUh}r:#(h]h]h]h]h]uh'j4#h ]r;#j )r<#}r=#(hUh}r>#(U anchornameU#gnutls-error-64Urefurijnh]h]h]h]h]Uinternaluh'j8#h ]r?#h"XGnuTLS error -64r@#rA#}rB#(hXGnuTLS error -64h'j<#ubah(j ubah(j ubah(j ubj )rC#}rD#(hUh}rE#(h]h]h]h]h]uh'j#h ]rF#j )rG#}rH#(hUh}rI#(h]h]h]h]h]uh'jC#h ]rJ#j )rK#}rL#(hUh}rM#(U anchornameU#info-on-invalid-certUrefurijnh]h]h]h]h]Uinternaluh'jG#h ]rN#h"Xinfo on invalid certrO#rP#}rQ#(hXinfo on invalid certh'jK#ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjwj )rR#}rS#(hUh}rT#(h]h]h]h]h]uh ]rU#j )rV#}rW#(hUh}rX#(h]h]h]h]h]uh'jR#h ]rY#(j )rZ#}r[#(hUh}r\#(h]h]h]h]h]uh'jV#h ]r]#j )r^#}r_#(hUh}r`#(U anchornameUUrefurijwh]h]h]h]h]Uinternaluh'jZ#h ]ra#h"XProperty Replacer nomatch moderb#rc#}rd#(hjh'j^#ubah(j ubah(j ubj )re#}rf#(hUh}rg#(h]h]h]h]h]uh'jV#h ]rh#j )ri#}rj#(hUh}rk#(h]h]h]h]h]uh'je#h ]rl#j )rm#}rn#(hUh}ro#(h]h]h]h]h]uh'ji#h ]rp#j )rq#}rr#(hUh}rs#(U anchornameU#summary-of-nomatch-modesUrefurijwh]h]h]h]h]Uinternaluh'jm#h ]rt#h"XSummary of nomatch Modesru#rv#}rw#(hXSummary of nomatch Modesh'jq#ubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjj )rx#}ry#(hUh}rz#(h]h]h]h]h]uh ]r{#j )r|#}r}#(hUh}r~#(h]h]h]h]h]uh'jx#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j|#h ]r#j )r#}r#(hUh}r#(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"X$MarkMessagePeriodr#r#}r#(hjh'j#ubah(j ubah(j ubah(j ubah(j! ubjj )r#}r#(hUh}r#(h]h]h]h]h]uh ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"Xrsyslog Propertiesr#r#}r#(hjh'j#ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameU#message-propertiesUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"XMessage Propertiesr#r#}r#(hXMessage Propertiesh'j#ubah(j ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameU#system-propertiesUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"XSystem Propertiesr#r#}r#(hXSystem Propertiesh'j#ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameU#time-related-system-propertiesUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"XTime-Related System Propertiesr#r#}r#(hXTime-Related System Propertiesh'j#ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r#}r#(hUh}r#(h]h]h]h]h]uh ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"X Output File is not Being Writtenr#r#}r#(hjh'j#ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#(j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(U anchornameU#selinuxUrefurijh]h]h]h]h]Uinternaluh'j#h ]r#h"XSELinuxr#r#}r#(hXSELinuxh'j#ubah(j ubah(j ubah(j ubj )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r#j )r#}r#(hUh}r#(h]h]h]h]h]uh'j#h ]r$j )r$}r$(hUh}r$(U anchornameU#max-number-of-open-filesUrefurijh]h]h]h]h]Uinternaluh'j#h ]r$h"XMax Number of Open Filesr$r$}r$(hXMax Number of Open Filesh'j$ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r$}r $(hUh}r $(h]h]h]h]h]uh ]r $j )r $}r $(hUh}r$(h]h]h]h]h]uh'j$h ]r$(j )r$}r$(hUh}r$(h]h]h]h]h]uh'j $h ]r$j )r$}r$(hUh}r$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"X Compatibilityr$r$}r$(hjh'j$ubah(j ubah(j ubj )r$}r$(hUh}r$(h]h]h]h]h]uh'j $h ]r$j )r$}r $(hUh'j$j X:/home/rger/proj/rsyslog-doc/source/compatibility/index.rsth(j h}r!$(UnumberedKUparentjU titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r"$(Njr#$Njr$$Njr%$Njr&$Njr'$Njr($eUhiddenUcaptionNU includefiles]r)$(jjjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r*$}r+$(hUh}r,$(h]h]h]h]h]uh ]r-$j )r.$}r/$(hUh}r0$(h]h]h]h]h]uh'j*$h ]r1$j )r2$}r3$(hUh}r4$(h]h]h]h]h]uh'j.$h ]r5$j )r6$}r7$(hUh}r8$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j2$h ]r9$h"X Data Typesr:$r;$}r<$(hjh'j6$ubah(j ubah(j ubah(j ubah(j! ubjj )r=$}r>$(hUh}r?$(h]h]h]h]h]uh ]r@$j )rA$}rB$(hUh}rC$(h]h]h]h]h]uh'j=$h ]rD$j )rE$}rF$(hUh}rG$(h]h]h]h]h]uh'jA$h ]rH$j )rI$}rJ$(hUh}rK$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jE$h ]rL$h"Xmmrfc5424addhmacrM$rN$}rO$(hjh'jI$ubah(j ubah(j ubah(j ubah(j! ubjj )rP$}rQ$(hUh}rR$(h]h]h]h]h]uh ]rS$j )rT$}rU$(hUh}rV$(h]h]h]h]h]uh'jP$h ]rW$j )rX$}rY$(hUh}rZ$(h]h]h]h]h]uh'jT$h ]r[$j )r\$}r]$(hUh}r^$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jX$h ]r_$h"X&$ActionExecOnlyWhenPreviousIsSuspendedr`$ra$}rb$(hjh'j\$ubah(j ubah(j ubah(j ubah(j! ubjj )rc$}rd$(hUh}re$(h]h]h]h]h]uh ]rf$j )rg$}rh$(hUh}ri$(h]h]h]h]h]uh'jc$h ]rj$j )rk$}rl$(hUh}rm$(h]h]h]h]h]uh'jg$h ]rn$j )ro$}rp$(hUh}rq$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jk$h ]rr$h"X$DynaFileCacheSizers$rt$}ru$(hjh'jo$ubah(j ubah(j ubah(j ubah(j! ubjj )rv$}rw$(hUh}rx$(h]h]h]h]h]uh ]ry$j )rz$}r{$(hUh}r|$(h]h]h]h]h]uh'jv$h ]r}$(j )r~$}r$(hUh}r$(h]h]h]h]h]uh'jz$h ]r$j )r$}r$(hUh}r$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j~$h ]r$h"X"Compatibility Notes for rsyslog v5r$r$}r$(hjh'j$ubah(j ubah(j ubj )r$}r$(hUh}r$(h]h]h]h]h]uh'jz$h ]r$(j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameU#hup-processingUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XHUP processingr$r$}r$(hXHUP processingh'j$ubah(j ubah(j ubah(j ubj )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameU#queue-on-disk-formatUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XQueue on-disk formatr$r$}r$(hXQueue on-disk formath'j$ubah(j ubah(j ubah(j ubj )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameU#queue-worker-thread-shutdownUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XQueue Worker Thread Shutdownr$r$}r$(hXQueue Worker Thread Shutdownh'j$ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r$}r$(hUh}r$(h]h]h]h]h]uh ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XRSyslog - Historyr$r$}r$(hjh'j$ubah(j ubah(j ubah(j ubah(j! ubjj )r$}r$(hUh}r$(h]h]h]h]h]uh ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$(j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XHistorical Documentsr$r$}r$(hjh'j$ubah(j ubah(j ubj )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh'j$j X7/home/rger/proj/rsyslog-doc/source/historical/index.rsth(j h}r$(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r$(Nj r$Nj r$Nj r$Nj r$eUhiddenUcaptionNU includefiles]r$(j j j j eU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r$}r$(hUh}r$(h]h]h]h]h]uh ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(h]h]h]h]h]uh'j$h ]r$j )r$}r$(hUh}r$(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j$h ]r$h"XBpmrfc3164sd: Parse RFC5424 structured data inside RFC3164 messagesr$r$}r$(hjh'j$ubah(j ubah(j ubah(j ubah(j! ubjj )r%}r%(hUh}r%(h]h]h]h]h]uh ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%(j )r%}r %(hUh}r %(h]h]h]h]h]uh'j%h ]r %j )r %}r %(hUh}r%(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"X;Handling a massive syslog database insert rate with Rsyslogr%r%}r%(hjh'j %ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%(j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r %(hUh}r!%(U anchornameU #abstractUrefurijh]h]h]h]h]Uinternaluh'j%h ]r"%h"XAbstractr#%r$%}r%%(hXAbstractr&%h'j%ubah(j ubah(j ubah(j ubj )r'%}r(%(hUh}r)%(h]h]h]h]h]uh'j%h ]r*%j )r+%}r,%(hUh}r-%(h]h]h]h]h]uh'j'%h ]r.%j )r/%}r0%(hUh}r1%(U anchornameU#the-intentionUrefurijh]h]h]h]h]Uinternaluh'j+%h ]r2%h"X The Intentionr3%r4%}r5%(hX The Intentionr6%h'j/%ubah(j ubah(j ubah(j ubj )r7%}r8%(hUh}r9%(h]h]h]h]h]uh'j%h ]r:%(j )r;%}r<%(hUh}r=%(h]h]h]h]h]uh'j7%h ]r>%j )r?%}r@%(hUh}rA%(U anchornameU #how-to-setupUrefurijh]h]h]h]h]Uinternaluh'j;%h ]rB%h"X How To SetuprC%rD%}rE%(hX How To SetuprF%h'j?%ubah(j ubah(j ubj )rG%}rH%(hUh}rI%(h]h]h]h]h]uh'j7%h ]rJ%j )rK%}rL%(hUh}rM%(h]h]h]h]h]uh'jG%h ]rN%j )rO%}rP%(hUh}rQ%(h]h]h]h]h]uh'jK%h ]rR%j )rS%}rT%(hUh}rU%(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'jO%h ]rV%h"XFeedback requestedrW%rX%}rY%(hXFeedback requestedrZ%h'jS%ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r[%}r\%(hUh}r]%(h]h]h]h]h]uh'j%h ]r^%j )r_%}r`%(hUh}ra%(h]h]h]h]h]uh'j[%h ]rb%j )rc%}rd%(hUh}re%(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'j_%h ]rf%h"XRevision Historyrg%rh%}ri%(hXRevision Historyrj%h'jc%ubah(j ubah(j ubah(j ubj )rk%}rl%(hUh}rm%(h]h]h]h]h]uh'j%h ]rn%j )ro%}rp%(hUh}rq%(h]h]h]h]h]uh'jk%h ]rr%j )rs%}rt%(hUh}ru%(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'jo%h ]rv%h"X Copyrightrw%rx%}ry%(hX Copyrightrz%h'js%ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r{%}r|%(hUh}r}%(h]h]h]h]h]uh ]r~%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j{%h ]r%(j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"Ximklog: Kernel Log Input Moduler%r%}r%(hjh'j%ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%(j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XConfiguration Directivesr%r%}r%(hXConfiguration Directivesh'j%ubah(j ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XCaveats/Known Bugsr%r%}r%(hXCaveats/Known Bugsh'j%ubah(j ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XExampler%r%}r%(hXExampleh'j%ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r%}r%(hUh}r%(h]h]h]h]h]uh ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%(j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XRSyslog - Featuresr%r%}r%(hjh'j%ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%(j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#current-featuresUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XCurrent Featuresr%r%}r%(hXCurrent Featuresh'j%ubah(j ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#world-s-firstUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"X World's firstr%r%}r%(hX World's firsth'j%ubah(j ubah(j ubah(j ubj )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(h]h]h]h]h]uh'j%h ]r%j )r%}r%(hUh}r%(U anchornameU#upcoming-featuresUrefurijh]h]h]h]h]Uinternaluh'j%h ]r%h"XUpcoming Featuresr&r&}r&(hXUpcoming Featuresh'j%ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r&}r&(hUh}r&(h]h]h]h]h]uh ]r&j )r&}r&(hUh}r &(h]h]h]h]h]uh'j&h ]r &j )r &}r &(hUh}r &(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j &h ]r&h"X$GssModer&r&}r&(hjh'j&ubah(j ubah(j ubah(j ubah(j! ubjj )r&}r&(hUh}r&(h]h]h]h]h]uh ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r &(h]h]h]h]h]uh'j&h ]r!&j )r"&}r#&(hUh}r$&(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j&h ]r%&h"XCommunity Resourcesr&&r'&}r(&(hjh'j"&ubah(j ubah(j ubah(j ubah(j! ubjj )r)&}r*&(hUh}r+&(h]h]h]h]h]uh ]r,&(j )r-&}r.&(hUh}r/&(h]h]h]h]h]uh'j)&h ]r0&j )r1&}r2&(hUh}r3&(h]h]h]h]h]uh'j-&h ]r4&j )r5&}r6&(hUh}r7&(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j1&h ]r8&h"XThe rsyslog config data modelr9&r:&}r;&(hj!h'j5&ubah(j ubah(j ubah(j ubj )r<&}r=&(hUh}r>&(h]h]h]h]h]uh'j)&h ]r?&(j )r@&}rA&(hUh}rB&(h]h]h]h]h]uh'j<&h ]rC&j )rD&}rE&(hUh}rF&(U anchornameU#objectsUrefurijh]h]h]h]h]Uinternaluh'j@&h ]rG&h"XObjectsrH&rI&}rJ&(hXObjectsrK&h'jD&ubah(j ubah(j ubj )rL&}rM&(hUh}rN&(h]h]h]h]h]uh'j<&h ]rO&(j )rP&}rQ&(hUh}rR&(h]h]h]h]h]uh'jL&h ]rS&j )rT&}rU&(hUh}rV&(h]h]h]h]h]uh'jP&h ]rW&j )rX&}rY&(hUh}rZ&(U anchornameU#variables-propertiesUrefurijh]h]h]h]h]Uinternaluh'jT&h ]r[&h"XVariables/Propertiesr\&r]&}r^&(hXVariables/Propertiesr_&h'jX&ubah(j ubah(j ubah(j ubj )r`&}ra&(hUh}rb&(h]h]h]h]h]uh'jL&h ]rc&(j )rd&}re&(hUh}rf&(h]h]h]h]h]uh'j`&h ]rg&j )rh&}ri&(hUh}rj&(U anchornameU#flat-elementsUrefurijh]h]h]h]h]Uinternaluh'jd&h ]rk&h"X Flat Elementsrl&rm&}rn&(hX Flat Elementsro&h'jh&ubah(j ubah(j ubj )rp&}rq&(hUh}rr&(h]h]h]h]h]uh'j`&h ]rs&(j )rt&}ru&(hUh}rv&(h]h]h]h]h]uh'jp&h ]rw&j )rx&}ry&(hUh}rz&(h]h]h]h]h]uh'jt&h ]r{&j )r|&}r}&(hUh}r~&(U anchornameU#global-parametersUrefurijh]h]h]h]h]Uinternaluh'jx&h ]r&h"XGlobal Parametersr&r&}r&(hXGlobal Parametersr&h'j|&ubah(j ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'jp&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#modulesUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XModulesr&r&}r&(hXModulesr&h'j&ubah(j ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'jp&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#inputsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XInputsr&r&}r&(hXInputsr&h'j&ubah(j ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'jp&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU #rulesetsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XRulesetsr&r&}r&(hXRulesetsr&h'j&ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'jL&h ]r&(j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#hierarchical-elementsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XHierarchical Elementsr&r&}r&(hXHierarchical Elementsr&h'j&ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&(j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#execution-statementsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XExecution Statementsr&r&}r&(hXExecution Statementsr&h'j&ubah(j ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#expression-evaluationUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XExpression Evaluationr&r&}r&(hXExpression Evaluationr&h'j&ubah(j ubah(j ubah(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r&}r&(hUh}r&(U anchornameU#control-of-flow-statementsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r&h"XControl-of-Flow Statementsr&r&}r&(hXControl-of-Flow Statementsr&h'j&ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r&}r&(hUh}r&(h]h]h]h]h]uh'jL&h ]r&j )r&}r&(hUh}r&(h]h]h]h]h]uh'j&h ]r&j )r'}r'(hUh}r'(U anchornameU#note-on-queue-objectsUrefurijh]h]h]h]h]Uinternaluh'j&h ]r'h"XNote on Queue Objectsr'r'}r'(hXNote on Queue Objectsr'h'j'ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubj"j )r'}r '(hUh}r '(h]h]h]h]h]uh ]r 'j )r '}r '(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j 'h ]r'j )r'}r'(hUh}r'(U anchornameUUrefurij"h]h]h]h]h]Uinternaluh'j'h ]r'h"X ommongodb: MongoDB Output Moduler'r'}r'(hj*h'j'ubah(j ubah(j ubah(j ubah(j! ubj+j )r'}r'(hUh}r'(h]h]h]h]h]uh ]r'j )r'}r '(hUh}r!'(h]h]h]h]h]uh'j'h ]r"'j )r#'}r$'(hUh}r%'(h]h]h]h]h]uh'j'h ]r&'j )r''}r('(hUh}r)'(U anchornameUUrefurij+h]h]h]h]h]Uinternaluh'j#'h ]r*'h"Xglobal() configuration objectr+'r,'}r-'(hj3h'j''ubah(j ubah(j ubah(j ubah(j! ubj4j )r.'}r/'(hUh}r0'(h]h]h]h]h]uh ]r1'j )r2'}r3'(hUh}r4'(h]h]h]h]h]uh'j.'h ]r5'(j )r6'}r7'(hUh}r8'(h]h]h]h]h]uh'j2'h ]r9'j )r:'}r;'(hUh}r<'(U anchornameUUrefurij4h]h]h]h]h]Uinternaluh'j6'h ]r='h"X/Legacy Action-Specific Configuration Statementsr>'r?'}r@'(hj<h'j:'ubah(j ubah(j ubj )rA'}rB'(hUh}rC'(h]h]h]h]h]uh'j2'h ]rD'(j )rE'}rF'(hUh}rG'(h]h]h]h]h]uh'jA'h ]rH'(j )rI'}rJ'(hUh}rK'(h]h]h]h]h]uh'jE'h ]rL'j )rM'}rN'(hUh}rO'(U anchornameU(#generic-action-configuration-statementsUrefurij4h]h]h]h]h]Uinternaluh'jI'h ]rP'h"X'Generic action configuration StatementsrQ'rR'}rS'(hX'Generic action configuration Statementsh'jM'ubah(j ubah(j ubj )rT'}rU'(hUh}rV'(h]h]h]h]h]uh'jE'h ]rW'j )rX'}rY'(hUh'jT'j XA/home/rger/proj/rsyslog-doc/source/configuration/action/index.rstrZ'h(j h}r['(UnumberedKUparentj4U titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r\'(Njr]'Njr^'NjXr_'eUhiddenUcaptionNU includefiles]r`'(jjjXeU includehiddenuj Kh ]ubah(j! ubeh(j ubj )ra'}rb'(hUh}rc'(h]h]h]h]h]uh'jA'h ]rd'(j )re'}rf'(hUh}rg'(h]h]h]h]h]uh'ja'h ]rh'j )ri'}rj'(hUh}rk'(U anchornameU)#omfile-specific-configuration-statementsUrefurij4h]h]h]h]h]Uinternaluh'je'h ]rl'h"X(omfile-specific Configuration Statementsrm'rn'}ro'(hX(omfile-specific Configuration Statementsh'ji'ubah(j ubah(j ubj )rp'}rq'(hUh}rr'(h]h]h]h]h]uh'ja'h ]rs'j )rt'}ru'(hUh'jp'j jZ'h(j h}rv'(UnumberedKUparentj4U titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]rw'(Nh{rx'Nj>ry'Njrz'Njr{'Njr|'Njr}'Njwr~'eUhiddenUcaptionNU includefiles]r'(h{j>jjjjjweU includehiddenuj KAh ]ubah(j! ubeh(j ubj )r'}r'(hUh}r'(h]h]h]h]h]uh'jA'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameU(#omfwd-specific-configuration-statementsUrefurij4h]h]h]h]h]Uinternaluh'j'h ]r'h"X'omfwd-specific Configuration Statementsr'r'}r'(hX'omfwd-specific Configuration Statementsh'j'ubah(j ubah(j ubah(j ubj )r'}r'(hUh}r'(h]h]h]h]h]uh'jA'h ]r'(j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameU+#omgssapi-specific-configuration-statementsUrefurij4h]h]h]h]h]Uinternaluh'j'h ]r'h"X*omgssapi-specific Configuration Statementsr'r'}r'(hX*omgssapi-specific Configuration Statementsh'j'ubah(j ubah(j ubj )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh'j'j jZ'h(j h}r'(UnumberedKUparentj4U titlesonlyUmaxdepthJUglobh]h]h]h]h]Uentries]r'(Nj1r'Njr'eUhiddenUcaptionNU includefiles]r'(j1jeU includehiddenuj Kh ]ubah(j! ubeh(j ubj )r'}r'(hUh}r'(h]h]h]h]h]uh'jA'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameU/#action-queue-specific-configuration-statementsUrefurij4h]h]h]h]h]Uinternaluh'j'h ]r'h"X.action-queue specific Configuration Statementsr'r'}r'(hX.action-queue specific Configuration Statementsh'j'ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj=j )r'}r'(hUh}r'(h]h]h]h]h]uh ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameUUrefurij=h]h]h]h]h]Uinternaluh'j'h ]r'h"X Licensingr'r'}r'(hjEh'j'ubah(j ubah(j ubah(j ubah(j! ubjFj )r'}r'(hUh}r'(h]h]h]h]h]uh ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'(j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameUUrefurijFh]h]h]h]h]Uinternaluh'j'h ]r'h"XInputr'r'}r'(hjNh'j'ubah(j ubah(j ubj )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameU#general-input-parametersUrefurijFh]h]h]h]h]Uinternaluh'j'h ]r'h"XGeneral Input Parametersr'r'}r'(hXGeneral Input Parametersh'j'ubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjOj )r'}r'(hUh}r'(h]h]h]h]h]uh ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(h]h]h]h]h]uh'j'h ]r'j )r'}r'(hUh}r'(U anchornameUUrefurijOh]h]h]h]h]Uinternaluh'j'h ]r(h"XVersion Namingr(r(}r((hjWh'j'ubah(j ubah(j ubah(j ubah(j! ubjXj )r(}r((hUh}r((h]h]h]h]h]uh ]r(j )r(}r ((hUh}r ((h]h]h]h]h]uh'j(h ]r ((j )r (}r ((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh}r((U anchornameUUrefurijXh]h]h]h]h]Uinternaluh'j (h ]r(h"X$RepeatedMsgReductionr(r(}r((hj`h'j(ubah(j ubah(j ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r((j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r ((hUh}r!((h]h]h]h]h]uh'j(h ]r"(j )r#(}r$((hUh}r%((U anchornameU #descriptionUrefurijXh]h]h]h]h]Uinternaluh'j(h ]r&(h"X Descriptionr'(r((}r)((hX Descriptionh'j#(ubah(j ubah(j ubah(j ubj )r*(}r+((hUh}r,((h]h]h]h]h]uh'j(h ]r-(j )r.(}r/((hUh}r0((h]h]h]h]h]uh'j*(h ]r1(j )r2(}r3((hUh}r4((U anchornameU#what-is-a-repeated-messageUrefurijXh]h]h]h]h]Uinternaluh'j.(h ]r5(h"XWhat is a repeated messager6(r7(}r8((hXWhat is a repeated messageh'j2(ubah(j ubah(j ubah(j ubj )r9(}r:((hUh}r;((h]h]h]h]h]uh'j(h ]r<(j )r=(}r>((hUh}r?((h]h]h]h]h]uh'j9(h ]r@(j )rA(}rB((hUh}rC((U anchornameU #discussionUrefurijXh]h]h]h]h]Uinternaluh'j=(h ]rD(h"X DiscussionrE(rF(}rG((hX Discussionh'jA(ubah(j ubah(j ubah(j ubj )rH(}rI((hUh}rJ((h]h]h]h]h]uh'j(h ]rK(j )rL(}rM((hUh}rN((h]h]h]h]h]uh'jH(h ]rO(j )rP(}rQ((hUh}rR((U anchornameU#sampleUrefurijXh]h]h]h]h]Uinternaluh'jL(h ]rS(h"XSamplerT(rU(}rV((hXSampleh'jP(ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjaj )rW(}rX((hUh}rY((h]h]h]h]h]uh ]rZ(j )r[(}r\((hUh}r]((h]h]h]h]h]uh'jW(h ]r^(j )r_(}r`((hUh}ra((h]h]h]h]h]uh'j[(h ]rb(j )rc(}rd((hUh}re((U anchornameUUrefurijah]h]h]h]h]Uinternaluh'j_(h ]rf(h"X&Troubleshooting SELinux-Related Issuesrg(rh(}ri((hjih'jc(ubah(j ubah(j ubah(j ubah(j! ubjjj )rj(}rk((hUh}rl((h]h]h]h]h]uh ]rm(j )rn(}ro((hUh}rp((h]h]h]h]h]uh'jj(h ]rq(j )rr(}rs((hUh}rt((h]h]h]h]h]uh'jn(h ]ru(j )rv(}rw((hUh}rx((U anchornameUUrefurijjh]h]h]h]h]Uinternaluh'jr(h ]ry(h"X(IP Address Anonymization Module (mmanon)rz(r{(}r|((hjrh'jv(ubah(j ubah(j ubah(j ubah(j! ubjsj )r}(}r~((hUh}r((h]h]h]h]h]uh ]r(j )r(}r((hUh}r((h]h]h]h]h]uh'j}(h ]r((j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh}r((U anchornameUUrefurijsh]h]h]h]h]Uinternaluh'j(h ]r(h"X RainerScriptr(r(}r((hj{h'j(ubah(j ubah(j ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh'j(j X9/home/rger/proj/rsyslog-doc/source/rainerscript/index.rstr(h(j h}r((UnumberedKUparentjsU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r((Njr(Njr(Njr(Njr(Njr(Njr(Njr(Njr(Njr(Njr(Njr(Njr(eUhiddenUcaptionNU includefiles]r((jjjjjjjjjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubj|j )r(}r((hUh}r((h]h]h]h]h]uh ]r(j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r((j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh}r((U anchornameUUrefurij|h]h]h]h]h]Uinternaluh'j(h ]r(h"XModulesr(r(}r((hjh'j(ubah(j ubah(j ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh'j(j XB/home/rger/proj/rsyslog-doc/source/configuration/modules/index.rsth(j h}r((UnumberedKUparentj|U titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r((Njr(Njr(Njr(Njr(Njr(Njr(Njr(eUhiddenUcaptionNU includefiles]r((jjjjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r(}r((hUh}r((h]h]h]h]h]uh ]r(j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r((j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh}r((U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j(h ]r(h"X(Encrypting Syslog Traffic with TLS (SSL)r(r(}r((hjh'j(ubah(j ubah(j ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r((j )r(}r((hUh'j(j XA/home/rger/proj/rsyslog-doc/source/tutorials/tls_cert_summary.rstr(h(j h}r((UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r((Njr(Njr(Njr(Njr(Njr(Njr(Njr(eUhiddenUcaptionNU includefiles]r((jjjjjjjeU includehiddenuj Kh ]ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r((j )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r(j )r(}r((hUh}r((U anchornameU #overviewUrefurijh]h]h]h]h]Uinternaluh'j(h ]r(h"XOverviewr(r(}r((hXOverviewr(h'j(ubah(j ubah(j ubj )r(}r((hUh}r((h]h]h]h]h]uh'j(h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j(h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r )}r )(hUh}r )(U anchornameU#summaryUrefurijh]h]h]h]h]Uinternaluh'j)h ]r )h"XSummaryr )r)}r)(hXSummaryr)h'j )ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r)}r)(hUh}r)(h]h]h]h]h]uh ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)(j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j)h ]r )h"X Functionsr!)r")}r#)(hjh'j)ubah(j ubah(j ubj )r$)}r%)(hUh}r&)(h]h]h]h]h]uh'j)h ]r')(j )r()}r))(hUh}r*)(h]h]h]h]h]uh'j$)h ]r+)j )r,)}r-)(hUh}r.)(h]h]h]h]h]uh'j()h ]r/)j )r0)}r1)(hUh}r2)(U anchornameU #getenv-strUrefurijh]h]h]h]h]Uinternaluh'j,)h ]r3)h"X getenv(str)r4)r5)}r6)(hX getenv(str)r7)h'j0)ubah(j ubah(j ubah(j ubj )r8)}r9)(hUh}r:)(h]h]h]h]h]uh'j$)h ]r;)j )r<)}r=)(hUh}r>)(h]h]h]h]h]uh'j8)h ]r?)j )r@)}rA)(hUh}rB)(U anchornameU #strlen-strUrefurijh]h]h]h]h]Uinternaluh'j<)h ]rC)h"X strlen(str)rD)rE)}rF)(hX strlen(str)rG)h'j@)ubah(j ubah(j ubah(j ubj )rH)}rI)(hUh}rJ)(h]h]h]h]h]uh'j$)h ]rK)j )rL)}rM)(hUh}rN)(h]h]h]h]h]uh'jH)h ]rO)j )rP)}rQ)(hUh}rR)(U anchornameU #tolower-strUrefurijh]h]h]h]h]Uinternaluh'jL)h ]rS)h"X tolower(str)rT)rU)}rV)(hX tolower(str)rW)h'jP)ubah(j ubah(j ubah(j ubj )rX)}rY)(hUh}rZ)(h]h]h]h]h]uh'j$)h ]r[)j )r\)}r])(hUh}r^)(h]h]h]h]h]uh'jX)h ]r_)j )r`)}ra)(hUh}rb)(U anchornameU #cstr-exprUrefurijh]h]h]h]h]Uinternaluh'j\)h ]rc)h"X cstr(expr)rd)re)}rf)(hX cstr(expr)rg)h'j`)ubah(j ubah(j ubah(j ubj )rh)}ri)(hUh}rj)(h]h]h]h]h]uh'j$)h ]rk)j )rl)}rm)(hUh}rn)(h]h]h]h]h]uh'jh)h ]ro)j )rp)}rq)(hUh}rr)(U anchornameU #cnum-exprUrefurijh]h]h]h]h]Uinternaluh'jl)h ]rs)h"X cnum(expr)rt)ru)}rv)(hX cnum(expr)rw)h'jp)ubah(j ubah(j ubah(j ubj )rx)}ry)(hUh}rz)(h]h]h]h]h]uh'j$)h ]r{)j )r|)}r})(hUh}r~)(h]h]h]h]h]uh'jx)h ]r)j )r)}r)(hUh}r)(U anchornameU#wrap-str-wrapper-strUrefurijh]h]h]h]h]Uinternaluh'j|)h ]r)h"Xwrap(str, wrapper_str)r)r)}r)(hXwrap(str, wrapper_str)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU!#wrap-str-wrapper-str-escaper-strUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"X#wrap(str, wrapper_str, escaper_str)r)r)}r)(hX#wrap(str, wrapper_str, escaper_str)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU+#replace-str-substr-to-replace-replace-withUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"X-replace(str, substr_to_replace, replace_with)r)r)}r)(hX-replace(str, substr_to_replace, replace_with)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU#re-match-expr-reUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"Xre_match(expr, re)r)r)}r)(hXre\_match(expr, re)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU+#re-extract-expr-re-match-submatch-no-foundUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"X/re_extract(expr, re, match, submatch, no-found)r)r)}r)(hX0re\_extract(expr, re, match, submatch, no-found)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU#field-str-delim-matchnbrUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"Xfield(str, delim, matchnbr)r)r)}r)(hXfield(str, delim, matchnbr)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU#prifilt-constantUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"Xprifilt(constant)r)r)}r)(hXprifilt(constant)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r)}r)(hUh}r)(U anchornameU(#dyn-inc-bucket-name-litteral-string-strUrefurijh]h]h]h]h]Uinternaluh'j)h ]r)h"X)dyn_inc(bucket_name_litteral_string, str)r)r)}r)(hX)dyn_inc(bucket_name_litteral_string, str)r)h'j)ubah(j ubah(j ubah(j ubj )r)}r)(hUh}r)(h]h]h]h]h]uh'j$)h ]r)j )r)}r)(hUh}r)(h]h]h]h]h]uh'j)h ]r)j )r*}r*(hUh}r*(U anchornameU&#lookup-table-name-litteral-string-keyUrefurijh]h]h]h]h]Uinternaluh'j)h ]r*h"X'lookup(table_name_litteral_string, key)r*r*}r*(hX'lookup(table_name_litteral_string, key)r*h'j*ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r*}r *(hUh}r *(h]h]h]h]h]uh ]r *j )r *}r *(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j *h ]r*j )r*}r*(hUh}r*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"Xompipe: Pipe Output Moduler*r*}r*(hjh'j*ubah(j ubah(j ubah(j ubah(j! ubjj )r*}r*(hUh}r*(h]h]h]h]h]uh ]r*j )r*}r *(hUh}r!*(h]h]h]h]h]uh'j*h ]r"*(j )r#*}r$*(hUh}r%*(h]h]h]h]h]uh'j*h ]r&*j )r'*}r(*(hUh}r)*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j#*h ]r**h"Xtimezoner+*r,*}r-*(hjh'j'*ubah(j ubah(j ubj )r.*}r/*(hUh}r0*(h]h]h]h]h]uh'j*h ]r1*(j )r2*}r3*(hUh}r4*(h]h]h]h]h]uh'j.*h ]r5*j )r6*}r7*(hUh}r8*(h]h]h]h]h]uh'j2*h ]r9*j )r:*}r;*(hUh}r<*(U anchornameU #parametersUrefurijh]h]h]h]h]Uinternaluh'j6*h ]r=*h"X Parametersr>*r?*}r@*(hX Parametersh'j:*ubah(j ubah(j ubah(j ubj )rA*}rB*(hUh}rC*(h]h]h]h]h]uh'j.*h ]rD*j )rE*}rF*(hUh}rG*(h]h]h]h]h]uh'jA*h ]rH*j )rI*}rJ*(hUh}rK*(U anchornameU#sampleUrefurijh]h]h]h]h]Uinternaluh'jE*h ]rL*h"XSamplerM*rN*}rO*(hXSampleh'jI*ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )rP*}rQ*(hUh}rR*(h]h]h]h]h]uh ]rS*j )rT*}rU*(hUh}rV*(h]h]h]h]h]uh'jP*h ]rW*(j )rX*}rY*(hUh}rZ*(h]h]h]h]h]uh'jT*h ]r[*j )r\*}r]*(hUh}r^*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jX*h ]r_*h"XSetting up the CAr`*ra*}rb*(hjh'j\*ubah(j ubah(j ubj )rc*}rd*(hUh}re*(h]h]h]h]h]uh'jT*h ]rf*j )rg*}rh*(hUh}ri*(h]h]h]h]h]uh'jc*h ]rj*j )rk*}rl*(hUh}rm*(h]h]h]h]h]uh'jg*h ]rn*j )ro*}rp*(hUh}rq*(U anchornameU#sample-screen-sessionUrefurijh]h]h]h]h]Uinternaluh'jk*h ]rr*h"XSample Screen Sessionrs*rt*}ru*(hXSample Screen Sessionh'jo*ubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjj )rv*}rw*(hUh}rx*(h]h]h]h]h]uh ]ry*j )rz*}r{*(hUh}r|*(h]h]h]h]h]uh'jv*h ]r}*(j )r~*}r*(hUh}r*(h]h]h]h]h]uh'jz*h ]r*j )r*}r*(hUh}r*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j~*h ]r*h"X+Legacy Format Samples for Multiple Rulesetsr*r*}r*(hjh'j*ubah(j ubah(j ubj )r*}r*(hUh}r*(h]h]h]h]h]uh'jz*h ]r*(j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameU#split-local-and-remote-loggingUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"XSplit local and remote loggingr*r*}r*(hXSplit local and remote loggingh'j*ubah(j ubah(j ubah(j ubj )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameU9#split-local-and-remote-logging-for-three-different-portsUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"X8Split local and remote logging for three different portsr*r*}r*(hX8Split local and remote logging for three different portsh'j*ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r*}r*(hUh}r*(h]h]h]h]h]uh ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"Xgtls Network Stream Driverr*r*}r*(hjh'j*ubah(j ubah(j ubah(j ubah(j! ubjj )r*}r*(hUh}r*(h]h]h]h]h]uh ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*(j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"XExamplesr*r*}r*(hjh'j*ubah(j ubah(j ubj )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*(j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameU #templatesUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"X Templatesr*r*}r*(hX Templatesh'j*ubah(j ubah(j ubah(j ubj )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r*(hUh}r*(U anchornameU#selector-linesUrefurijh]h]h]h]h]Uinternaluh'j*h ]r*h"XSelector linesr*r*}r*(hXSelector linesh'j*ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r*}r*(hUh}r*(h]h]h]h]h]uh ]r*j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*(j )r*}r*(hUh}r*(h]h]h]h]h]uh'j*h ]r*j )r*}r+(hUh}r+(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j*h ]r+h"XNetStream Driversr+r+}r+(hjh'j*ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j*h ]r +j )r +}r +(hUh}r +(h]h]h]h]h]uh'j+h ]r +(j )r+}r+(hUh}r+(h]h]h]h]h]uh'j +h ]r+j )r+}r+(hUh}r+(U anchornameU#current-network-stream-driversUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"XCurrent Network Stream Driversr+r+}r+(hXCurrent Network Stream Driversh'j+ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j +h ]r+j )r+}r+(hUh'j+j X</home/rger/proj/rsyslog-doc/source/concepts/netstrm_drvr.rsth(j h}r+(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r +(Njr!+Njr"+eUhiddenUcaptionNU includefiles]r#+(jjeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubeh(j ubah(j! ubjj )r$+}r%+(hUh}r&+(h]h]h]h]h]uh ]r'+j )r(+}r)+(hUh}r*+(h]h]h]h]h]uh'j$+h ]r++j )r,+}r-+(hUh}r.+(h]h]h]h]h]uh'j(+h ]r/+j )r0+}r1+(hUh}r2+(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j,+h ]r3+h"X$Escape8BitCharactersOnReceiver4+r5+}r6+(hjh'j0+ubah(j ubah(j ubah(j ubah(j! ubjj )r7+}r8+(hUh}r9+(h]h]h]h]h]uh ]r:+j )r;+}r<+(hUh}r=+(h]h]h]h]h]uh'j7+h ]r>+j )r?+}r@+(hUh}rA+(h]h]h]h]h]uh'j;+h ]rB+j )rC+}rD+(hUh}rE+(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j?+h ]rF+h"XThe Janitor ProcessrG+rH+}rI+(hjh'jC+ubah(j ubah(j ubah(j ubah(j! ubjj )rJ+}rK+(hUh}rL+(h]h]h]h]h]uh ]rM+j )rN+}rO+(hUh}rP+(h]h]h]h]h]uh'jJ+h ]rQ+(j )rR+}rS+(hUh}rT+(h]h]h]h]h]uh'jN+h ]rU+j )rV+}rW+(hUh}rX+(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jR+h ]rY+h"X)Recording the Priority of Syslog MessagesrZ+r[+}r\+(hjh'jV+ubah(j ubah(j ubj )r]+}r^+(hUh}r_+(h]h]h]h]h]uh'jN+h ]r`+(j )ra+}rb+(hUh}rc+(h]h]h]h]h]uh'j]+h ]rd+j )re+}rf+(hUh}rg+(h]h]h]h]h]uh'ja+h ]rh+j )ri+}rj+(hUh}rk+(U anchornameU #abstractUrefurijh]h]h]h]h]Uinternaluh'je+h ]rl+h"XAbstractrm+rn+}ro+(hXAbstracth'ji+ubah(j ubah(j ubah(j ubj )rp+}rq+(hUh}rr+(h]h]h]h]h]uh'j]+h ]rs+j )rt+}ru+(hUh}rv+(h]h]h]h]h]uh'jp+h ]rw+j )rx+}ry+(hUh}rz+(U anchornameU #backgroundUrefurijh]h]h]h]h]Uinternaluh'jt+h ]r{+h"X Backgroundr|+r}+}r~+(hX Backgroundh'jx+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU#how-is-it-doneUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"XHow is it done?r+r+}r+(hXHow is it done?h'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU:#what-if-i-do-not-want-rsyslogd-to-be-the-standard-syslogdUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"X:What if I do not want rsyslogd to be the standard syslogd?r+r+}r+(hX:What if I do not want rsyslogd to be the standard syslogd?h'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU#some-sample-dataUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"XSome Sample Datar+r+}r+(hXSome Sample Datah'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"XFeedback Requestedr+r+}r+(hXFeedback Requestedh'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU##references-and-additional-materialUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"X"References and Additional Materialr+r+}r+(hX"References and Additional Materialh'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"XRevision Historyr+r+}r+(hXRevision Historyh'j+ubah(j ubah(j ubah(j ubj )r+}r+(hUh}r+(h]h]h]h]h]uh'j]+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"X Copyrightr+r+}r+(hX Copyrighth'j+ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r+}r+(hUh}r+(h]h]h]h]h]uh ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(h]h]h]h]h]uh'j+h ]r+j )r+}r+(hUh}r+(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j+h ]r+h"X $FileGroupr+r+}r+(hjh'j+ubah(j ubah(j ubah(j ubah(j! ubjj )r+}r+(hUh}r+(h]h]h]h]h]uh ]r+j )r+}r,(hUh}r,(h]h]h]h]h]uh'j+h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j+h ]r,j )r,}r,(hUh}r ,(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j,h ]r ,h"X+pmrfc5424: Parse RFC5424-formatted messagesr ,r ,}r ,(hjh'j,ubah(j ubah(j ubah(j ubah(j! ubjj )r,}r,(hUh}r,(h]h]h]h]h]uh ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"Xrsylog code styler,r,}r ,(hj h'j,ubah(j ubah(j ubah(j ubah(j! ubj j )r!,}r",(hUh}r#,(h]h]h]h]h]uh ]r$,j )r%,}r&,(hUh}r',(h]h]h]h]h]uh'j!,h ]r(,j )r),}r*,(hUh}r+,(h]h]h]h]h]uh'j%,h ]r,,j )r-,}r.,(hUh}r/,(U anchornameUUrefurij h]h]h]h]h]Uinternaluh'j),h ]r0,h"X(pmlastmsg: last message repeated n timesr1,r2,}r3,(hjh'j-,ubah(j ubah(j ubah(j ubah(j! ubjj )r4,}r5,(hUh}r6,(h]h]h]h]h]uh ]r7,j )r8,}r9,(hUh}r:,(h]h]h]h]h]uh'j4,h ]r;,j )r<,}r=,(hUh}r>,(h]h]h]h]h]uh'j8,h ]r?,j )r@,}rA,(hUh}rB,(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j<,h ]rC,h"X$IncludeConfigrD,rE,}rF,(hjh'j@,ubah(j ubah(j ubah(j ubah(j! ubjj )rG,}rH,(hUh}rI,(h]h]h]h]h]uh ]rJ,j )rK,}rL,(hUh}rM,(h]h]h]h]h]uh'jG,h ]rN,(j )rO,}rP,(hUh}rQ,(h]h]h]h]h]uh'jK,h ]rR,j )rS,}rT,(hUh}rU,(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jO,h ]rV,h"XFilter ConditionsrW,rX,}rY,(hj&h'jS,ubah(j ubah(j ubj )rZ,}r[,(hUh}r\,(h]h]h]h]h]uh'jK,h ]r],(j )r^,}r_,(hUh}r`,(h]h]h]h]h]uh'jZ,h ]ra,j )rb,}rc,(hUh}rd,(h]h]h]h]h]uh'j^,h ]re,j )rf,}rg,(hUh}rh,(U anchornameU #selectorsUrefurijh]h]h]h]h]Uinternaluh'jb,h ]ri,h"X Selectorsrj,rk,}rl,(hX Selectorsh'jf,ubah(j ubah(j ubah(j ubj )rm,}rn,(hUh}ro,(h]h]h]h]h]uh'jZ,h ]rp,(j )rq,}rr,(hUh}rs,(h]h]h]h]h]uh'jm,h ]rt,j )ru,}rv,(hUh}rw,(U anchornameU#property-based-filtersUrefurijh]h]h]h]h]Uinternaluh'jq,h ]rx,h"XProperty-Based Filtersry,rz,}r{,(hXProperty-Based Filtersh'ju,ubah(j ubah(j ubj )r|,}r},(hUh}r~,(h]h]h]h]h]uh'jm,h ]r,(j )r,}r,(hUh}r,(h]h]h]h]h]uh'j|,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU#compare-operationsUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"XCompare-Operationsr,r,}r,(hXCompare-Operationsh'j,ubah(j ubah(j ubah(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'j|,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU #value-partUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"X Value Partr,r,}r,(hX Value Parth'j,ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'jZ,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU#expression-based-filtersUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"XExpression-Based Filtersr,r,}r,(hXExpression-Based Filtersh'j,ubah(j ubah(j ubah(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'jZ,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU#bsd-style-blocksUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"XBSD-style Blocksr,r,}r,(hXBSD-style Blocksh'j,ubah(j ubah(j ubah(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'jZ,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU #examplesUrefurijh]h]h]h]h]Uinternaluh'j,h ]r,h"XExamplesr,r,}r,(hXExamplesh'j,ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj'j )r,}r,(hUh}r,(h]h]h]h]h]uh ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,(j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameUUrefurij'h]h]h]h]h]Uinternaluh'j,h ]r,h"X&omfwd: syslog Forwarding Output Moduler,r,}r,(hj/h'j,ubah(j ubah(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,(j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU#module-parametersUrefurij'h]h]h]h]h]Uinternaluh'j,h ]r,h"XModule Parametersr,r,}r,(hXModule Parametersh'j,ubah(j ubah(j ubah(j ubj )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(h]h]h]h]h]uh'j,h ]r,j )r,}r,(hUh}r,(U anchornameU#action-parametersUrefurij'h]h]h]h]h]Uinternaluh'j,h ]r,h"XAction Parametersr,r,}r,(hXAction Parametersh'j,ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j,h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r -(hUh}r -(U anchornameU #see-alsoUrefurij'h]h]h]h]h]Uinternaluh'j-h ]r -h"XSee Alsor -r -}r-(hXSee Alsoh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j,h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU#caveats-known-bugsUrefurij'h]h]h]h]h]Uinternaluh'j-h ]r-h"XCaveats/Known Bugsr-r-}r-(hXCaveats/Known Bugsh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r -(h]h]h]h]h]uh'j,h ]r!-j )r"-}r#-(hUh}r$-(h]h]h]h]h]uh'j-h ]r%-j )r&-}r'-(hUh}r(-(U anchornameU#sampleUrefurij'h]h]h]h]h]Uinternaluh'j"-h ]r)-h"XSampler*-r+-}r,-(hXSampleh'j&-ubah(j ubah(j ubah(j ubj )r--}r.-(hUh}r/-(h]h]h]h]h]uh'j,h ]r0-j )r1-}r2-(hUh}r3-(h]h]h]h]h]uh'j--h ]r4-j )r5-}r6-(hUh}r7-(U anchornameU #legacy-configuration-directivesUrefurij'h]h]h]h]h]Uinternaluh'j1-h ]r8-h"XLegacy Configuration Directivesr9-r:-}r;-(hXLegacy Configuration Directivesh'j5-ubah(j ubah(j ubah(j ubj )r<-}r=-(hUh}r>-(h]h]h]h]h]uh'j,h ]r?-j )r@-}rA-(hUh}rB-(h]h]h]h]h]uh'j<-h ]rC-j )rD-}rE-(hUh}rF-(U anchornameU#legacy-sampleUrefurij'h]h]h]h]h]Uinternaluh'j@-h ]rG-h"X Legacy SamplerH-rI-}rJ-(hX Legacy Sampleh'jD-ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj0j )rK-}rL-(hUh}rM-(h]h]h]h]h]uh ]rN-j )rO-}rP-(hUh}rQ-(h]h]h]h]h]uh'jK-h ]rR-(j )rS-}rT-(hUh}rU-(h]h]h]h]h]uh'jO-h ]rV-j )rW-}rX-(hUh}rY-(U anchornameUUrefurij0h]h]h]h]h]Uinternaluh'jS-h ]rZ-h"X"Compatibility Notes for rsyslog v7r[-r\-}r]-(hj8h'jW-ubah(j ubah(j ubj )r^-}r_-(hUh}r`-(h]h]h]h]h]uh'jO-h ]ra-(j )rb-}rc-(hUh}rd-(h]h]h]h]h]uh'j^-h ]re-j )rf-}rg-(hUh}rh-(h]h]h]h]h]uh'jb-h ]ri-j )rj-}rk-(hUh}rl-(U anchornameU#bsd-style-blocksUrefurij0h]h]h]h]h]Uinternaluh'jf-h ]rm-h"XBSD-Style blocksrn-ro-}rp-(hXBSD-Style blocksh'jj-ubah(j ubah(j ubah(j ubj )rq-}rr-(hUh}rs-(h]h]h]h]h]uh'j^-h ]rt-j )ru-}rv-(hUh}rw-(h]h]h]h]h]uh'jq-h ]rx-j )ry-}rz-(hUh}r{-(U anchornameU#cee-propertiesUrefurij0h]h]h]h]h]Uinternaluh'ju-h ]r|-h"XCEE-Propertiesr}-r~-}r-(hXCEE-Propertiesh'jy-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j^-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU0#omusrmsg-using-just-a-username-or-is-deprecatedUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"X4omusrmsg: using just a username or "*" is deprecatedr-r-}r-(hX4omusrmsg: using just a username or "*" is deprecatedh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j^-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU,#omruleset-and-discard-action-are-deprecatedUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"X/omruleset and discard (~) action are deprecatedr-r-}r-(hX/omruleset and discard (~) action are deprecatedh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j^-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU8#retries-of-output-plugins-that-do-not-do-proper-repliesUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"X7Retries of output plugins that do not do proper repliesr-r-}r-(hX7Retries of output plugins that do not do proper repliesh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j^-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU#omfile-file-creation-timeUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"Xomfile: file creation timer-r-}r-(hXomfile: file creation timeh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j^-h ]r-(j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU#notes-for-the-7-3-7-4-branchUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"XNotes for the 7.3/7.4 branchr-r-}r-(hXNotes for the 7.3/7.4 branchh'j-ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-(j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-(j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU)#last-message-repeated-n-times-processingUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"X*"last message repeated n times" Processingr-r-}r-(hX*"last message repeated n times" Processingh'j-ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-(j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU#user-noticable-changesUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"XUser-Noticable Changesr-r-}r-(hXUser-Noticable Changesh'j-ubah(j ubah(j ubah(j ubj )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(h]h]h]h]h]uh'j-h ]r-j )r-}r-(hUh}r-(U anchornameU#performance-implicationsUrefurij0h]h]h]h]h]Uinternaluh'j-h ]r-h"XPerformance Implicationsr-r-}r-(hXPerformance Implicationsh'j-ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r.}r.(hUh}r.(h]h]h]h]h]uh'j-h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r .(hUh}r .(U anchornameU$#stricter-string-template-processingUrefurij0h]h]h]h]h]Uinternaluh'j.h ]r .h"X#Stricter string-template Processingr .r .}r.(hX#Stricter string-template Processingh'j.ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubj9j )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.(j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurij9h]h]h]h]h]Uinternaluh'j.h ]r.h"XVariable (Property) typesr.r .}r!.(hjAh'j.ubah(j ubah(j ubj )r".}r#.(hUh}r$.(h]h]h]h]h]uh'j.h ]r%.(j )r&.}r'.(hUh}r(.(h]h]h]h]h]uh'j".h ]r).j )r*.}r+.(hUh}r,.(h]h]h]h]h]uh'j&.h ]r-.j )r..}r/.(hUh}r0.(U anchornameU#setUrefurij9h]h]h]h]h]Uinternaluh'j*.h ]r1.cdocutils.nodes strong r2.)r3.}r4.(hX**set**h'j..j Nh(Ustrongr5.h}r6.(h]h]h]h]h]uj Nh ]r7.h"Xsetr8.r9.}r:.(hUh'j3.ubaubah(j ubah(j ubah(j ubj )r;.}r<.(hUh}r=.(h]h]h]h]h]uh'j".h ]r>.j )r?.}r@.(hUh}rA.(h]h]h]h]h]uh'j;.h ]rB.j )rC.}rD.(hUh}rE.(U anchornameU#unsetUrefurij9h]h]h]h]h]Uinternaluh'j?.h ]rF.j2.)rG.}rH.(hX **unset**h'jC.j Nh(j5.h}rI.(h]h]h]h]h]uj Nh ]rJ.h"XunsetrK.rL.}rM.(hUh'jG.ubaubah(j ubah(j ubah(j ubj )rN.}rO.(hUh}rP.(h]h]h]h]h]uh'j".h ]rQ.j )rR.}rS.(hUh}rT.(h]h]h]h]h]uh'jN.h ]rU.j )rV.}rW.(hUh}rX.(U anchornameU#resetUrefurij9h]h]h]h]h]Uinternaluh'jR.h ]rY.j2.)rZ.}r[.(hX **reset**h'jV.j Nh(j5.h}r\.(h]h]h]h]h]uj Nh ]r].h"Xresetr^.r_.}r`.(hUh'jZ.ubaubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjBj )ra.}rb.(hUh}rc.(h]h]h]h]h]uh ]rd.j )re.}rf.(hUh}rg.(h]h]h]h]h]uh'ja.h ]rh.(j )ri.}rj.(hUh}rk.(h]h]h]h]h]uh'je.h ]rl.j )rm.}rn.(hUh}ro.(U anchornameUUrefurijBh]h]h]h]h]Uinternaluh'ji.h ]rp.h"XSetting up the Central Serverrq.rr.}rs.(hjJh'jm.ubah(j ubah(j ubj )rt.}ru.(hUh}rv.(h]h]h]h]h]uh'je.h ]rw.j )rx.}ry.(hUh}rz.(h]h]h]h]h]uh'jt.h ]r{.j )r|.}r}.(hUh}r~.(h]h]h]h]h]uh'jx.h ]r.j )r.}r.(hUh}r.(U anchornameU#sample-syslog-confUrefurijBh]h]h]h]h]Uinternaluh'j|.h ]r.h"XSample syslog.confr.r.}r.(hXSample syslog.confr.h'j.ubah(j ubah(j ubah(j ubah(j! ubeh(j ubah(j! ubjKj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurijKh]h]h]h]h]Uinternaluh'j.h ]r.h"X$UMASKr.r.}r.(hjSh'j.ubah(j ubah(j ubah(j ubah(j! ubjTj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurijTh]h]h]h]h]Uinternaluh'j.h ]r.h"Xptcp Network Stream Driverr.r.}r.(hj\h'j.ubah(j ubah(j ubah(j ubah(j! ubj]j )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurij]h]h]h]h]h]Uinternaluh'j.h ]r.h"X!Notes on IPv6 Handling in Rsyslogr.r.}r.(hjeh'j.ubah(j ubah(j ubah(j ubah(j! ubjfj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurijfh]h]h]h]h]Uinternaluh'j.h ]r.h"X*Sample Use Case: Single Central Log Serverr.r.}r.(hjnh'j.ubah(j ubah(j ubah(j ubah(j! ubjoj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurijoh]h]h]h]h]Uinternaluh'j.h ]r.h"X$AbortOnUncleanConfigr.r.}r.(hjwh'j.ubah(j ubah(j ubah(j ubah(j! ubjxj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(h]h]h]h]h]uh'j.h ]r.j )r.}r.(hUh}r.(U anchornameUUrefurijxh]h]h]h]h]Uinternaluh'j.h ]r.h"X$ResetConfigVariablesr.r.}r.(hjh'j.ubah(j ubah(j ubah(j ubah(j! ubjj )r.}r.(hUh}r.(h]h]h]h]h]uh ]r.j )r.}r.(hUh}r/(h]h]h]h]h]uh'j.h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j.h ]r/j )r/}r/(hUh}r/(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j/h ]r /h"X$FailOnChownFailurer /r /}r /(hjh'j/ubah(j ubah(j ubah(j ubah(j! ubjj )r /}r/(hUh}r/(h]h]h]h]h]uh ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j /h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"X)omprog: Program integration Output moduler/r/}r/(hjh'j/ubah(j ubah(j ubah(j ubah(j! ubjj )r /}r!/(hUh}r"/(h]h]h]h]h]uh ]r#/j )r$/}r%/(hUh}r&/(h]h]h]h]h]uh'j /h ]r'/(j )r(/}r)/(hUh}r*/(h]h]h]h]h]uh'j$/h ]r+/j )r,/}r-/(hUh}r./(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j(/h ]r//h"XTroubleshootingr0/r1/}r2/(hjh'j,/ubah(j ubah(j ubj )r3/}r4/(hUh}r5/(h]h]h]h]h]uh'j$/h ]r6/(j )r7/}r8/(hUh}r9/(h]h]h]h]h]uh'j3/h ]r:/(j )r;/}r/j )r?/}r@/(hUh}rA/(U anchornameU#typical-problemsUrefurijh]h]h]h]h]Uinternaluh'j;/h ]rB/h"XTypical ProblemsrC/rD/}rE/(hXTypical Problemsh'j?/ubah(j ubah(j ubj )rF/}rG/(hUh}rH/(h]h]h]h]h]uh'j7/h ]rI/j )rJ/}rK/(hUh'jF/j X</home/rger/proj/rsyslog-doc/source/troubleshooting/index.rstrL/h(j h}rM/(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rN/(NjrO/NjrP/eUhiddenUcaptionNU includefiles]rQ/(jjeU includehiddenuj Kh ]ubah(j! ubeh(j ubj )rR/}rS/(hUh}rT/(h]h]h]h]h]uh'j3/h ]rU/(j )rV/}rW/(hUh}rX/(h]h]h]h]h]uh'jR/h ]rY/j )rZ/}r[/(hUh}r\/(U anchornameU#general-procedureUrefurijh]h]h]h]h]Uinternaluh'jV/h ]r]/h"XGeneral Procedurer^/r_/}r`/(hXGeneral Procedureh'jZ/ubah(j ubah(j ubj )ra/}rb/(hUh}rc/(h]h]h]h]h]uh'jR/h ]rd/j )re/}rf/(hUh'ja/j jL/h(j h}rg/(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rh/(Njri/Njrj/eUhiddenUcaptionNU includefiles]rk/(jjeU includehiddenuj Kh ]ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )rl/}rm/(hUh}rn/(h]h]h]h]h]uh ]ro/j )rp/}rq/(hUh}rr/(h]h]h]h]h]uh'jl/h ]rs/(j )rt/}ru/(hUh}rv/(h]h]h]h]h]uh'jp/h ]rw/j )rx/}ry/(hUh}rz/(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jt/h ]r{/h"X%Developing rsyslog modules (outdated)r|/r}/}r~/(hjh'jx/ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'jp/h ]r/(j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU #overviewUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XOverviewr/r/}r/(hXOverviewh'j/ubah(j ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU#module-generationUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XModule "generation"r/r/}r/(hXModule "generation"h'j/ubah(j ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/(j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU#naming-conventionsUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XNaming Conventionsr/r/}r/(hXNaming Conventionsh'j/ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU#sourceUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XSourcer/r/}r/(hXSourceh'j/ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU#module-securityUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XModule Securityr/r/}r/(hXModule Securityh'j/ubah(j ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU#action-selectorsUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"XAction Selectorsr/r/}r/(hXAction Selectorsh'j/ubah(j ubah(j ubah(j ubj )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"X Copyrightr/r/}r/(hX Copyrighth'j/ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r/}r/(hUh}r/(h]h]h]h]h]uh ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(h]h]h]h]h]uh'j/h ]r/j )r/}r/(hUh}r/(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j/h ]r/h"X$FileCreateModer0r0}r0(hjh'j/ubah(j ubah(j ubah(j ubah(j! ubjj )r0}r0(hUh}r0(h]h]h]h]h]uh ]r0j )r0}r0(hUh}r 0(h]h]h]h]h]uh'j0h ]r 0(j )r 0}r 0(hUh}r 0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j 0h ]r0h"X Using php-syslog-ng with rsyslogr0r0}r0(hjh'j0ubah(j ubah(j ubj )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0(j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r 0(h]h]h]h]h]uh'j0h ]r!0j )r"0}r#0(hUh}r$0(U anchornameU #abstractUrefurijh]h]h]h]h]Uinternaluh'j0h ]r%0h"XAbstractr&0r'0}r(0(hXAbstracth'j"0ubah(j ubah(j ubah(j ubj )r)0}r*0(hUh}r+0(h]h]h]h]h]uh'j0h ]r,0j )r-0}r.0(hUh}r/0(h]h]h]h]h]uh'j)0h ]r00j )r10}r20(hUh}r30(U anchornameU#overall-system-setupUrefurijh]h]h]h]h]Uinternaluh'j-0h ]r40h"XOverall System Setupr50r60}r70(hXOverall System Setuph'j10ubah(j ubah(j ubah(j ubj )r80}r90(hUh}r:0(h]h]h]h]h]uh'j0h ]r;0j )r<0}r=0(hUh}r>0(h]h]h]h]h]uh'j80h ]r?0j )r@0}rA0(hUh}rB0(U anchornameU#setting-up-the-systemUrefurijh]h]h]h]h]Uinternaluh'j<0h ]rC0h"XSetting up the systemrD0rE0}rF0(hXSetting up the systemh'j@0ubah(j ubah(j ubah(j ubj )rG0}rH0(hUh}rI0(h]h]h]h]h]uh'j0h ]rJ0j )rK0}rL0(hUh}rM0(h]h]h]h]h]uh'jG0h ]rN0j )rO0}rP0(hUh}rQ0(U anchornameU #conclusionUrefurijh]h]h]h]h]Uinternaluh'jK0h ]rR0h"X ConclusionrS0rT0}rU0(hX Conclusionh'jO0ubah(j ubah(j ubah(j ubj )rV0}rW0(hUh}rX0(h]h]h]h]h]uh'j0h ]rY0j )rZ0}r[0(hUh}r\0(h]h]h]h]h]uh'jV0h ]r]0j )r^0}r_0(hUh}r`0(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'jZ0h ]ra0h"XFeedback Requestedrb0rc0}rd0(hXFeedback Requestedh'j^0ubah(j ubah(j ubah(j ubj )re0}rf0(hUh}rg0(h]h]h]h]h]uh'j0h ]rh0j )ri0}rj0(hUh}rk0(h]h]h]h]h]uh'je0h ]rl0j )rm0}rn0(hUh}ro0(U anchornameU##references-and-additional-materialUrefurijh]h]h]h]h]Uinternaluh'ji0h ]rp0h"X"References and Additional Materialrq0rr0}rs0(hX"References and Additional Materialh'jm0ubah(j ubah(j ubah(j ubj )rt0}ru0(hUh}rv0(h]h]h]h]h]uh'j0h ]rw0j )rx0}ry0(hUh}rz0(h]h]h]h]h]uh'jt0h ]r{0j )r|0}r}0(hUh}r~0(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'jx0h ]r0h"XRevision Historyr0r0}r0(hXRevision Historyh'j|0ubah(j ubah(j ubah(j ubj )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"X Copyrightr0r0}r0(hX Copyrighth'j0ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r0}r0(hUh}r0(h]h]h]h]h]uh ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"X$omuxsock: Unix sockets Output Moduler0r0}r0(hjh'j0ubah(j ubah(j ubah(j ubah(j! ubjj )r0}r0(hUh}r0(h]h]h]h]h]uh ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"X $MaxOpenFilesr0r0}r0(hjh'j0ubah(j ubah(j ubah(j ubah(j! ubjj )r0}r0(hUh}r0(h]h]h]h]h]uh ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"XString Generator Modulesr0r0}r0(hjh'j0ubah(j ubah(j ubah(j ubah(j! ubjj )r0}r0(hUh}r0(h]h]h]h]h]uh ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0(j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"X$MaxMind/GeoIP DB lookup (mmdblookup)r0r0}r0(hjh'j0ubah(j ubah(j ubj )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0(j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameU#input-parametersUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"XInput parametersr0r0}r0(hXInput parametersh'j0ubah(j ubah(j ubah(j ubj )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(h]h]h]h]h]uh'j0h ]r0j )r0}r0(hUh}r0(U anchornameU #examplesUrefurijh]h]h]h]h]Uinternaluh'j0h ]r0h"XExamplesr0r0}r0(hXExamplesh'j0ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j0h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r 1(hUh}r 1(U anchornameU #buildingUrefurijh]h]h]h]h]Uinternaluh'j1h ]r 1h"XBuildingr 1r 1}r1(hXBuildingh'j1ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r1}r1(hUh}r1(h]h]h]h]h]uh ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1(j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"Xomkafka: write to Apache Kafkar1r 1}r!1(hjh'j1ubah(j ubah(j ubj )r"1}r#1(hUh}r$1(h]h]h]h]h]uh'j1h ]r%1(j )r&1}r'1(hUh}r(1(h]h]h]h]h]uh'j"1h ]r)1(j )r*1}r+1(hUh}r,1(h]h]h]h]h]uh'j&1h ]r-1j )r.1}r/1(hUh}r01(U anchornameU#configuration-parametersUrefurijh]h]h]h]h]Uinternaluh'j*1h ]r11h"XConfiguration Parametersr21r31}r41(hXConfiguration Parametersh'j.1ubah(j ubah(j ubj )r51}r61(hUh}r71(h]h]h]h]h]uh'j&1h ]r81(j )r91}r:1(hUh}r;1(h]h]h]h]h]uh'j51h ]r<1j )r=1}r>1(hUh}r?1(h]h]h]h]h]uh'j91h ]r@1j )rA1}rB1(hUh}rC1(U anchornameU#module-parametersUrefurijh]h]h]h]h]Uinternaluh'j=1h ]rD1h"XModule ParametersrE1rF1}rG1(hXModule Parametersh'jA1ubah(j ubah(j ubah(j ubj )rH1}rI1(hUh}rJ1(h]h]h]h]h]uh'j51h ]rK1j )rL1}rM1(hUh}rN1(h]h]h]h]h]uh'jH1h ]rO1j )rP1}rQ1(hUh}rR1(U anchornameU#action-parametersUrefurijh]h]h]h]h]Uinternaluh'jL1h ]rS1h"XAction ParametersrT1rU1}rV1(hXAction Parametersh'jP1ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )rW1}rX1(hUh}rY1(h]h]h]h]h]uh'j"1h ]rZ1j )r[1}r\1(hUh}r]1(h]h]h]h]h]uh'jW1h ]r^1j )r_1}r`1(hUh}ra1(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'j[1h ]rb1h"XCaveats/Known Bugsrc1rd1}re1(hXCaveats/Known Bugsh'j_1ubah(j ubah(j ubah(j ubj )rf1}rg1(hUh}rh1(h]h]h]h]h]uh'j"1h ]ri1j )rj1}rk1(hUh}rl1(h]h]h]h]h]uh'jf1h ]rm1j )rn1}ro1(hUh}rp1(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'jj1h ]rq1h"XExamplerr1rs1}rt1(hXExampleh'jn1ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )ru1}rv1(hUh}rw1(h]h]h]h]h]uh ]rx1j )ry1}rz1(hUh}r{1(h]h]h]h]h]uh'ju1h ]r|1(j )r}1}r~1(hUh}r1(h]h]h]h]h]uh'jy1h ]r1j )r1}r1(hUh}r1(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j}1h ]r1h"XInstalling rsyslog from Sourcer1r1}r1(hjh'j1ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'jy1h ]r1(j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#how-to-make-your-life-easierUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XHow to make your life easier...r1r1}r1(hXHow to make your life easier...h'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1(j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU #steps-to-doUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"X Steps To Dor1r1}r1(hX Steps To Doh'j1ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1(j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#step-1-download-softwareUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XStep 1 - Download Softwarer1r1}r1(hXStep 1 - Download Softwareh'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#build-requirementsUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XBuild Requirementsr1r1}r1(hXBuild Requirementsh'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#step-2-run-configureUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XStep 2 - Run ./configurer1r1}r1(hXStep 2 - Run ./configureh'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#step-3-compileUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XStep 3 - Compiler1r1}r1(hXStep 3 - Compileh'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(U anchornameU#step-4-installUrefurijh]h]h]h]h]Uinternaluh'j1h ]r1h"XStep 4 - Installr1r1}r1(hXStep 4 - Installh'j1ubah(j ubah(j ubah(j ubj )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r1j )r1}r1(hUh}r1(h]h]h]h]h]uh'j1h ]r2j )r2}r2(hUh}r2(U anchornameU#step-5-configure-rsyslogdUrefurijh]h]h]h]h]Uinternaluh'j1h ]r2h"XStep 5 - Configure rsyslogdr2r2}r2(hXStep 5 - Configure rsyslogdh'j2ubah(j ubah(j ubah(j ubj )r2}r 2(hUh}r 2(h]h]h]h]h]uh'j1h ]r 2j )r 2}r 2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameU#step-6-disable-stock-syslogdUrefurijh]h]h]h]h]Uinternaluh'j 2h ]r2h"XStep 6 - Disable stock syslogdr2r2}r2(hXStep 6 - Disable stock syslogdh'j2ubah(j ubah(j ubah(j ubj )r2}r2(hUh}r2(h]h]h]h]h]uh'j1h ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r 2(hUh}r!2(U anchornameU!#step-7-enable-rsyslogd-autostartUrefurijh]h]h]h]h]Uinternaluh'j2h ]r"2h"X"Step 7 - Enable rsyslogd Autostartr#2r$2}r%2(hX"Step 7 - Enable rsyslogd Autostarth'j2ubah(j ubah(j ubah(j ubj )r&2}r'2(hUh}r(2(h]h]h]h]h]uh'j1h ]r)2j )r*2}r+2(hUh}r,2(h]h]h]h]h]uh'j&2h ]r-2j )r.2}r/2(hUh}r02(U anchornameU #step-8-check-daily-cron-scriptsUrefurijh]h]h]h]h]Uinternaluh'j*2h ]r12h"X!Step 8 - Check daily cron scriptsr22r32}r42(hX!Step 8 - Check daily cron scriptsh'j.2ubah(j ubah(j ubah(j ubj )r52}r62(hUh}r72(h]h]h]h]h]uh'j1h ]r82j )r92}r:2(hUh}r;2(h]h]h]h]h]uh'j52h ]r<2j )r=2}r>2(hUh}r?2(U anchornameU#doneUrefurijh]h]h]h]h]Uinternaluh'j92h ]r@2h"XDonerA2rB2}rC2(hXDoneh'j=2ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )rD2}rE2(hUh}rF2(h]h]h]h]h]uh'j1h ]rG2(j )rH2}rI2(hUh}rJ2(h]h]h]h]h]uh'jD2h ]rK2j )rL2}rM2(hUh}rN2(U anchornameU#housekeeping-stuffUrefurijh]h]h]h]h]Uinternaluh'jH2h ]rO2h"XHousekeeping stuffrP2rQ2}rR2(hXHousekeeping stuffh'jL2ubah(j ubah(j ubj )rS2}rT2(hUh}rU2(h]h]h]h]h]uh'jD2h ]rV2(j )rW2}rX2(hUh}rY2(h]h]h]h]h]uh'jS2h ]rZ2j )r[2}r\2(hUh}r]2(h]h]h]h]h]uh'jW2h ]r^2j )r_2}r`2(hUh}ra2(U anchornameU#feedback-requestedUrefurijh]h]h]h]h]Uinternaluh'j[2h ]rb2h"XFeedback requestedrc2rd2}re2(hXFeedback requestedh'j_2ubah(j ubah(j ubah(j ubj )rf2}rg2(hUh}rh2(h]h]h]h]h]uh'jS2h ]ri2j )rj2}rk2(hUh}rl2(h]h]h]h]h]uh'jf2h ]rm2j )rn2}ro2(hUh}rp2(U anchornameU#revision-historyUrefurijh]h]h]h]h]Uinternaluh'jj2h ]rq2h"XRevision Historyrr2rs2}rt2(hXRevision Historyh'jn2ubah(j ubah(j ubah(j ubj )ru2}rv2(hUh}rw2(h]h]h]h]h]uh'jS2h ]rx2j )ry2}rz2(hUh}r{2(h]h]h]h]h]uh'ju2h ]r|2j )r}2}r~2(hUh}r2(U anchornameU #copyrightUrefurijh]h]h]h]h]Uinternaluh'jy2h ]r2h"X Copyrightr2r2}r2(hX Copyrighth'j}2ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r2}r2(hUh}r2(h]h]h]h]h]uh ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2(j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j2h ]r2h"X Input Modulesr2r2}r2(hjh'j2ubah(j ubah(j ubj )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh'j2j XF/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_input.rsth(j h}r2(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r2(Nj(r2Nh`r2Njr2Nj5r2Njr2Njr2Njr2Njr2Njr2Nj=r2Nhކr2Njr2NjYr2eUhiddenUcaptionNU includefiles]r2(j(h`jj5jjjjjj=hjjYeU includehiddenuj Kh ]ubah(j! ubeh(j ubah(j! ubjj )r2}r2(hUh}r2(h]h]h]h]h]uh ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j2h ]r2h"X"imkmsg: /dev/kmsg Log Input Moduler2r2}r2(hjh'j2ubah(j ubah(j ubah(j ubah(j! ubjj )r2}r2(hUh}r2(h]h]h]h]h]uh ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j2h ]r2h"X/omstdout: stdout output module (testbench tool)r2r2}r2(hjh'j2ubah(j ubah(j ubah(j ubah(j! ubjj )r2}r2(hUh}r2(h]h]h]h]h]uh ]r2j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2(j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j2h ]r2h"X Dynamic Statsr2r2}r2(hjh'j2ubah(j ubah(j ubj )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2(j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2(j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2j )r2}r2(hUh}r2(U anchornameU#dyn-stats-configurationUrefurijh]h]h]h]h]Uinternaluh'j2h ]r2h"XDyn-stats configurationr2r2}r2(hXDyn-stats configurationh'j2ubah(j ubah(j ubj )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r2(j )r2}r2(hUh}r2(h]h]h]h]h]uh'j2h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j2h ]r3j )r3}r3(hUh}r3(U anchornameU#dyn-stats-name-bucket-objectUrefurijh]h]h]h]h]Uinternaluh'j3h ]r3h"X&dyn_stats(name=""...) (object)r 3r 3}r 3(hX&dyn_stats(name=""...) (object)h'j3ubah(j ubah(j ubah(j ubj )r 3}r 3(hUh}r3(h]h]h]h]h]uh'j2h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j 3h ]r3j )r3}r3(hUh}r3(U anchornameU#dyn-inc-bucket-expr-functionUrefurijh]h]h]h]h]Uinternaluh'j3h ]r3h"X&dyn_inc("", ) (function)r3r3}r3(hX&dyn_inc("", ) (function)h'j3ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r3}r3(hUh}r3(h]h]h]h]h]uh'j2h ]r3(j )r3}r 3(hUh}r!3(h]h]h]h]h]uh'j3h ]r"3j )r#3}r$3(hUh}r%3(U anchornameU #reportingUrefurijh]h]h]h]h]Uinternaluh'j3h ]r&3h"X Reportingr'3r(3}r)3(hX Reportingh'j#3ubah(j ubah(j ubj )r*3}r+3(hUh}r,3(h]h]h]h]h]uh'j3h ]r-3j )r.3}r/3(hUh}r03(h]h]h]h]h]uh'j*3h ]r13j )r23}r33(hUh}r43(h]h]h]h]h]uh'j.3h ]r53j )r63}r73(hUh}r83(U anchornameU#fieldsUrefurijh]h]h]h]h]Uinternaluh'j23h ]r93h"XFieldsr:3r;3}r<3(hXFieldsh'j63ubah(j ubah(j ubah(j ubah(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )r=3}r>3(hUh}r?3(h]h]h]h]h]uh ]r@3j )rA3}rB3(hUh}rC3(h]h]h]h]h]uh'j=3h ]rD3j )rE3}rF3(hUh}rG3(h]h]h]h]h]uh'jA3h ]rH3j )rI3}rJ3(hUh}rK3(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jE3h ]rL3h"X8Support module for external message modification modulesrM3rN3}rO3(hjh'jI3ubah(j ubah(j ubah(j ubah(j! ubjj )rP3}rQ3(hUh}rR3(h]h]h]h]h]uh ]rS3j )rT3}rU3(hUh}rV3(h]h]h]h]h]uh'jP3h ]rW3(j )rX3}rY3(hUh}rZ3(h]h]h]h]h]uh'jT3h ]r[3j )r\3}r]3(hUh}r^3(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jX3h ]r_3h"X-mmrm1stspace: First Space Modification Moduler`3ra3}rb3(hj"h'j\3ubah(j ubah(j ubj )rc3}rd3(hUh}re3(h]h]h]h]h]uh'jT3h ]rf3(j )rg3}rh3(hUh}ri3(h]h]h]h]h]uh'jc3h ]rj3j )rk3}rl3(hUh}rm3(h]h]h]h]h]uh'jg3h ]rn3j )ro3}rp3(hUh}rq3(U anchornameU#configuration-parametersUrefurijh]h]h]h]h]Uinternaluh'jk3h ]rr3h"XConfiguration Parametersrs3rt3}ru3(hXConfiguration Parametersh'jo3ubah(j ubah(j ubah(j ubj )rv3}rw3(hUh}rx3(h]h]h]h]h]uh'jc3h ]ry3j )rz3}r{3(hUh}r|3(h]h]h]h]h]uh'jv3h ]r}3j )r~3}r3(hUh}r3(U anchornameU #examplesUrefurijh]h]h]h]h]Uinternaluh'jz3h ]r3h"XExamplesr3r3}r3(hXExamplesh'j~3ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj#j )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurij#h]h]h]h]h]Uinternaluh'j3h ]r3h"XFree Services for Rsyslogr3r3}r3(hj+h'j3ubah(j ubah(j ubah(j ubah(j! ubj,j )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurij,h]h]h]h]h]Uinternaluh'j3h ]r3h"X Turning Lanes and Rsyslog Queuesr3r3}r3(hj4h'j3ubah(j ubah(j ubah(j ubah(j! ubj5j )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurij5h]h]h]h]h]Uinternaluh'j3h ]r3h"X'imjournal: Systemd Journal Input Moduler3r3}r3(hj=h'j3ubah(j ubah(j ubah(j ubah(j! ubj>j )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurij>h]h]h]h]h]Uinternaluh'j3h ]r3h"X $DirGroupr3r3}r3(hjFh'j3ubah(j ubah(j ubah(j ubah(j! ubjGj )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurijGh]h]h]h]h]Uinternaluh'j3h ]r3h"X'mmsnmptrapd message modification moduler3r3}r3(hjOh'j3ubah(j ubah(j ubah(j ubah(j! ubjPj )r3}r3(hUh}r3(h]h]h]h]h]uh ]r3j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3(j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r3(hUh}r3(U anchornameUUrefurijPh]h]h]h]h]Uinternaluh'j3h ]r3h"X pmciscoiosr3r3}r3(hjXh'j3ubah(j ubah(j ubj )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3(j )r3}r3(hUh}r3(h]h]h]h]h]uh'j3h ]r3j )r3}r4(hUh}r4(h]h]h]h]h]uh'j3h ]r4j )r4}r4(hUh}r4(U anchornameU#parser-parametersUrefurijPh]h]h]h]h]Uinternaluh'j3h ]r4h"XParser Parametersr4r4}r 4(hXParser Parametersh'j4ubah(j ubah(j ubah(j ubj )r 4}r 4(hUh}r 4(h]h]h]h]h]uh'j3h ]r 4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j 4h ]r4j )r4}r4(hUh}r4(U anchornameU#exampleUrefurijPh]h]h]h]h]Uinternaluh'j4h ]r4h"XExampler4r4}r4(hXExampleh'j4ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjYj )r4}r4(hUh}r4(h]h]h]h]h]uh ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r 4(j )r!4}r"4(hUh}r#4(h]h]h]h]h]uh'j4h ]r$4j )r%4}r&4(hUh}r'4(U anchornameUUrefurijYh]h]h]h]h]Uinternaluh'j!4h ]r(4h"Ximuxsock: Unix Socket Inputr)4r*4}r+4(hjah'j%4ubah(j ubah(j ubj )r,4}r-4(hUh}r.4(h]h]h]h]h]uh'j4h ]r/4(j )r04}r14(hUh}r24(h]h]h]h]h]uh'j,4h ]r34(j )r44}r54(hUh}r64(h]h]h]h]h]uh'j04h ]r74j )r84}r94(hUh}r:4(U anchornameU#configuration-parametersUrefurijYh]h]h]h]h]Uinternaluh'j44h ]r;4h"XConfiguration Parametersr<4r=4}r>4(hXConfiguration Parametersh'j84ubah(j ubah(j ubj )r?4}r@4(hUh}rA4(h]h]h]h]h]uh'j04h ]rB4(j )rC4}rD4(hUh}rE4(h]h]h]h]h]uh'j?4h ]rF4j )rG4}rH4(hUh}rI4(h]h]h]h]h]uh'jC4h ]rJ4j )rK4}rL4(hUh}rM4(U anchornameU#global-parametersUrefurijYh]h]h]h]h]Uinternaluh'jG4h ]rN4h"XGlobal ParametersrO4rP4}rQ4(hXGlobal Parametersh'jK4ubah(j ubah(j ubah(j ubj )rR4}rS4(hUh}rT4(h]h]h]h]h]uh'j?4h ]rU4j )rV4}rW4(hUh}rX4(h]h]h]h]h]uh'jR4h ]rY4j )rZ4}r[4(hUh}r\4(U anchornameU#input-parametersUrefurijYh]h]h]h]h]Uinternaluh'jV4h ]r]4h"XInput Parametersr^4r_4}r`4(hXInput Parametersh'jZ4ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )ra4}rb4(hUh}rc4(h]h]h]h]h]uh'j,4h ]rd4j )re4}rf4(hUh}rg4(h]h]h]h]h]uh'ja4h ]rh4j )ri4}rj4(hUh}rk4(U anchornameU #see-alsoUrefurijYh]h]h]h]h]Uinternaluh'je4h ]rl4h"XSee Alsorm4rn4}ro4(hXSee Alsoh'ji4ubah(j ubah(j ubah(j ubj )rp4}rq4(hUh}rr4(h]h]h]h]h]uh'j,4h ]rs4j )rt4}ru4(hUh}rv4(h]h]h]h]h]uh'jp4h ]rw4j )rx4}ry4(hUh}rz4(U anchornameU#caveats-known-bugsUrefurijYh]h]h]h]h]Uinternaluh'jt4h ]r{4h"XCaveats/Known Bugsr|4r}4}r~4(hXCaveats/Known Bugsh'jx4ubah(j ubah(j ubah(j ubj )r4}r4(hUh}r4(h]h]h]h]h]uh'j,4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameU#samplesUrefurijYh]h]h]h]h]Uinternaluh'j4h ]r4h"XSamplesr4r4}r4(hXSamplesh'j4ubah(j ubah(j ubah(j ubj )r4}r4(hUh}r4(h]h]h]h]h]uh'j,4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameU #legacy-configuration-directivesUrefurijYh]h]h]h]h]Uinternaluh'j4h ]r4h"XLegacy Configuration Directivesr4r4}r4(hXLegacy Configuration Directivesh'j4ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjbj )r4}r4(hUh}r4(h]h]h]h]h]uh ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameUUrefurijbh]h]h]h]h]Uinternaluh'j4h ]r4h"X(omlibdbi: Generic Database Output Moduler4r4}r4(hjjh'j4ubah(j ubah(j ubah(j ubah(j! ubjkj )r4}r4(hUh}r4(h]h]h]h]h]uh ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameUUrefurijkh]h]h]h]h]Uinternaluh'j4h ]r4h"X%GuardTime Log Signature Provider (gt)r4r4}r4(hjsh'j4ubah(j ubah(j ubah(j ubah(j! ubjtj )r4}r4(hUh}r4(h]h]h]h]h]uh ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4(j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameUUrefurijth]h]h]h]h]Uinternaluh'j4h ]r4h"X)omamqp1: AMQP 1.0 Messaging Output Moduler4r4}r4(hj|h'j4ubah(j ubah(j ubj )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4(j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameU*#notes-on-use-with-the-qpid-c-broker-qpiddUrefurijth]h]h]h]h]Uinternaluh'j4h ]r4j2.)r4}r4(hX1**Notes on use with the QPID C++ broker (qpidd)**h'j4j Nh(j5.h}r4(h]h]h]h]h]uj Nh ]r4h"X-Notes on use with the QPID C++ broker (qpidd)r4r4}r4(hUh'j4ubaubah(j ubah(j ubah(j ubj )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(h]h]h]h]h]uh'j4h ]r4j )r4}r4(hUh}r4(U anchornameU5#notes-on-use-with-the-qpid-dispatch-router-qdrouterdUrefurijth]h]h]h]h]Uinternaluh'j4h ]r4j2.)r4}r4(hX:**Notes on use with the QPID Dispatch Router (qdrouterd)**h'j4j Nh(j5.h}r4(h]h]h]h]h]uj Nh ]r4h"X6Notes on use with the QPID Dispatch Router (qdrouterd)r4r4}r4(hUh'j4ubaubah(j ubah(j ubah(j ubj )r5}r5(hUh}r5(h]h]h]h]h]uh'j4h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r 5(hUh}r 5(U anchornameU*#using-qdrouterd-in-combination-with-qpiddUrefurijth]h]h]h]h]Uinternaluh'j5h ]r 5j2.)r 5}r 5(hX-**Using qdrouterd in combination with qpidd**h'j5j Nh(j5.h}r5(h]h]h]h]h]uj Nh ]r5h"X)Using qdrouterd in combination with qpiddr5r5}r5(hUh'j 5ubaubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj}j )r5}r5(hUh}r5(h]h]h]h]h]uh ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5(j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r 5(hUh}r!5(U anchornameUUrefurij}h]h]h]h]h]Uinternaluh'j5h ]r"5h"X;Receiving massive amounts of messages with high performancer#5r$5}r%5(hjh'j5ubah(j ubah(j ubj )r&5}r'5(hUh}r(5(h]h]h]h]h]uh'j5h ]r)5(j )r*5}r+5(hUh}r,5(h]h]h]h]h]uh'j&5h ]r-5j )r.5}r/5(hUh}r05(h]h]h]h]h]uh'j*5h ]r15j )r25}r35(hUh}r45(U anchornameU #use-caseUrefurij}h]h]h]h]h]Uinternaluh'j.5h ]r55h"XUse Caser65r75}r85(hXUse Caseh'j25ubah(j ubah(j ubah(j ubj )r95}r:5(hUh}r;5(h]h]h]h]h]uh'j&5h ]r<5j )r=5}r>5(hUh}r?5(h]h]h]h]h]uh'j95h ]r@5j )rA5}rB5(hUh}rC5(U anchornameU#sample-configurationUrefurij}h]h]h]h]h]Uinternaluh'j=5h ]rD5h"XSample ConfigurationrE5rF5}rG5(hXSample Configurationh'jA5ubah(j ubah(j ubah(j ubj )rH5}rI5(hUh}rJ5(h]h]h]h]h]uh'j&5h ]rK5j )rL5}rM5(hUh}rN5(h]h]h]h]h]uh'jH5h ]rO5j )rP5}rQ5(hUh}rR5(U anchornameU#notes-on-the-suggested-configUrefurij}h]h]h]h]h]Uinternaluh'jL5h ]rS5h"XNotes on the suggested configrT5rU5}rV5(hXNotes on the suggested configh'jP5ubah(j ubah(j ubah(j ubj )rW5}rX5(hUh}rY5(h]h]h]h]h]uh'j&5h ]rZ5j )r[5}r\5(hUh}r]5(h]h]h]h]h]uh'jW5h ]r^5j )r_5}r`5(hUh}ra5(U anchornameU##suggested-user-performance-testingUrefurij}h]h]h]h]h]Uinternaluh'j[5h ]rb5h"X"Suggested User Performance Testingrc5rd5}re5(hX"Suggested User Performance Testingh'j_5ubah(j ubah(j ubah(j ubj )rf5}rg5(hUh}rh5(h]h]h]h]h]uh'j&5h ]ri5j )rj5}rk5(hUh}rl5(h]h]h]h]h]uh'jf5h ]rm5j )rn5}ro5(hUh}rp5(U anchornameU #see-alsoUrefurij}h]h]h]h]h]Uinternaluh'jj5h ]rq5h"XSee Alsorr5rs5}rt5(hXSee Alsoh'jn5ubah(j ubah(j ubah(j ubj )ru5}rv5(hUh}rw5(h]h]h]h]h]uh'j&5h ]rx5j )ry5}rz5(hUh}r{5(h]h]h]h]h]uh'ju5h ]r|5j )r}5}r~5(hUh}r5(U anchornameU #copyrightUrefurij}h]h]h]h]h]Uinternaluh'jy5h ]r5h"X Copyrightr5r5}r5(hX Copyrighth'j}5ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r5}r5(hUh}r5(h]h]h]h]h]uh ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"X'omhdfs: Hadoop Filesystem Output Moduler5r5}r5(hjh'j5ubah(j ubah(j ubah(j ubah(j! ubjj )r5}r5(hUh}r5(h]h]h]h]h]uh ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"X$DebugPrintTemplateListr5r5}r5(hjh'j5ubah(j ubah(j ubah(j ubah(j! ubjj )r5}r5(hUh}r5(h]h]h]h]h]uh ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"X'Fix invalid UTF-8 Sequences (mmutf8fix)r5r5}r5(hjh'j5ubah(j ubah(j ubah(j ubah(j! ubjj )r5}r5(hUh}r5(h]h]h]h]h]uh ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5(j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"Ximrelp: RELP Input Moduler5r5}r5(hjh'j5ubah(j ubah(j ubj )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5(j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameU#module-parametersUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"XModule Parametersr5r5}r5(hXModule Parametersh'j5ubah(j ubah(j ubah(j ubj )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5(j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(U anchornameU#input-parametersUrefurijh]h]h]h]h]Uinternaluh'j5h ]r5h"XInput Parametersr5r5}r5(hXInput Parametersh'j5ubah(j ubah(j ubj )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5(j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r5(h]h]h]h]h]uh'j5h ]r5j )r5}r5(hUh}r6(U anchornameU#caveats-known-bugsUrefurijh]h]h]h]h]Uinternaluh'j5h ]r6h"XCaveats/Known Bugsr6r6}r6(hXCaveats/Known Bugsh'j5ubah(j ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'j5h ]r6j )r 6}r 6(hUh}r 6(h]h]h]h]h]uh'j6h ]r 6j )r 6}r6(hUh}r6(U anchornameU#sampleUrefurijh]h]h]h]h]Uinternaluh'j 6h ]r6h"XSampler6r6}r6(hXSampleh'j 6ubah(j ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'j5h ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameU #legacy-configuration-directivesUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"XLegacy Configuration Directivesr 6r!6}r"6(hXLegacy Configuration Directivesh'j6ubah(j ubah(j ubah(j ubj )r#6}r$6(hUh}r%6(h]h]h]h]h]uh'j5h ]r&6j )r'6}r(6(hUh}r)6(h]h]h]h]h]uh'j#6h ]r*6j )r+6}r,6(hUh}r-6(U anchornameU#id1Urefurijh]h]h]h]h]Uinternaluh'j'6h ]r.6h"XCaveats/Known Bugsr/6r06}r16(hXCaveats/Known Bugsh'j+6ubah(j ubah(j ubah(j ubj )r26}r36(hUh}r46(h]h]h]h]h]uh'j5h ]r56j )r66}r76(hUh}r86(h]h]h]h]h]uh'j26h ]r96j )r:6}r;6(hUh}r<6(U anchornameU#legacy-sampleUrefurijh]h]h]h]h]Uinternaluh'j66h ]r=6h"X Legacy Sampler>6r?6}r@6(hX Legacy Sampleh'j:6ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubah(j! ubjj )rA6}rB6(hUh}rC6(h]h]h]h]h]uh ]rD6j )rE6}rF6(hUh}rG6(h]h]h]h]h]uh'jA6h ]rH6(j )rI6}rJ6(hUh}rK6(h]h]h]h]h]uh'jE6h ]rL6j )rM6}rN6(hUh}rO6(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jI6h ]rP6h"XWelcome to RsyslogrQ6rR6}rS6(hjh'jM6ubah(j ubah(j ubj )rT6}rU6(hUh}rV6(h]h]h]h]h]uh'jE6h ]rW6(j )rX6}rY6(hUh}rZ6(h]h]h]h]h]uh'jT6h ]r[6(j )r\6}r]6(hUh}r^6(h]h]h]h]h]uh'jX6h ]r_6j )r`6}ra6(hUh}rb6(U anchornameU#manualUrefurijh]h]h]h]h]Uinternaluh'j\6h ]rc6h"XManualrd6re6}rf6(hXManualh'j`6ubah(j ubah(j ubj )rg6}rh6(hUh}ri6(h]h]h]h]h]uh'jX6h ]rj6j )rk6}rl6(hUh'jg6j X,/home/rger/proj/rsyslog-doc/source/index.rstrm6h(j h}rn6(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]ro6(Nj|rp6Nj}rq6Nj~rr6Njrs6Njrt6Njru6Njrv6Njrw6eUhiddenUcaptionNU includefiles]rx6(j|j}j~jjjjjeU includehiddenuj Kh ]ubah(j! ubeh(j ubj )ry6}rz6(hUh}r{6(h]h]h]h]h]uh'jT6h ]r|6(j )r}6}r~6(hUh}r6(h]h]h]h]h]uh'jy6h ]r6j )r6}r6(hUh}r6(U anchornameU #referenceUrefurijh]h]h]h]h]Uinternaluh'j}6h ]r6h"X Referencer6r6}r6(hX Referenceh'j6ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'jy6h ]r6j )r6}r6(hUh'j6j jm6h(j h}r6(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r6(Njr6Njr6Njr6Njr6Njr6Njr6Njr6Njr6Njr6eUhiddenUcaptionNU includefiles]r6(jjjjjjjjjeU includehiddenuj K&h ]ubah(j! ubeh(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'jT6h ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameU#sponsors-and-communityUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"XSponsors and Communityr6r6}r6(hXSponsors and Communityh'j6ubah(j ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'jT6h ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameU#related-linksUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"X Related Linksr6r6}r6(hX Related Linksh'j6ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r6}r6(hUh}r6(h]h]h]h]h]uh ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6(j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"X!pmnull: Syslog Null Parser Moduler6r6}r6(hjh'j6ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6(j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameU#parser-parametersUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"XParser Parametersr6r6}r6(hXParser Parametersh'j6ubah(j ubah(j ubah(j ubj )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"XExampler6r6}r6(hXExampleh'j6ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r6}r6(hUh}r6(h]h]h]h]h]uh ]r6j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6(j )r6}r6(hUh}r6(h]h]h]h]h]uh'j6h ]r6j )r6}r6(hUh}r6(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j6h ]r6h"XRsyslog Whitepapersr6r6}r6(hjh'j6ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j6h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7(j )r7}r 7(hUh}r 7(h]h]h]h]h]uh'j7h ]r 7j )r 7}r 7(hUh}r7(U anchornameU #white-papersUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"X White Papersr7r7}r7(hX White Papersh'j 7ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh'j7j X8/home/rger/proj/rsyslog-doc/source/whitepapers/index.rsth(j h}r7(UnumberedKUparentjU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]r7(Njr7Njr7Njr7Njr7Njr7eUhiddenUcaptionNU includefiles]r 7(jjjjjeU includehiddenuj K h ]ubah(j! ubeh(j ubah(j! ubeh(j ubah(j! ubjj )r!7}r"7(hUh}r#7(h]h]h]h]h]uh ]r$7j )r%7}r&7(hUh}r'7(h]h]h]h]h]uh'j!7h ]r(7j )r)7}r*7(hUh}r+7(h]h]h]h]h]uh'j%7h ]r,7j )r-7}r.7(hUh}r/7(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j)7h ]r07h"X$libgcrypt Log Crypto Provider (gcry)r17r27}r37(hjh'j-7ubah(j ubah(j ubah(j ubah(j! ubjj )r47}r57(hUh}r67(h]h]h]h]h]uh ]r77j )r87}r97(hUh}r:7(h]h]h]h]h]uh'j47h ]r;7j )r<7}r=7(hUh}r>7(h]h]h]h]h]uh'j87h ]r?7j )r@7}rA7(hUh}rB7(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j<7h ]rC7h"X*omruleset: ruleset output/including modulerD7rE7}rF7(hjh'j@7ubah(j ubah(j ubah(j ubah(j! ubjj )rG7}rH7(hUh}rI7(h]h]h]h]h]uh ]rJ7j )rK7}rL7(hUh}rM7(h]h]h]h]h]uh'jG7h ]rN7(j )rO7}rP7(hUh}rQ7(h]h]h]h]h]uh'jK7h ]rR7j )rS7}rT7(hUh}rU7(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'jO7h ]rV7h"X TemplatesrW7rX7}rY7(hjh'jS7ubah(j ubah(j ubj )rZ7}r[7(hUh}r\7(h]h]h]h]h]uh'jK7h ]r]7(j )r^7}r_7(hUh}r`7(h]h]h]h]h]uh'jZ7h ]ra7j )rb7}rc7(hUh}rd7(h]h]h]h]h]uh'j^7h ]re7j )rf7}rg7(hUh}rh7(U anchornameU#template-processingUrefurijh]h]h]h]h]Uinternaluh'jb7h ]ri7h"XTemplate processingrj7rk7}rl7(hXTemplate processingrm7h'jf7ubah(j ubah(j ubah(j ubj )rn7}ro7(hUh}rp7(h]h]h]h]h]uh'jZ7h ]rq7(j )rr7}rs7(hUh}rt7(h]h]h]h]h]uh'jn7h ]ru7j )rv7}rw7(hUh}rx7(U anchornameU#the-template-statementUrefurijh]h]h]h]h]Uinternaluh'jr7h ]ry7h"XThe template() statementrz7r{7}r|7(hXThe template() statementr}7h'jv7ubah(j ubah(j ubj )r~7}r7(hUh}r7(h]h]h]h]h]uh'jn7h ]r7(j )r7}r7(hUh}r7(h]h]h]h]h]uh'j~7h ]r7(j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#listUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xlistr7r7}r7(hXlistr7h'j7ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7(j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#constant-statementUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xconstant statementr7r7}r7(hXconstant statementr7h'j7ubah(j ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#property-statementUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xproperty statementr7r7}r7(hXproperty statementr7h'j7ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j~7h ]r7(j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#subtreeUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xsubtreer7r7}r7(hXsubtreer7h'j7ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU #use-caseUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"XUse caser7r7}r7(hXUse caser7h'j7ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j~7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#stringUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xstringr7r7}r7(hXstringr7h'j7ubah(j ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j~7h ]r7j )r7}r7(hUh}r7(h]h]h]h]h]uh'j7h ]r7j )r7}r7(hUh}r7(U anchornameU#pluginUrefurijh]h]h]h]h]Uinternaluh'j7h ]r7h"Xpluginr7r7}r7(hXpluginr7h'j7ubah(j ubah(j ubah(j ubj )r7}r7(hUh}r7(h]h]h]h]h]uh'j~7h ]r7j )r7}r7(hUh}r8(h]h]h]h]h]uh'j7h ]r8j )r8}r8(hUh}r8(U anchornameU#optionsUrefurijh]h]h]h]h]Uinternaluh'j7h ]r8h"Xoptionsr8r8}r8(hXoptionsr 8h'j8ubah(j ubah(j ubah(j ubj )r 8}r 8(hUh}r 8(h]h]h]h]h]uh'j~7h ]r 8(j )r8}r8(hUh}r8(h]h]h]h]h]uh'j 8h ]r8j )r8}r8(hUh}r8(U anchornameU #examplesUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"XExamplesr8r8}r8(hXExamplesr8h'j8ubah(j ubah(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'j 8h ]r8(j )r8}r8(hUh}r 8(h]h]h]h]h]uh'j8h ]r!8j )r"8}r#8(hUh}r$8(h]h]h]h]h]uh'j8h ]r%8j )r&8}r'8(hUh}r(8(U anchornameU'#standard-template-for-writing-to-filesUrefurijh]h]h]h]h]Uinternaluh'j"8h ]r)8h"X&Standard Template for Writing to Filesr*8r+8}r,8(hX&Standard Template for Writing to Filesr-8h'j&8ubah(j ubah(j ubah(j ubj )r.8}r/8(hUh}r08(h]h]h]h]h]uh'j8h ]r18j )r28}r38(hUh}r48(h]h]h]h]h]uh'j.8h ]r58j )r68}r78(hUh}r88(U anchornameU?#standard-template-for-forwarding-to-a-remote-host-rfc3164-modeUrefurijh]h]h]h]h]Uinternaluh'j28h ]r98h"X@Standard Template for Forwarding to a Remote Host (RFC3164 mode)r:8r;8}r<8(hX@Standard Template for Forwarding to a Remote Host (RFC3164 mode)r=8h'j68ubah(j ubah(j ubah(j ubj )r>8}r?8(hUh}r@8(h]h]h]h]h]uh'j8h ]rA8j )rB8}rC8(hUh}rD8(h]h]h]h]h]uh'j>8h ]rE8j )rF8}rG8(hUh}rH8(U anchornameU2#standard-template-for-write-to-the-mysql-databaseUrefurijh]h]h]h]h]Uinternaluh'jB8h ]rI8h"X1Standard Template for write to the MySQL databaserJ8rK8}rL8(hX1Standard Template for write to the MySQL databaserM8h'jF8ubah(j ubah(j ubah(j ubj )rN8}rO8(hUh}rP8(h]h]h]h]h]uh'j8h ]rQ8j )rR8}rS8(hUh}rT8(h]h]h]h]h]uh'jN8h ]rU8j )rV8}rW8(hUh}rX8(U anchornameU'#creating-dynamic-file-names-for-omfileUrefurijh]h]h]h]h]Uinternaluh'jR8h ]rY8h"X&Creating Dynamic File Names for omfilerZ8r[8}r\8(hX&Creating Dynamic File Names for omfiler]8h'jV8ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubeh(j! ubeh(j ubj )r^8}r_8(hUh}r`8(h]h]h]h]h]uh'jZ7h ]ra8(j )rb8}rc8(hUh}rd8(h]h]h]h]h]uh'j^8h ]re8j )rf8}rg8(hUh}rh8(U anchornameU#legacy-formatUrefurijh]h]h]h]h]Uinternaluh'jb8h ]ri8h"X legacy formatrj8rk8}rl8(hX legacy formatrm8h'jf8ubah(j ubah(j ubj )rn8}ro8(hUh}rp8(h]h]h]h]h]uh'j^8h ]rq8(j )rr8}rs8(hUh}rt8(h]h]h]h]h]uh'jn8h ]ru8j )rv8}rw8(hUh}rx8(h]h]h]h]h]uh'jr8h ]ry8j )rz8}r{8(hUh}r|8(U anchornameU#id1Urefurijh]h]h]h]h]Uinternaluh'jv8h ]r}8h"Xstringr~8r8}r8(hXstringr8h'jz8ubah(j ubah(j ubah(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'jn8h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameU#id2Urefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"Xpluginr8r8}r8(hXpluginr8h'j8ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'jZ7h ]r8(j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameU#reserved-template-namesUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"XReserved Template Namesr8r8}r8(hXReserved Template Namesr8h'j8ubah(j ubah(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameU%#legacy-string-based-template-samplesUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"X$Legacy String-based Template Samplesr8r8}r8(hX$Legacy String-based Template Samplesr8h'j8ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'jZ7h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameU #see-alsoUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"XSee Alsor8r8}r8(hXSee Alsor8h'j8ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r8}r8(hUh}r8(h]h]h]h]h]uh ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"X$ControlCharacterEscapePrefixr8r8}r8(hjh'j8ubah(j ubah(j ubah(j ubah(j! ubjj )r8}r8(hUh}r8(h]h]h]h]h]uh ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8(j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"XThe rsyslog "call" statementr8r8}r8(hjh'j8ubah(j ubah(j ubj )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8(j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(h]h]h]h]h]uh'j8h ]r8j )r8}r8(hUh}r8(U anchornameU#syntaxUrefurijh]h]h]h]h]Uinternaluh'j8h ]r8h"Xsyntaxr8r8}r8(hXsyntaxh'j8ubah(j ubah(j ubah(j ubj )r8}r9(hUh}r9(h]h]h]h]h]uh'j8h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j8h ]r9j )r9}r9(hUh}r 9(U anchornameU#related-linksUrefurijh]h]h]h]h]Uinternaluh'j9h ]r 9h"X related linksr 9r 9}r 9(hX related linksh'j9ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r9}r9(hUh}r9(h]h]h]h]h]uh ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"X'omoracle: Oracle Database Output Moduler9r9}r 9(hjh'j9ubah(j ubah(j ubah(j ubah(j! ubjj )r!9}r"9(hUh}r#9(h]h]h]h]h]uh ]r$9j )r%9}r&9(hUh}r'9(h]h]h]h]h]uh'j!9h ]r(9(j )r)9}r*9(hUh}r+9(h]h]h]h]h]uh'j%9h ]r,9j )r-9}r.9(hUh}r/9(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j)9h ]r09h"XMessage parsers in rsyslogr19r29}r39(hjh'j-9ubah(j ubah(j ubj )r49}r59(hUh}r69(h]h]h]h]h]uh'j%9h ]r79(j )r89}r99(hUh}r:9(h]h]h]h]h]uh'j49h ]r;9j )r<9}r=9(hUh}r>9(h]h]h]h]h]uh'j89h ]r?9j )r@9}rA9(hUh}rB9(U anchornameU#introUrefurijh]h]h]h]h]Uinternaluh'j<9h ]rC9h"XIntrorD9rE9}rF9(hXIntroh'j@9ubah(j ubah(j ubah(j ubj )rG9}rH9(hUh}rI9(h]h]h]h]h]uh'j49h ]rJ9j )rK9}rL9(hUh}rM9(h]h]h]h]h]uh'jG9h ]rN9j )rO9}rP9(hUh}rQ9(U anchornameU#what-are-message-parsersUrefurijh]h]h]h]h]Uinternaluh'jK9h ]rR9h"XWhat are message parsers?rS9rT9}rU9(hXWhat are message parsers?h'jO9ubah(j ubah(j ubah(j ubj )rV9}rW9(hUh}rX9(h]h]h]h]h]uh'j49h ]rY9(j )rZ9}r[9(hUh}r\9(h]h]h]h]h]uh'jV9h ]r]9j )r^9}r_9(hUh}r`9(U anchornameU#how-are-message-parsers-usedUrefurijh]h]h]h]h]Uinternaluh'jZ9h ]ra9h"XHow are message parsers used?rb9rc9}rd9(hXHow are message parsers used?h'j^9ubah(j ubah(j ubj )re9}rf9(hUh}rg9(h]h]h]h]h]uh'jV9h ]rh9(j )ri9}rj9(hUh}rk9(h]h]h]h]h]uh'je9h ]rl9j )rm9}rn9(hUh}ro9(h]h]h]h]h]uh'ji9h ]rp9j )rq9}rr9(hUh}rs9(U anchornameU##parser-chains-and-how-they-operateUrefurijh]h]h]h]h]Uinternaluh'jm9h ]rt9h"X"Parser Chains and how they Operateru9rv9}rw9(hX"Parser Chains and how they Operateh'jq9ubah(j ubah(j ubah(j ubj )rx9}ry9(hUh}rz9(h]h]h]h]h]uh'je9h ]r{9j )r|9}r}9(hUh}r~9(h]h]h]h]h]uh'jx9h ]r9j )r9}r9(hUh}r9(U anchornameU#where-are-parser-chains-usedUrefurijh]h]h]h]h]Uinternaluh'j|9h ]r9h"XWhere are parser chains used?r9r9}r9(hXWhere are parser chains used?h'j9ubah(j ubah(j ubah(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'je9h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU8#can-i-use-different-parser-chains-for-different-devicesUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"X8Can I use different parser chains for different devices?r9r9}r9(hX8Can I use different parser chains for different devices?h'j9ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'j49h ]r9(j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU$#which-message-parsers-are-availableUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"X#Which message parsers are availabler9r9}r9(hX#Which message parsers are availableh'j9ubah(j ubah(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU#how-to-write-a-message-parserUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"XHow to write a message parser?r9r9}r9(hXHow to write a message parser?h'j9ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'j49h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU #conclusionUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"X Conclusionr9r9}r9(hX Conclusionh'j9ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r9}r9(hUh}r9(h]h]h]h]h]uh ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9(j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"X Lookup Tablesr9r9}r9(hj h'j9ubah(j ubah(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9(j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9(j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU#lookup-table-file-formatUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"XLookup Table File Formatr9r9}r9(hXLookup Table File Formatr9h'j9ubah(j ubah(j ubj )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9(j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(h]h]h]h]h]uh'j9h ]r9j )r9}r9(hUh}r9(U anchornameU#headerUrefurijh]h]h]h]h]Uinternaluh'j9h ]r9h"XHeaderr9r9}r:(hXHeaderr:h'j9ubah(j ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j9h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r :j )r :}r :(hUh}r :(U anchornameU#tableUrefurijh]h]h]h]h]Uinternaluh'j:h ]r :h"XTabler:r:}r:(hXTabler:h'j :ubah(j ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j9h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU#exampleUrefurijh]h]h]h]h]Uinternaluh'j:h ]r:h"XExampler:r:}r :(hXExampler!:h'j:ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r":}r#:(hUh}r$:(h]h]h]h]h]uh'j9h ]r%:(j )r&:}r':(hUh}r(:(h]h]h]h]h]uh'j":h ]r):j )r*:}r+:(hUh}r,:(U anchornameU#rainerscript-statementsUrefurijh]h]h]h]h]Uinternaluh'j&:h ]r-:h"XRainerScript Statementsr.:r/:}r0:(hXRainerScript Statementsr1:h'j*:ubah(j ubah(j ubj )r2:}r3:(hUh}r4:(h]h]h]h]h]uh'j":h ]r5:(j )r6:}r7:(hUh}r8:(h]h]h]h]h]uh'j2:h ]r9:(j )r::}r;:(hUh}r<:(h]h]h]h]h]uh'j6:h ]r=:j )r>:}r?:(hUh}r@:(U anchornameU#lookup-table-objectUrefurijh]h]h]h]h]Uinternaluh'j::h ]rA:h"Xlookup_table() ObjectrB:rC:}rD:(hXlookup\_table() ObjectrE:h'j>:ubah(j ubah(j ubj )rF:}rG:(hUh}rH:(h]h]h]h]h]uh'j6:h ]rI:j )rJ:}rK:(hUh}rL:(h]h]h]h]h]uh'jF:h ]rM:j )rN:}rO:(hUh}rP:(h]h]h]h]h]uh'jJ:h ]rQ:j )rR:}rS:(hUh}rT:(U anchornameU #parametersUrefurijh]h]h]h]h]Uinternaluh'jN:h ]rU:h"X ParametersrV:rW:}rX:(hX ParametersrY:h'jR:ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )rZ:}r[:(hUh}r\:(h]h]h]h]h]uh'j2:h ]r]:(j )r^:}r_:(hUh}r`:(h]h]h]h]h]uh'jZ:h ]ra:j )rb:}rc:(hUh}rd:(U anchornameU#lookup-functionUrefurijh]h]h]h]h]Uinternaluh'j^:h ]re:h"Xlookup() Functionrf:rg:}rh:(hXlookup() Functionri:h'jb:ubah(j ubah(j ubj )rj:}rk:(hUh}rl:(h]h]h]h]h]uh'jZ:h ]rm:j )rn:}ro:(hUh}rp:(h]h]h]h]h]uh'jj:h ]rq:j )rr:}rs:(hUh}rt:(h]h]h]h]h]uh'jn:h ]ru:j )rv:}rw:(hUh}rx:(U anchornameU#id1Urefurijh]h]h]h]h]Uinternaluh'jr:h ]ry:h"X Parametersrz:r{:}r|:(hX Parametersr}:h'jv:ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r~:}r:(hUh}r:(h]h]h]h]h]uh'j2:h ]r:(j )r:}r:(hUh}r:(h]h]h]h]h]uh'j~:h ]r:j )r:}r:(hUh}r:(U anchornameU#load-lookup-table-statementUrefurijh]h]h]h]h]Uinternaluh'j:h ]r:h"Xload_lookup_table Statementr:r:}r:(hXload\_lookup\_table Statementr:h'j:ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j~:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU#id2Urefurijh]h]h]h]h]Uinternaluh'j:h ]r:h"X Parametersr:r:}r:(hX Parametersr:h'j:ubah(j ubah(j ubah(j ubah(j! ubeh(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j2:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU#usage-exampleUrefurijh]h]h]h]h]Uinternaluh'j:h ]r:h"X Usage exampler:r:}r:(hX Usage exampler:h'j:ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j9h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU#implementation-detailsUrefurijh]h]h]h]h]Uinternaluh'j:h ]r:h"XImplementation Detailsr:r:}r:(hXImplementation Detailsr:h'j:ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj j )r:}r:(hUh}r:(h]h]h]h]h]uh ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:(j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameUUrefurij h]h]h]h]h]Uinternaluh'j:h ]r:h"XLog rotation with rsyslogr:r:}r:(hjh'j:ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:(j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU #situationUrefurij h]h]h]h]h]Uinternaluh'j:h ]r:h"X Situationr:r:}r:(hX Situationh'j:ubah(j ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(U anchornameU'#log-rotation-based-on-a-fixed-log-sizeUrefurij h]h]h]h]h]Uinternaluh'j:h ]r:h"X&Log rotation based on a fixed log sizer:r:}r:(hX&Log rotation based on a fixed log sizeh'j:ubah(j ubah(j ubah(j ubj )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r:(hUh}r:(h]h]h]h]h]uh'j:h ]r:j )r:}r;(hUh}r;(U anchornameU2#use-output-channels-for-fixed-length-syslog-filesUrefurij h]h]h]h]h]Uinternaluh'j:h ]r;h"X1Use Output Channels for fixed-length syslog filesr;r;}r;(hX1Use Output Channels for fixed-length syslog filesh'j:ubah(j ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j:h ]r ;j )r ;}r ;(hUh}r ;(h]h]h]h]h]uh'j;h ]r ;j )r;}r;(hUh}r;(U anchornameU #conclusionUrefurij h]h]h]h]h]Uinternaluh'j ;h ]r;h"X Conclusionr;r;}r;(hX Conclusionh'j;ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubjj )r;}r;(hUh}r;(h]h]h]h]h]uh ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r ;j )r!;}r";(hUh}r#;(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j;h ]r$;h"X Expressionsr%;r&;}r';(hjh'j!;ubah(j ubah(j ubah(j ubah(j! ubjj )r(;}r);(hUh}r*;(h]h]h]h]h]uh ]r+;j )r,;}r-;(hUh}r.;(h]h]h]h]h]uh'j(;h ]r/;(j )r0;}r1;(hUh}r2;(h]h]h]h]h]uh'j,;h ]r3;j )r4;}r5;(hUh}r6;(U anchornameUUrefurijh]h]h]h]h]Uinternaluh'j0;h ]r7;h"X Lookup Tablesr8;r9;}r:;(hj'h'j4;ubah(j ubah(j ubj )r;;}r<;(hUh}r=;(h]h]h]h]h]uh'j,;h ]r>;(j )r?;}r@;(hUh}rA;(h]h]h]h]h]uh'j;;h ]rB;(j )rC;}rD;(hUh}rE;(h]h]h]h]h]uh'j?;h ]rF;j )rG;}rH;(hUh}rI;(U anchornameU#typesUrefurijh]h]h]h]h]Uinternaluh'jC;h ]rJ;h"XTypesrK;rL;}rM;(hXTypesh'jG;ubah(j ubah(j ubj )rN;}rO;(hUh}rP;(h]h]h]h]h]uh'j?;h ]rQ;(j )rR;}rS;(hUh}rT;(h]h]h]h]h]uh'jN;h ]rU;j )rV;}rW;(hUh}rX;(h]h]h]h]h]uh'jR;h ]rY;j )rZ;}r[;(hUh}r\;(U anchornameU#stringUrefurijh]h]h]h]h]Uinternaluh'jV;h ]r];h"Xstringr^;r_;}r`;(hXstringh'jZ;ubah(j ubah(j ubah(j ubj )ra;}rb;(hUh}rc;(h]h]h]h]h]uh'jN;h ]rd;j )re;}rf;(hUh}rg;(h]h]h]h]h]uh'ja;h ]rh;j )ri;}rj;(hUh}rk;(U anchornameU#arrayUrefurijh]h]h]h]h]Uinternaluh'je;h ]rl;h"Xarrayrm;rn;}ro;(hXarrayh'ji;ubah(j ubah(j ubah(j ubj )rp;}rq;(hUh}rr;(h]h]h]h]h]uh'jN;h ]rs;j )rt;}ru;(hUh}rv;(h]h]h]h]h]uh'jp;h ]rw;j )rx;}ry;(hUh}rz;(U anchornameU #sparsearrayUrefurijh]h]h]h]h]Uinternaluh'jt;h ]r{;h"X sparseArrayr|;r};}r~;(hX sparseArrayh'jx;ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU#lookup-table-file-formatUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"XLookup Table File Formatr;r;}r;(hXLookup Table File Formath'j;ubah(j ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;;h ]r;(j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU#lookup-table-configurationUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"XLookup-table configurationr;r;}r;(hXLookup-table configurationh'j;ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;(j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU1#lookup-table-name-table-file-path-to-file-objectUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"X?lookup_table(name="" file=""...) (object)r;r;}r;(hX?lookup_table(name="
" file=""...) (object)h'j;ubah(j ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU#lookup-table-expr-functionUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"X$lookup("
", ) (function)r;r;}r;(hX$lookup("
", ) (function)h'j;ubah(j ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU/#reload-lookup-table-table-stub-value-statementUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"X:reload_lookup_table("
", "") (statement)r;r;}r;(hX:reload_lookup_table("
", "") (statement)h'j;ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU#implementation-detailsUrefurijh]h]h]h]h]Uinternaluh'j;h ]r;h"XImplementation Detailsr;r;}r;(hXImplementation Detailsh'j;ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj(j )r;}r;(hUh}r;(h]h]h]h]h]uh ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;(j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameUUrefurij(h]h]h]h]h]Uinternaluh'j;h ]r;h"Xim3195: RFC3195 Input Moduler;r;}r;(hj0h'j;ubah(j ubah(j ubj )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;(j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(h]h]h]h]h]uh'j;h ]r;j )r;}r;(hUh}r;(U anchornameU#configuration-directivesUrefurij(h]h]h]h]h]Uinternaluh'j;h ]r;h"XConfiguration Directivesr<r<}r<(hXConfiguration Directivesh'j;ubah(j ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j;h ]r<j )r<}r<(hUh}r <(h]h]h]h]h]uh'j<h ]r <j )r <}r <(hUh}r <(U anchornameU#caveats-known-bugsUrefurij(h]h]h]h]h]Uinternaluh'j<h ]r<h"XCaveats/Known Bugsr<r<}r<(hXCaveats/Known Bugsh'j <ubah(j ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j;h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameU#exampleUrefurij(h]h]h]h]h]Uinternaluh'j<h ]r<h"XExampler<r<}r <(hXExampleh'j<ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubj1j )r!<}r"<(hUh}r#<(h]h]h]h]h]uh ]r$<j )r%<}r&<(hUh}r'<(h]h]h]h]h]uh'j!<h ]r(<j )r)<}r*<(hUh}r+<(h]h]h]h]h]uh'j%<h ]r,<j )r-<}r.<(hUh}r/<(U anchornameUUrefurij1h]h]h]h]h]Uinternaluh'j)<h ]r0<h"X$GssForwardServiceNamer1<r2<}r3<(hj9h'j-<ubah(j ubah(j ubah(j ubah(j! ubj:j )r4<}r5<(hUh}r6<(h]h]h]h]h]uh ]r7<j )r8<}r9<(hUh}r:<(h]h]h]h]h]uh'j4<h ]r;<j )r<<}r=<(hUh}r><(h]h]h]h]h]uh'j8<h ]r?<j )r@<}rA<(hUh}rB<(U anchornameUUrefurij:h]h]h]h]h]Uinternaluh'j<<h ]rC<h"XHow you can HelprD<rE<}rF<(hjBh'j@<ubah(j ubah(j ubah(j ubah(j! ubjCj )rG<}rH<(hUh}rI<(h]h]h]h]h]uh ]rJ<j )rK<}rL<(hUh}rM<(h]h]h]h]h]uh'jG<h ]rN<j )rO<}rP<(hUh}rQ<(h]h]h]h]h]uh'jK<h ]rR<j )rS<}rT<(hUh}rU<(U anchornameUUrefurijCh]h]h]h]h]Uinternaluh'jO<h ]rV<h"X$AllowedSenderrW<rX<}rY<(hjKh'jS<ubah(j ubah(j ubah(j ubah(j! ubjLj )rZ<}r[<(hUh}r\<(h]h]h]h]h]uh ]r]<j )r^<}r_<(hUh}r`<(h]h]h]h]h]uh'jZ<h ]ra<(j )rb<}rc<(hUh}rd<(h]h]h]h]h]uh'j^<h ]re<j )rf<}rg<(hUh}rh<(U anchornameUUrefurijLh]h]h]h]h]Uinternaluh'jb<h ]ri<h"XOutput Modulesrj<rk<}rl<(hjTh'jf<ubah(j ubah(j ubj )rm<}rn<(hUh}ro<(h]h]h]h]h]uh'j^<h ]rp<j )rq<}rr<(hUh'jm<j XG/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_output.rsth(j h}rs<(UnumberedKUparentjLU titlesonlyUmaxdepthKUglobh]h]h]h]h]Uentries]rt<(Njtru<Njrv<Njrw<Nj'rx<Njry<Nj&rz<NhEr{<Njr|<Njr}<Njbr~<Nh*r<Nj"r<Nhr<Njr<NjJr<Njr<Njr<Nj4r<Njr<Nj\r<Njr<Nhr<Njr<Njr<Njr<eUhiddenUcaptionNU includefiles]r<(jtjjj'jj&hEjjjbh*j"hjjJjjj4jj\jhjjjeU includehiddenuj K h ]ubah(j! ubeh(j ubah(j! ubjUj )r<}r<(hUh}r<(h]h]h]h]h]uh ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameUUrefurijUh]h]h]h]h]Uinternaluh'j<h ]r<h"X$RulesetParserr<r<}r<(hj]h'j<ubah(j ubah(j ubah(j ubah(j! ubj^j )r<}r<(hUh}r<(h]h]h]h]h]uh ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<(j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameUUrefurij^h]h]h]h]h]Uinternaluh'j<h ]r<h"XGELF forwarding in rsyslogr<r<}r<(hjfh'j<ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<(j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameU #situationUrefurij^h]h]h]h]h]Uinternaluh'j<h ]r<h"X Situationr<r<}r<(hX Situationh'j<ubah(j ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameU(#changing-the-default-log-format-to-gelfUrefurij^h]h]h]h]h]Uinternaluh'j<h ]r<h"X'Changing the default log format to GELFr<r<}r<(hX'Changing the default log format to GELFh'j<ubah(j ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameU)#applying-the-template-to-a-syslog-actionUrefurij^h]h]h]h]h]Uinternaluh'j<h ]r<h"X(Applying the template to a syslog actionr<r<}r<(hX(Applying the template to a syslog actionh'j<ubah(j ubah(j ubah(j ubj )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(h]h]h]h]h]uh'j<h ]r<j )r<}r<(hUh}r<(U anchornameU #conclusionUrefurij^h]h]h]h]h]Uinternaluh'j<h ]r<h"X Conclusionr<r<}r<(hX Conclusionh'j<ubah(j ubah(j ubah(j ubeh(j! ubeh(j ubah(j! ubuU indexentriesr<}r<(h]h*]r<(Usingler<XimudpUindex-0Umainr<tr<ah3]h<]hE]hN]hW]h`]r<((j<XimfileUindex-0j<tr<(j<X imfile; modeUindex-1Utr<(j<Ximfile; readtimeoutUindex-2Utr<(j<Ximfile; timeoutGranularityUindex-3Utr<(j<Ximfile; PollingIntervalUindex-4Utr=(j<X imfile; FileUindex-5Utr=(j<X imfile; TagUindex-6Utr=(j<Ximfile; FacilityUindex-7Utr=(j<Ximfile; SeverityUindex-8Utr=(j<Ximfile; PersistStateIntervalUindex-9Utr=(j<Ximfile; startmsg.regexUindex-10Utr=(j<Ximfile; readTimeoutUindex-11Utr=(j<Ximfile; readModeUindex-12Utr=(j<Ximfile; escapeLFUindex-13Utr =(j<Ximfile; MaxLinesAtOnceUindex-14Utr =(j<Ximfile; MaxSubmitAtOnceUindex-15Utr =(j<X imfile; deleteStateOnFileDeleteUindex-16Utr =(j<Ximfile; RulesetUindex-17Utr =(j<Ximfile; reopenOnTruncateUindex-18Utr=(j<Ximfile; trimLineOverBytesUindex-19Utr=(j<Ximfile; freshStartTailUindex-20Utr=(j<Ximfile; $InputFileNameUindex-21Utr=(j<Ximfile; $InputFileTagUindex-22Utr=(j<Ximfile; $InputFileStateFileUindex-23Utr=(j<Ximfile; $InputFileFacilityUindex-24Utr=(j<Ximfile; $InputFileSeverityUindex-25Utr=(j<Ximfile; $InputRunFileMonitorUindex-26Utr=(j<Ximfile; $InputFilePollIntervalUindex-27Utr=(j<X&imfile; $InputFilePersistStateIntervalUindex-28Utr=(j<Ximfile; $InputFileReadModeUindex-29Utr=(j<X imfile; $InputFileMaxLinesAtOnceUindex-30Utr=(j<Ximfile; $InputFileBindRulesetUindex-31Utr=ehi]hr]h{]h]h]h]h]h]h]r=(j<XparserUindex-0j<tr=ah]h]h]h]h]h]h]h]j]j ]j]j]j&]j/]j8]jA]jJ]jS]j\]je]jn]jw]j]j]j]j]j]j]j]j]j]j]j]j]j]j]r=((j<XimudpUindex-0j<tr=(j<Ximudp; module parametersUindex-1Utr =(j<Ximudp; input parametersUindex-2Utr!=(j<Ximudp; port (input parameter)Uindex-3Utr"=ej]j]j]j]j"]j+]j4]j=]jF]jO]r#=(j<XactionUindex-0j<tr$=ah ]j`]ji]jr]j{]r%=((j<X RFC; RFC 3164Uindex-0Utr&=(j<X RFC; RFC 3195Uindex-1Utr'=(j<X RFC; RFC 5424Uindex-2Utr(=ej]j]j]j]j]j]j]j]j]r)=(j<X RFC; RFC 3164Uindex-0Utr*=aj]j]j]j]j]j]j ]j]j]j&]j/]j8]jA]jJ]jS]j\]je]jn]jw]j]j]j]j]j]j]j]j]j]j]j]j]j]j]j]j]j]j]j"]j+]j4]j=]jF]r+=(j<XinputUindex-0j<tr,=ajO]jX]ja]jj]js]j|]j]j]j]j]r-=(j<XtimezoneUindex-0j<tr.=aj]j]j]j]j]j]j]j]j]j]r/=(j<X RFC; RFC 5424Uindex-0Utr0=aj]j ]j]j]r1=(j<X RFC; RFC 5424Uindex-0Utr2=aj']j0]j9]jB]jK]jT]j]]jf]jo]jx]j]j]j]j]j]j]j]j]j]j]r3=(j<X mmdblookupUindex-0j<tr4=aj]j]j]j]j]j]j]j]j#]j,]j5]j>]jG]jP]jY]jb]jk]jt]j}]j]j]j]j]r5=(j<X'tls.permittedPeer() (built-in function)jUtr6=aj]j]j]j]j]j]j]j]j]j]j]j ]j]j]j(]j1]j:]jC]jL]jU]j^]uUall_docsr7=}r8=(hGA)hxh*GA)h2h3GA)hmhj4GA)h^j=GA)hjFGA)h jOGA)h[h GA)hn=j`GA)h=jiGA)hsljrGA)hIj{GA)i(UjGA)hI},jGA)ijGA)hD?jGA)hyajGA)hjGA)hWjGA)hSqjGA)iSjGA)hQjGA)h(pjGA)ikjGA)h4jGA)h jGA)hYjGA)hqsj GA)i*>jGA)h{4jGA)h j&GA)h(Fj/GA)hj8GA)ho6jAGA)hлkjJGA)hjSGA)iEj\GA)hjeGA)hrbjnGA)ijwGA)hijGA)htjGA)hGgjGA)i &jGA)h<)0jGA)ijGA)h (jGA)hRgjGA)hT:jGA)h?[jGA)hjGA)hw)jGA)hͩjGA)ijGA)hjGA)hQ jGA)hVyjGA)h;jGA)hlUj"GA)hj+GA)i@j4GA)hQj=GA)hWjFGA)hoqjOGA)hjXGA)hXB jaGA)i [jjGA)hjsGA)iwj|GA)h,jGA)i!jGA)i(jGA)h`jGA)hsjGA)ijGA)hjGA)hKmjGA)hbjGA)hKejGA)hsXjGA)hE}RjGA)i7zjGA)hUCjGA)hjGA)hj GA)hjGA)hkKjGA)hdj'GA)h=j0GA)hB^j9GA)i rjBGA)i"jKGA)hmjTGA)hLnj]GA)httjfGA)i`joGA)hgHojxGA)hmujGA)hhhjGA)hÉjGA)i jGA)hO'jGA)hT&jGA)h~5jGA)hcjGA)hljGA)h{JjGA)hYjGA)h޵jGA)hjGA)hyyjGA)hjGA)h'NjGA)hajGA)h7jGA)h.j#GA)hj,GA)i%fj5GA)hj>GA)hSh{jGGA)hu jPGA)h'jYGA)h@BjbGA)hMjkGA)hjtGA)hj}GA)h1jGA)h,jGA)hh{jGA)h]jGA)h9jGA)hjGA)h̔ljGA)i"p]jGA)h_jGA)hjGA)h޷$jGA)hq!jGA)iS.jGA)h/#jGA)hGÏjGA)hj GA)ijGA)iQjGA)hvj(GA)h|IRj1GA)hV Vj:GA)hjCGA)hq%9jLGA)hzQjUGA)hj^GA)iuUsettingsr9=}r:=(Ucloak_email_addressesr;=Utrim_footnote_reference_spacer<=U halt_levelr==KUsectsubtitle_xformr>=Uembed_stylesheetr?=U pep_base_urlr@=U https://www.python.org/dev/peps/rA=Udoctitle_xformrB=Uwarning_streamrC=csphinx.util.nodes WarningStream rD=)rE=}rF=(U_rerG=cre _compile rH=U+\((DEBUG|INFO|WARNING|ERROR|SEVERE)/[0-4]\)rI=KRrJ=UwarnfuncrK=NubUenvrL=hU rfc_base_urlrM=Uhttps://tools.ietf.org/html/rN=Ufile_insertion_enabledrO=Ugettext_compactrP=Uinput_encodingrQ=U utf-8-sigrR=uU ref_contextrS=}Ufiles_to_rebuildrT=}rU=(jh]rV=jaRrW=h*h]rX=jLaRrY=jh]rZ=jaRr[=hj|aRr>jh]r>haRr>jsh]r>h aRr>jh]r>jaRr>jqh]r>h aRr >joh]r >h aRr >jh]r >(jjeRr >jh]r>jaRr>j&h]r>jLaRr>jh]r>haRr>jh]r>jaRr>jhh]r>h aRr>jh]r>haRr>jh]r>jaRr>jh]r>jaRr>jh]r>jsaRr>jh]r >haRr!>jh]r">j4aRr#>jh]r$>j4aRr%>jh]r&>jaRr'>jh]r(>jaRr)>jh]r*>jaRr+>jh]r,>jaRr->jh]r.>jaRr/>jh]r0>jaRr1>jh]r2>jaRr3>jh]r4>j4aRr5>jwh]r6>j4aRr7>jh]r8>haRr9>j"h]r:>jLaRr;>jh]r<>jsaRr=>jh]r>>j8aRr?>jh]r@>jaRrA>jmh]rB>h aRrC>jh]rD>jaRrE>jXh]rF>j4aRrG>jh]rH>jaRrI>jjh]rJ>haRrK>jkh]rL>h aRrM>jrh]rN>h aRrO>jh]rP>jaRrQ>jh]rR>jsaRrS>jh]rT>jLaRrU>jh]rV>j|aRrW>jh]rX>jaRrY>jh]rZ>jaRr[>jh]r\>jaRr]>jh]r^>j aRr_>jh]r`>haRra>jh]rb>j aRrc>jh]rd>jaRre>jJh]rf>jLaRrg>jh]rh>j4aRri>jh]rj>jaRrk>jh]rl>jeaRrm>jh]rn>haRro>j h]rp>jaRrq>jh]rr>jaRrs>jjh]rt>h aRru>j'h]rv>jLaRrw>jh]rx>jaRry>jh]rz>jsaRr{>jh]r|>jaRr}>jh]r~>jaRr>jh]r>jaRr>juh]r>h aRr>jh]r>jaRr>jh]r>jLaRr>jh]r>jaRr>jh]r>jaRr>jh]r>jLaRr>j~h]r>jaRr>j h]r>jaRr>jh]r>j4aRr>j h]r>jaRr>jh]r>jLaRr>jh]r>jaRr>jh]r>j|aRr>j1h]r>j4aRr>jh]r>jLaRr>jh]r>jaRr>jh]r>j|aRr>jh]r>jaRr>jh]r>jLaRr>jwh]r>h aRr>jh]r>haRr>jh]r>haRr>jh]r>jaRr>jh]r>jaRr>j5h]r>jaRr>j>h]r>j4aRr>jGh]r>haRr>jPh]r>jaRr>jYh]r>jaRr>jbh]r>jLaRr>jih]r>h aRr>jth]r>jLaRr>jh]r>j/aRr>jh]r>jLaRr>jh]r>jaRr>jh]r>jaRr>jh]r>jaRr>jh]r>jaRr>jvh]r>h aRr>jh]r>jLaRr>jgh]r>h aRr>jh]r>haRr>jh]r>jsaRr>jh]r>jLaRr>jh]r>j aRr>jh]r>jaRr>jh]r>jaRr>jh]r>jsaRr>jxh]r>h aRr>j(h]r>jaRr>jh]r>haRr>jh]r>jaRr>jh]r>haRr>jh]r>j|aRr>jUh]r>j`aRr>jh]r>jaRr>uUtoc_secnumbersr>}Uversioning_comparer>U_nitpick_ignorer>h]Rr>ub.build/.doctrees/features.doctree0000664000175000017500000012043113035122643015712 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X rsyslog vs. syslog-ng comparisonqX8writing massive amounts of syslog messages to a databaseqXrsyslog - featuresqNXnativelyq Xrainerq Xsending mail messagesq Xrfc 3195q X world's firstq NXstunnelqXcurrent featuresqNXupcoming featuresqNXfuture of rfc 3195 in rsyslogqXtls-protected syslogqXrsyslog mailing listqXrsyslog change logqXsyslog-protocolqX3processing messages only during specific timeframesqXwriting to mysql databasesquUsubstitution_defsq}qUparse_messagesq]qcdocutils.nodes system_message q)q}q(U rawsourceqUU attributesq }q!(Udupnamesq"]UlevelKUidsq#]Ubackrefsq$]q%Uid1q&aUsourceX//home/rger/proj/rsyslog-doc/source/features.rstq'Uclassesq(]Unamesq)]UlineKUtypeUINFOq*uUparentq+cdocutils.nodes list_item q,)q-}q.(hXJsupport for `RFC 3195 `_ as a sender - this is currently unlikely to happen, because there is no real demand for it. Any work on RFC 3195 has been suspend until we see some real interest in it.  It is probably much better to use TCP-based syslog, which is interoperable with a large number of applications. You may also read my blog post on the future of liblogging, which contains interesting information about the `future of RFC 3195 in rsyslog `_. h+cdocutils.nodes bullet_list q/)q0}q1(hUh+cdocutils.nodes section q2)q3}q4(hUh+h2)q5}q6(hUh+hUsourceq7h'Utagnameq8Usectionq9h }q:(h"]h(]h$]h#]q;Ursyslog-featuresqKUdocumentq?hUchildrenq@]qA(cdocutils.nodes title qB)qC}qD(hXRSyslog - FeaturesqEh+h5h7h'h8UtitleqFh }qG(h"]h(]h$]h#]h)]uh>Kh?hh@]qHcdocutils.nodes Text qIXRSyslog - FeaturesqJqK}qL(hhEh+hCubaubcdocutils.nodes paragraph qM)qN}qO(hX**This page lists both current features as well as those being considered for future versions of rsyslog.** If you think a feature is missing, drop `Rainer `_ a note. Rsyslog is a vital project. Features are added each few days. If you would like to keep up of what is going on, you can also subscribe to the `rsyslog mailing list `_.h+h5h7h'h8U paragraphqPh }qQ(h"]h(]h$]h#]h)]uh>Kh?hh@]qR(cdocutils.nodes strong qS)qT}qU(hXk**This page lists both current features as well as those being considered for future versions of rsyslog.**h }qV(h"]h(]h$]h#]h)]uh+hNh@]qWhIXgThis page lists both current features as well as those being considered for future versions of rsyslog.qXqY}qZ(hUh+hTubah8Ustrongq[ubhIX) If you think a feature is missing, drop q\q]}q^(hX) If you think a feature is missing, drop h+hNubcdocutils.nodes reference q_)q`}qa(hX(`Rainer `_h }qb(UnameXRainerUrefuriqcXmailto:rgerhards@adiscon.comqdh#]h$]h"]h(]h)]uh+hNh@]qehIXRainerqfqg}qh(hUh+h`ubah8U referenceqiubcdocutils.nodes target qj)qk}ql(hX U referencedqmKh+hNh8Utargetqnh }qo(Urefurihdh#]qpUrainerqqah$]h"]h(]h)]qrh auh@]ubhIX a note. Rsyslog is a vital project. Features are added each few days. If you would like to keep up of what is going on, you can also subscribe to the qsqt}qu(hX a note. Rsyslog is a vital project. Features are added each few days. If you would like to keep up of what is going on, you can also subscribe to the h+hNubh_)qv}qw(hXK`rsyslog mailing list `_h }qx(UnameXrsyslog mailing listhcX1http://lists.adiscon.net/mailman/listinfo/rsyslogqyh#]h$]h"]h(]h)]uh+hNh@]qzhIXrsyslog mailing listq{q|}q}(hUh+hvubah8hiubhj)q~}q(hX4 hmKh+hNh8hnh }q(Urefurihyh#]qUrsyslog-mailing-listqah$]h"]h(]h)]qhauh@]ubhIX.q}q(hX.h+hNubeubhM)q}q(hXA better structured feature list is now contained in our `rsyslog vs. syslog-ng comparison `_. Probably that page will replace this one in the future.h+h5h7h'h8hPh }q(h"]h(]h$]h#]h)]uh>K h?hh@]q(hIX9A better structured feature list is now contained in our qq}q(hX9A better structured feature list is now contained in our h+hubh_)q}q(hX@`rsyslog vs. syslog-ng comparison `_h }q(UnameX rsyslog vs. syslog-ng comparisonhcXrsyslog_ng_comparison.htmlqh#]h$]h"]h(]h)]uh+hh@]qhIX rsyslog vs. syslog-ng comparisonqq}q(hUh+hubah8hiubhj)q}q(hX hmKh+hh8hnh }q(Urefurihh#]qUrsyslog-vs-syslog-ng-comparisonqah$]h"]h(]h)]qhauh@]ubhIX:. Probably that page will replace this one in the future.qq}q(hX:. Probably that page will replace this one in the future.h+hubeubh2)q}q(hUh+h5h7h'h8h9h }q(h"]h(]h$]h#]qUcurrent-featuresqah)]qhauh>Kh?hh@]q(hB)q}q(hXCurrent Featuresqh+hh7h'h8hFh }q(h"]h(]h$]h#]h)]uh>Kh?hh@]qhIXCurrent Featuresqq}q(hhh+hubaubh/)q}q(hUh+hh7h'h8U bullet_listqh }q(UbulletqX-h#]h$]h"]h(]h)]uh>Kh?hh@]q(h,)q}q(hXEnative support for `writing to MySQL databases `_qh+hh7h'h8U list_itemqh }q(h"]h(]h$]h#]h)]uh>Nh?hh@]qhM)q}q(hhh+hh7h'h8hPh }q(h"]h(]h$]h#]h)]uh>Kh@]q(hIXnative support for qq}q(hXnative support for h+hubh_)q}q(hX2`writing to MySQL databases `_h }q(UnameXwriting to MySQL databaseshcXrsyslog_mysql.htmlqh#]h$]h"]h(]h)]uh+hh@]qhIXwriting to MySQL databasesqŅq}q(hUh+hubah8hiubhj)q}q(hX hmKh+hh8hnh }q(Urefurihh#]qUwriting-to-mysql-databasesqah$]h"]h(]h)]qhauh@]ubeubaubh,)q}q(hX0native support for writing to Postgres databasesqh+hh7h'h8hh }q(h"]h(]h$]h#]h)]uh>Nh?hh@]qhM)q}q(hhh+hh7h'h8hPh }q(h"]h(]h$]h#]h)]uh>Kh@]qhIX0native support for writing to Postgres databasesqׅq}q(hhh+hubaubaubh,)q}q(hXdirect support for Firebird/Interbase, OpenTDS (MS SQL, Sybase), SQLLite, Ingres, Oracle, and mSQL via libdbi, a database abstraction layer (almost as good as native)h+hh7h'h8hh }q(h"]h(]h$]h#]h)]uh>Nh?hh@]qhM)q}q(hXdirect support for Firebird/Interbase, OpenTDS (MS SQL, Sybase), SQLLite, Ingres, Oracle, and mSQL via libdbi, a database abstraction layer (almost as good as native)qh+hh7h'h8hPh }q(h"]h(]h$]h#]h)]uh>Kh@]qhIXdirect support for Firebird/Interbase, OpenTDS (MS SQL, Sybase), SQLLite, Ingres, Oracle, and mSQL via libdbi, a database abstraction layer (almost as good as native)qㅁq}q(hhh+hubaubaubh,)q}q(hXPnative support for `sending mail messages `_ (first seen in 3.17.0)h+hh7h'h8hh }q(h"]h(]h$]h#]h)]uh>Nh?hh@]qhM)q}q(hXPnative support for `sending mail messages `_ (first seen in 3.17.0)h+hh7h'h8hPh }q(h"]h(]h$]h#]h)]uh>Kh@]q(hIXnative support for qq}q(hXnative support for h+hubh_)q}q(hX&`sending mail messages `_h }q(UnameXsending mail messageshcX ommail.htmlqh#]h$]h"]h(]h)]uh+hh@]qhIXsending mail messagesqq}q(hUh+hubah8hiubhj)q}q(hX hmKh+hh8hnh }q(Urefurihh#]qUsending-mail-messagesqah$]h"]h(]h)]qh auh@]ubhIX (first seen in 3.17.0)qr}r(hX (first seen in 3.17.0)h+hubeubaubh,)r}r(hX>support for (plain) tcp based syslog - much better reliabilityrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r (h"]h(]h$]h#]h)]uh>Kh@]r hIX>support for (plain) tcp based syslog - much better reliabilityr r }r (hjh+jubaubaubh,)r}r(hX<support for sending and receiving compressed syslog messagesrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kh@]rhIX<support for sending and receiving compressed syslog messagesrr}r(hjh+jubaubaubh,)r}r(hXsupport for on-demand on-disk spooling of messages that can not be processed fast enough (a great feature for `writing massive amounts of syslog messages to a database `_)h+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXsupport for on-demand on-disk spooling of messages that can not be processed fast enough (a great feature for `writing massive amounts of syslog messages to a database `_)h+jh7h'h8hPh }r (h"]h(]h$]h#]h)]uh>Kh@]r!(hIXnsupport for on-demand on-disk spooling of messages that can not be processed fast enough (a great feature for r"r#}r$(hXnsupport for on-demand on-disk spooling of messages that can not be processed fast enough (a great feature for h+jubh_)r%}r&(hX]`writing massive amounts of syslog messages to a database `_h }r'(UnameX8writing massive amounts of syslog messages to a databasehcXrsyslog_high_database_rate.htmlr(h#]h$]h"]h(]h)]uh+jh@]r)hIX8writing massive amounts of syslog messages to a databaser*r+}r,(hUh+j%ubah8hiubhj)r-}r.(hX" hmKh+jh8hnh }r/(Urefurij(h#]r0U8writing-massive-amounts-of-syslog-messages-to-a-databaser1ah$]h"]h(]h)]r2hauh@]ubhIX)r3}r4(hX)h+jubeubaubh,)r5}r6(hXsupport for selectively `processing messages only during specific timeframes `_ and spooling them to disk otherwiseh+hh7h'h8hh }r7(h"]h(]h$]h#]h)]uh>Nh?hh@]r8hM)r9}r:(hXsupport for selectively `processing messages only during specific timeframes `_ and spooling them to disk otherwiseh+j5h7h'h8hPh }r;(h"]h(]h$]h#]h)]uh>Kh@]r<(hIXsupport for selectively r=r>}r?(hXsupport for selectively h+j9ubh_)r@}rA(hXg`processing messages only during specific timeframes `_h }rB(UnameX3processing messages only during specific timeframeshcX.http://wiki.rsyslog.com/index.php/OffPeakHoursrCh#]h$]h"]h(]h)]uh+j9h@]rDhIX3processing messages only during specific timeframesrErF}rG(hUh+j@ubah8hiubhj)rH}rI(hX1 hmKh+j9h8hnh }rJ(UrefurijCh#]rKU3processing-messages-only-during-specific-timeframesrLah$]h"]h(]h)]rMhauh@]ubhIX$ and spooling them to disk otherwiserNrO}rP(hX$ and spooling them to disk otherwiseh+j9ubeubaubh,)rQ}rR(hX\ability to monitor text files and convert their contents into syslog messages (one per line)h+hh7h'h8hh }rS(h"]h(]h$]h#]h)]uh>Nh?hh@]rThM)rU}rV(hX\ability to monitor text files and convert their contents into syslog messages (one per line)rWh+jQh7h'h8hPh }rX(h"]h(]h$]h#]h)]uh>K!h@]rYhIX\ability to monitor text files and convert their contents into syslog messages (one per line)rZr[}r\(hjWh+jUubaubaubh,)r]}r^(hXability to configure backup syslog/database servers - if the primary fails, control is switched to a prioritized list of backupsh+hh7h'h8hh }r_(h"]h(]h$]h#]h)]uh>Nh?hh@]r`hM)ra}rb(hXability to configure backup syslog/database servers - if the primary fails, control is switched to a prioritized list of backupsrch+j]h7h'h8hPh }rd(h"]h(]h$]h#]h)]uh>K#h@]rehIXability to configure backup syslog/database servers - if the primary fails, control is switched to a prioritized list of backupsrfrg}rh(hjch+jaubaubaubh,)ri}rj(hXsupport for receiving messages via reliable `RFC 3195 `_ delivery (a bit clumsy to build right now...)h+hh7h'h8hh }rk(h"]h(]h$]h#]h)]uh>Nh?hh@]rlhM)rm}rn(hXsupport for receiving messages via reliable `RFC 3195 `_ delivery (a bit clumsy to build right now...)h+jih7h'h8hPh }ro(h"]h(]h$]h#]h)]uh>K%h@]rp(hIX,support for receiving messages via reliable rqrr}rs(hX,support for receiving messages via reliable h+jmubh_)rt}ru(hXG`RFC 3195 `_h }rv(UnameXRFC 3195hcX9http://www.monitorware.com/Common/en/glossary/rfc3195.phprwh#]h$]h"]h(]h)]uh+jmh@]rxhIXRFC 3195ryrz}r{(hUh+jtubah8hiubhj)r|}r}(hX< hmKh+jmh8hnh }r~(Urefurijwh#]rUrfc-3195rah$]h"]h(]h)]rh auh@]ubhIX. delivery (a bit clumsy to build right now...)rr}r(hX. delivery (a bit clumsy to build right now...)h+jmubeubaubh,)r}r(hXlability to generate file names and directories (log targets) dynamically, based on many different propertiesh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXlability to generate file names and directories (log targets) dynamically, based on many different propertiesrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K(h@]rhIXlability to generate file names and directories (log targets) dynamically, based on many different propertiesrr}r(hjh+jubaubaubh,)r}r(hXccontrol of log output format, including ability to present channel and priority as visible log datah+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXccontrol of log output format, including ability to present channel and priority as visible log datarh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K*h@]rhIXccontrol of log output format, including ability to present channel and priority as visible log datarr}r(hjh+jubaubaubh,)r}r(hXYgood timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zoneh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXYgood timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zonerh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K,h@]rhIXYgood timestamp format control; at a minimum, ISO 8601/RFC 3339 second-resolution UTC zonerr}r(hjh+jubaubaubh,)r}r(hX=ability to reformat message contents and work with substringsrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K.h@]rhIX=ability to reformat message contents and work with substringsrr}r(hjh+jubaubaubh,)r}r(hX%support for log files larger than 2gbrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K/h@]rhIX%support for log files larger than 2gbrr}r(hjh+jubaubaubh,)r}r(hXIsupport for file size limitation and automatic rollover command executionh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXIsupport for file size limitation and automatic rollover command executionrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K0h@]rhIXIsupport for file size limitation and automatic rollover command executionrr}r(hjh+jubaubaubh,)r}r(hXCsupport for running multiple rsyslogd instances on a single machinerh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K2h@]rhIXCsupport for running multiple rsyslogd instances on a single machinerr}r(hjh+jubaubaubh,)r}r(hXsupport for `TLS-protected syslog `_ (both `natively `_ and via `stunnel `_)h+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXsupport for `TLS-protected syslog `_ (both `natively `_ and via `stunnel `_)h+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K3h@]r(hIX support for rr}r(hX support for h+jubh_)r}r(hX*`TLS-protected syslog `_h }r(UnameXTLS-protected sysloghcXrsyslog_tls.htmlrh#]h$]h"]h(]h)]uh+jh@]rhIXTLS-protected syslogrr}r(hUh+jubah8hiubhj)r}r(hX hmKh+jh8hnh }r(Urefurijh#]rUtls-protected-syslograh$]h"]h(]h)]rhauh@]ubhIX (both rr}r(hX (both h+jubh_)r}r(hX`natively `_h }r(Unameh hcXrsyslog_tls.htmlrh#]h$]h"]h(]h)]uh+jh@]rhIXnativelyrr}r(hUh+jubah8hiubhj)r}r(hX hmKh+jh8hnh }r(Urefurijh#]rUnativelyrah$]h"]h(]h)]rh auh@]ubhIX and via rr}r(hX and via h+jubh_)r}r(hX!`stunnel `_h }r(UnamehhcXrsyslog_stunnel.htmlr h#]h$]h"]h(]h)]uh+jh@]r hIXstunnelr r }r (hUh+jubah8hiubhj)r}r(hX hmKh+jh8hnh }r(Urefurij h#]rUstunnelrah$]h"]h(]h)]rhauh@]ubhIX)r}r(hX)h+jubeubaubh,)r}r(hXLability to filter on any part of the message, not just facility and severityh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXLability to filter on any part of the message, not just facility and severityrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>K6h@]rhIXLability to filter on any part of the message, not just facility and severityrr }r!(hjh+jubaubaubh,)r"}r#(hX-ability to use regular expressions in filtersr$h+hh7h'h8hh }r%(h"]h(]h$]h#]h)]uh>Nh?hh@]r&hM)r'}r((hj$h+j"h7h'h8hPh }r)(h"]h(]h$]h#]h)]uh>K8h@]r*hIX-ability to use regular expressions in filtersr+r,}r-(hj$h+j'ubaubaubh,)r.}r/(hX0support for discarding messages based on filtersr0h+hh7h'h8hh }r1(h"]h(]h$]h#]h)]uh>Nh?hh@]r2hM)r3}r4(hj0h+j.h7h'h8hPh }r5(h"]h(]h$]h#]h)]uh>K9h@]r6hIX0support for discarding messages based on filtersr7r8}r9(hj0h+j3ubaubaubh,)r:}r;(hX5ability to execute shell scripts on received messagesr<h+hh7h'h8hh }r=(h"]h(]h$]h#]h)]uh>Nh?hh@]r>hM)r?}r@(hj<h+j:h7h'h8hPh }rA(h"]h(]h$]h#]h)]uh>K:h@]rBhIX5ability to execute shell scripts on received messagesrCrD}rE(hj<h+j?ubaubaubh,)rF}rG(hXvcontrol of whether the local hostname or the hostname of the origin of the data is shown as the hostname in the outputh+hh7h'h8hh }rH(h"]h(]h$]h#]h)]uh>Nh?hh@]rIhM)rJ}rK(hXvcontrol of whether the local hostname or the hostname of the origin of the data is shown as the hostname in the outputrLh+jFh7h'h8hPh }rM(h"]h(]h$]h#]h)]uh>K;h@]rNhIXvcontrol of whether the local hostname or the hostname of the origin of the data is shown as the hostname in the outputrOrP}rQ(hjLh+jJubaubaubh,)rR}rS(hXNability to preserve the original hostname in NAT environments and relay chainsh+hh7h'h8hh }rT(h"]h(]h$]h#]h)]uh>Nh?hh@]rUhM)rV}rW(hXNability to preserve the original hostname in NAT environments and relay chainsrXh+jRh7h'h8hPh }rY(h"]h(]h$]h#]h)]uh>K=h@]rZhIXNability to preserve the original hostname in NAT environments and relay chainsr[r\}r](hjXh+jVubaubaubh,)r^}r_(hX,ability to limit the allowed network sendersr`h+hh7h'h8hh }ra(h"]h(]h$]h#]h)]uh>Nh?hh@]rbhM)rc}rd(hj`h+j^h7h'h8hPh }re(h"]h(]h$]h#]h)]uh>K?h@]rfhIX,ability to limit the allowed network sendersrgrh}ri(hj`h+jcubaubaubh,)rj}rk(hXOpowerful BSD-style hostname and program name blocks for easy multi-host supporth+hh7h'h8hh }rl(h"]h(]h$]h#]h)]uh>Nh?hh@]rmhM)rn}ro(hXOpowerful BSD-style hostname and program name blocks for easy multi-host supportrph+jjh7h'h8hPh }rq(h"]h(]h$]h#]h)]uh>K@h@]rrhIXOpowerful BSD-style hostname and program name blocks for easy multi-host supportrsrt}ru(hjph+jnubaubaubh,)rv}rw(hXmassively multi-threaded with dynamic work thread pools that start up and shut themselves down on an as-needed basis (great for high log volume on multicore machines)h+hh7h'h8hh }rx(h"]h(]h$]h#]h)]uh>Nh?hh@]ryhM)rz}r{(hXmassively multi-threaded with dynamic work thread pools that start up and shut themselves down on an as-needed basis (great for high log volume on multicore machines)r|h+jvh7h'h8hPh }r}(h"]h(]h$]h#]h)]uh>KBh@]r~hIXmassively multi-threaded with dynamic work thread pools that start up and shut themselves down on an as-needed basis (great for high log volume on multicore machines)rr}r(hj|h+jzubaubaubh,)r}r(hXvery experimental and volatile support for `syslog-protocol `_ compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)h+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXvery experimental and volatile support for `syslog-protocol `_ compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)h+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KEh@]r(hIX+very experimental and volatile support for rr}r(hX+very experimental and volatile support for h+jubh_)r}r(hX)`syslog-protocol `_h }r(UnamehhcXsyslog_protocol.htmlrh#]h$]h"]h(]h)]uh+jh@]rhIXsyslog-protocolrr}r(hUh+jubah8hiubhj)r}r(hX hmKh+jh8hnh }r(Urefurijh#]rUsyslog-protocolrah$]h"]h(]h)]rhauh@]ubhIX compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)rr}r(hX compliant messages (it is volatile because standardization is currently underway and this is a proof-of-concept implementation to aid this effort)h+jubeubaubh,)r}r(hX4world's first implementation of syslog-transport-tlsrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KIh@]rhIX4world's first implementation of syslog-transport-tlsrr}r(hjh+jubaubaubh,)r}r(hXthe sysklogd's klogd functionality is implemented as the *imklog* input plug-in. So rsyslog is a full replacement for the sysklogd packageh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXthe sysklogd's klogd functionality is implemented as the *imklog* input plug-in. So rsyslog is a full replacement for the sysklogd packageh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KJh@]r(hIX9the sysklogd's klogd functionality is implemented as the rr}r(hX9the sysklogd's klogd functionality is implemented as the h+jubcdocutils.nodes emphasis r)r}r(hX*imklog*h }r(h"]h(]h$]h#]h)]uh+jh@]rhIXimklogrr}r(hUh+jubah8UemphasisrubhIXI input plug-in. So rsyslog is a full replacement for the sysklogd packagerr}r(hXI input plug-in. So rsyslog is a full replacement for the sysklogd packageh+jubeubaubh,)r}r(hXsupport for IPv6rh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KMh@]rhIXsupport for IPv6rr}r(hjh+jubaubaubh,)r}r(hXiability to control repeated line reduction ("last message repeated n times") on a per selector-line basish+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXiability to control repeated line reduction ("last message repeated n times") on a per selector-line basisrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KNh@]rhIXiability to control repeated line reduction ("last message repeated n times") on a per selector-line basisrr}r(hjh+jubaubaubh,)r}r(hXsupports sub-configuration files, which can be automatically read from directories. Includes are specified in the main configuration fileh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXsupports sub-configuration files, which can be automatically read from directories. Includes are specified in the main configuration filerh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KPh@]rhIXsupports sub-configuration files, which can be automatically read from directories. Includes are specified in the main configuration filerr}r(hjh+jubaubaubh,)r}r(hX7supports multiple actions per selector/filter conditionrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KSh@]rhIX7supports multiple actions per selector/filter conditionrr}r(hjh+jubaubaubh,)r}r(hXFMySQL and Postgres SQL functionality as a dynamically loadable plug-inh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXFMySQL and Postgres SQL functionality as a dynamically loadable plug-inrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KTh@]rhIXFMySQL and Postgres SQL functionality as a dynamically loadable plug-inrr}r(hjh+jubaubaubh,)r}r(hXLmodular design for inputs and outputs - easily extensible via custom pluginsh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXLmodular design for inputs and outputs - easily extensible via custom pluginsrh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KVh@]rhIXLmodular design for inputs and outputs - easily extensible via custom pluginsrr}r(hjh+jubaubaubh,)r }r (hX$an easy-to-write to plugin interfacer h+hh7h'h8hh }r (h"]h(]h$]h#]h)]uh>Nh?hh@]r hM)r}r(hj h+j h7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KXh@]rhIX$an easy-to-write to plugin interfacerr}r(hj h+jubaubaubh,)r}r(hX"ability to send SNMP trap messagesrh+hh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hjh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>KYh@]rhIX"ability to send SNMP trap messagesrr}r (hjh+jubaubaubh,)r!}r"(hX;ability to filter out messages based on sequence of arrivalr#h+hh7h'h8hh }r$(h"]h(]h$]h#]h)]uh>Nh?hh@]r%hM)r&}r'(hj#h+j!h7h'h8hPh }r((h"]h(]h$]h#]h)]uh>KZh@]r)hIX;ability to filter out messages based on sequence of arrivalr*r+}r,(hj#h+j&ubaubaubh,)r-}r.(hXsupport for comma-separated-values (CSV) output generation (via the "csv" property replace option). The CSV format supported is that from RFC 4180.h+hh7h'h8hh }r/(h"]h(]h$]h#]h)]uh>Nh?hh@]r0hM)r1}r2(hXsupport for comma-separated-values (CSV) output generation (via the "csv" property replace option). The CSV format supported is that from RFC 4180.r3h+j-h7h'h8hPh }r4(h"]h(]h$]h#]h)]uh>K[h@]r5hIXsupport for comma-separated-values (CSV) output generation (via the "csv" property replace option). The CSV format supported is that from RFC 4180.r6r7}r8(hj3h+j1ubaubaubh,)r9}r:(hX\support for arbitrary complex boolean, string and arithmetic expressions in message filters h+hh7h'h8hh }r;(h"]h(]h$]h#]h)]uh>Nh?hh@]r<hM)r=}r>(hX[support for arbitrary complex boolean, string and arithmetic expressions in message filtersr?h+j9h7h'h8hPh }r@(h"]h(]h$]h#]h)]uh>K^h@]rAhIX[support for arbitrary complex boolean, string and arithmetic expressions in message filtersrBrC}rD(hj?h+j=ubaubaubeubeubh2)rE}rF(hUh+h5h7h'h8h9h }rG(h"]h(]h$]h#]rHU world-s-firstrIah)]rJh auh>Kbh?hh@]rK(hB)rL}rM(hX World's firstrNh+jEh7h'h8hFh }rO(h"]h(]h$]h#]h)]uh>Kbh?hh@]rPhIX World's firstrQrR}rS(hjNh+jLubaubhM)rT}rU(hXRsyslog has an interesting number of "world's firsts" - things that were implemented for the first time ever in rsyslog. Some of them are still features not available elsewhere.rVh+jEh7h'h8hPh }rW(h"]h(]h$]h#]h)]uh>Kdh?hh@]rXhIXRsyslog has an interesting number of "world's firsts" - things that were implemented for the first time ever in rsyslog. Some of them are still features not available elsewhere.rYrZ}r[(hjVh+jTubaubh/)r\}r](hUh+jEh7h'h8hh }r^(hX-h#]h$]h"]h(]h)]uh>Khh?hh@]r_(h,)r`}ra(hXoworld's first implementation of IETF I-D syslog-protocol (February 2006, version 1.12.2 and above), now RFC5424h+j\h7h'h8hh }rb(h"]h(]h$]h#]h)]uh>Nh?hh@]rchM)rd}re(hXoworld's first implementation of IETF I-D syslog-protocol (February 2006, version 1.12.2 and above), now RFC5424rfh+j`h7h'h8hPh }rg(h"]h(]h$]h#]h)]uh>Khh@]rhhIXoworld's first implementation of IETF I-D syslog-protocol (February 2006, version 1.12.2 and above), now RFC5424rirj}rk(hjfh+jdubaubaubh,)rl}rm(hXpworld's first implementation of dynamic syslog on-the-wire compression (December 2006, version 1.13.0 and above)h+j\h7h'h8hh }rn(h"]h(]h$]h#]h)]uh>Nh?hh@]rohM)rp}rq(hXpworld's first implementation of dynamic syslog on-the-wire compression (December 2006, version 1.13.0 and above)rrh+jlh7h'h8hPh }rs(h"]h(]h$]h#]h)]uh>Kjh@]rthIXpworld's first implementation of dynamic syslog on-the-wire compression (December 2006, version 1.13.0 and above)rurv}rw(hjrh+jpubaubaubh,)rx}ry(hXlworld's first open-source implementation of a disk-queueing syslogd (January 2008, version 3.11.0 and above)h+j\h7h'h8hh }rz(h"]h(]h$]h#]h)]uh>Nh?hh@]r{hM)r|}r}(hXlworld's first open-source implementation of a disk-queueing syslogd (January 2008, version 3.11.0 and above)r~h+jxh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Klh@]rhIXlworld's first open-source implementation of a disk-queueing syslogd (January 2008, version 3.11.0 and above)rr}r(hj~h+j|ubaubaubh,)r}r(hXcworld's first implementation of IETF I-D syslog-transport-tls (May 2008, version 3.19.0 and above) h+j\h7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXbworld's first implementation of IETF I-D syslog-transport-tls (May 2008, version 3.19.0 and above)rh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Knh@]rhIXbworld's first implementation of IETF I-D syslog-transport-tls (May 2008, version 3.19.0 and above)rr}r(hjh+jubaubaubeubeubh3eubh7h'h8h9h }r(h"]h(]h$]h#]rUupcoming-featuresrah)]rhauh>Krh?hh@]r(hB)r}r(hXUpcoming Featuresrh+h3h7h'h8hFh }r(h"]h(]h$]h#]h)]uh>Krh?hh@]rhIXUpcoming Featuresrr}r(hjh+jubaubhM)r}r(hXThe list below is something like a repository of ideas we'd like to implement. Features on this list are typically NOT scheduled for immediate inclusion.rh+h3h7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kth?hh@]rhIXThe list below is something like a repository of ideas we'd like to implement. Features on this list are typically NOT scheduled for immediate inclusion.rr}r(hjh+jubaubhM)r}r(hX<**Note that we also maintain a `list of features that are looking for sponsors `_. If you are interested in any of these features, or any other feature, you may consider sponsoring the implementation. This is also a great way to show your commitment to the open source community. Plus, it can be financially attractive: just think about how much less it may be to sponsor a feature instead of purchasing a commercial implementation. Also, the benefit of being recognised as a sponsor may even drive new customers to your business!**rh+h3h7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kxh?hh@]rhS)r}r(hjh }r(h"]h(]h$]h#]h)]uh+jh@]rhIX8Note that we also maintain a `list of features that are looking for sponsors `_. If you are interested in any of these features, or any other feature, you may consider sponsoring the implementation. This is also a great way to show your commitment to the open source community. Plus, it can be financially attractive: just think about how much less it may be to sponsor a feature instead of purchasing a commercial implementation. Also, the benefit of being recognised as a sponsor may even drive new customers to your business!rr}r(hUh+jubah8h[ubaubh0hM)r}r(hXvTo see when each feature was added, see the `rsyslog change log `_ (online only).h+h3h7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kh?hh@]r(hIX,To see when each feature was added, see the rr}r(hX,To see when each feature was added, see the h+jubh_)r}r(hX;`rsyslog change log `_h }r(UnameXrsyslog change loghcX#http://www.rsyslog.com/Topic4.phtmlrh#]h$]h"]h(]h)]uh+jh@]rhIXrsyslog change logrr}r(hUh+jubah8hiubhj)r}r(hX& hmKh+jh8hnh }r(Urefurijh#]rUrsyslog-change-lograh$]h"]h(]h)]rhauh@]ubhIX (online only).rr}r(hX (online only).h+jubeubeubh7h'h8hh }r(hX-h#]h$]h"]h(]h)]uh>Kh?hh@]r(h,)r}r(hXuport it to more \*nix variants (eg AIX and HP UX) - this needs volunteers with access to those machines and knowledgeh+h0h7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXuport it to more \*nix variants (eg AIX and HP UX) - this needs volunteers with access to those machines and knowledgeh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kh@]rhIXtport it to more *nix variants (eg AIX and HP UX) - this needs volunteers with access to those machines and knowledgerr}r(hXuport it to more \*nix variants (eg AIX and HP UX) - this needs volunteers with access to those machines and knowledgeh+jubaubaubh,)r}r(hXpcre filtering - maybe (depending on feedback)  - simple regex already partly added. So far, this seems sufficient so that there is no urgent need to do pcre. If done, it will be a loadable RainerScript function.h+h0h7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXpcre filtering - maybe (depending on feedback)  - simple regex already partly added. So far, this seems sufficient so that there is no urgent need to do pcre. If done, it will be a loadable RainerScript function.rh+jh7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kh@]rhIXpcre filtering - maybe (depending on feedback)  - simple regex already partly added. So far, this seems sufficient so that there is no urgent need to do pcre. If done, it will be a loadable RainerScript function.rr}r(hjh+jubaubaubh-eubh7h'h8hh }r(h"]h(]h$]h#]h)]uh>Nh?hh@]rhM)r}r(hXIsupport for `RFC 3195 `_ as a sender - this is currently unlikely to happen, because there is no real demand for it. Any work on RFC 3195 has been suspend until we see some real interest in it.  It is probably much better to use TCP-based syslog, which is interoperable with a large number of applications. You may also read my blog post on the future of liblogging, which contains interesting information about the `future of RFC 3195 in rsyslog `_.h+h-h7h'h8hPh }r(h"]h(]h$]h#]h)]uh>Kh@]r(hIX support for rr}r(hX support for h+jubh_)r}r(hXG`RFC 3195 `_h }r(UnameXRFC 3195hcX9http://www.monitorware.com/Common/en/glossary/rfc3195.phprh#]h$]h"]h(]h)]uh+jh@]rhIXRFC 3195rr}r(hUh+jubah8hiubhj)r}r(hX< hmKh+jh8hnh }r(Urefurijh#]rh&ah$]h"]rXrfc 3195rah(]h)]uh@]ubhIX as a sender - this is currently unlikely to happen, because there is no real demand for it. Any work on RFC 3195 has been suspend until we see some real interest in it.  It is probably much better to use TCP-based syslog, which is interoperable with a large number of applications. You may also read my blog post on the future of liblogging, which contains interesting information about the rr}r(hX as a sender - this is currently unlikely to happen, because there is no real demand for it. Any work on RFC 3195 has been suspend until we see some real interest in it.  It is probably much better to use TCP-based syslog, which is interoperable with a large number of applications. You may also read my blog post on the future of liblogging, which contains interesting information about the h+jubh_)r}r(hXl`future of RFC 3195 in rsyslog `_h }r(UnameXfuture of RFC 3195 in rsysloghcXIhttp://rgerhards.blogspot.com/2007/09/where-is-liblogging-heading-to.htmlrh#]h$]h"]h(]h)]uh+jh@]rhIXfuture of RFC 3195 in rsyslogrr}r(hUh+jubah8hiubhj)r}r(hXL hmKh+jh8hnh }r(Urefurijh#]rUfuture-of-rfc-3195-in-rsyslograh$]h"]h(]h)]r hauh@]ubhIX.r }r (hX.h+jubeubaubh@]r hM)r }r(hX+Duplicate explicit target name: "rfc 3195".h }r(h"]h(]h$]h#]h)]uh+hh@]rhIX+Duplicate explicit target name: "rfc 3195".rr}r(hUh+j ubah8hPubah8Usystem_messagerubaUcurrent_sourcerNU decorationrNUautofootnote_startrKUnameidsr}r(hhhj1hhUentryr?U language_coder@UenrAU datestamprBNU report_levelrCKU _destinationrDNU halt_levelrEKU strip_classesrFNhFNUerror_encoding_error_handlerrGUbackslashreplacerHUdebugrINUembed_stylesheetrJUoutput_encoding_error_handlerrKUstrictrLU sectnum_xformrMKUdump_transformsrNNU docinfo_xformrOKUwarning_streamrPNUpep_file_url_templaterQUpep-%04drRUexit_status_levelrSKUconfigrTNUstrict_visitorrUNUcloak_email_addressesrVUtrim_footnote_reference_spacerWUenvrXNUdump_pseudo_xmlrYNUexpose_internalsrZNUsectsubtitle_xformr[U source_linkr\NUrfc_referencesr]NUoutput_encodingr^Uutf-8r_U source_urlr`NUinput_encodingraU utf-8-sigrbU_disable_configrcNU id_prefixrdUU tab_widthreKUerror_encodingrfUUTF-8rgU_sourcerhh'Ugettext_compactriU generatorrjNUdump_internalsrkNU smart_quotesrlU pep_base_urlrmU https://www.python.org/dev/peps/rnUsyntax_highlightroUlongrpUinput_encoding_error_handlerrqjLUauto_id_prefixrrUidrsUdoctitle_xformrtUstrip_elements_with_classesruNU _config_filesrv]Ufile_insertion_enabledrwU raw_enabledrxKU dump_settingsryNubUsymbol_footnote_startrzKUidsr{}r|(jh3j1j-hhjjjjhh~h&jjIjEhhh}q?(h XThis chapter complements rsyslog's documentation of :doc:`rulesets <../concepts/multi_ruleset>`. While the base document focusses on RainerScript format, it does not provide samples in legacy format. These are included in this document.h!hh"h#h$U paragraphq@h&}qA(h(]h)]h*]h+]h-]uh/Kh0hh]qB(h9X4This chapter complements rsyslog's documentation of qCqD}qE(h X4This chapter complements rsyslog's documentation of h!h>ubcsphinx.addnodes pending_xref qF)qG}qH(h X+:doc:`rulesets <../concepts/multi_ruleset>`qIh!h>h"h#h$U pending_xrefqJh&}qK(UreftypeXdocqLUrefwarnqMU reftargetqNX../concepts/multi_rulesetU refdomainUh+]h*]U refexplicith(]h)]h-]UrefdocqOX.historical/multi_ruleset_legacy_format_samplesqPuh/Kh]qQcdocutils.nodes literal qR)qS}qT(h hIh&}qU(h(]h)]qV(UxrefqWhLeh*]h+]h-]uh!hGh]qXh9XrulesetsqYqZ}q[(h Uh!hSubah$Uliteralq\ubaubh9X. While the base document focusses on RainerScript format, it does not provide samples in legacy format. These are included in this document.q]q^}q_(h X. While the base document focusses on RainerScript format, it does not provide samples in legacy format. These are included in this document.h!h>ubeubh=)q`}qa(h X**Important:** do **not** use legacy ruleset defintions for new configurations. Especially with rulesets, legacy format is extremely hard to get right. The information in this page is included in order to help you understand already existing configurations using the ruleset feature. We even recommend to convert any such configs to RainerScript format because of its increased robustness and simplicity.h!hh"h#h$h@h&}qb(h(]h)]h*]h+]h-]uh/K h0hh]qc(cdocutils.nodes strong qd)qe}qf(h X**Important:**h&}qg(h(]h)]h*]h+]h-]uh!h`h]qhh9X Important:qiqj}qk(h Uh!heubah$Ustrongqlubh9X do qmqn}qo(h X do h!h`ubhd)qp}qq(h X**not**h&}qr(h(]h)]h*]h+]h-]uh!h`h]qsh9Xnotqtqu}qv(h Uh!hpubah$hlubh9X{ use legacy ruleset defintions for new configurations. Especially with rulesets, legacy format is extremely hard to get right. The information in this page is included in order to help you understand already existing configurations using the ruleset feature. We even recommend to convert any such configs to RainerScript format because of its increased robustness and simplicity.qwqx}qy(h X{ use legacy ruleset defintions for new configurations. Especially with rulesets, legacy format is extremely hard to get right. The information in this page is included in order to help you understand already existing configurations using the ruleset feature. We even recommend to convert any such configs to RainerScript format because of its increased robustness and simplicity.h!h`ubeubh=)qz}q{(h XKLegacy ruleset support was available starting with version 4.5.0 and 5.1.1.q|h!hh"h#h$h@h&}q}(h(]h)]h*]h+]h-]uh/Kh0hh]q~h9XKLegacy ruleset support was available starting with version 4.5.0 and 5.1.1.qq}q(h h|h!hzubaubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qhauh/Kh0hh]q(h2)q}q(h XSplit local and remote loggingqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XSplit local and remote loggingqq}q(h hh!hubaubh=)q}q(h XLet's say you have a pretty standard system that logs its local messages to the usual bunch of files that are specified in the default rsyslog.conf. As an example, your rsyslog.conf might look like this:qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XLet's say you have a pretty standard system that logs its local messages to the usual bunch of files that are specified in the default rsyslog.conf. As an example, your rsyslog.conf might look like this:qq}q(h hh!hubaubcdocutils.nodes literal_block q)q}q(h X# ... module loading ... # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...h!hh"h#h$U literal_blockqh&}q(U xml:spaceqUpreserveqh+]h*]h(]h)]h-]uh/Kh0hh]qh9X# ... module loading ... # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...qq}q(h Uh!hubaubh=)q}q(h X-Now, you want to add receive messages from a remote system and log these to a special file, but you do not want to have these messages written to the files specified above. The traditional approach is to add a rule in front of all others that filters on the message, processes it and then discards it:qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/K)h0hh]qh9X-Now, you want to add receive messages from a remote system and log these to a special file, but you do not want to have these messages written to the files specified above. The traditional approach is to add a rule in front of all others that filters on the message, processes it and then discards it:qq}q(h hh!hubaubh)q}q(h X # ... module loading ... # process remote messages :fromhost-ip, isequal, "192.0.2.1" /var/log/remotefile & ~ # only messages not from 192.0.21 make it past this point # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...h!hh"h#h$hh&}q(hhh+]h*]h(]h)]h-]uh/K1h0hh]qh9X # ... module loading ... # process remote messages :fromhost-ip, isequal, "192.0.2.1" /var/log/remotefile & ~ # only messages not from 192.0.21 make it past this point # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...qq}q(h Uh!hubaubh=)q}q(h XNote the tilde character, which is the discard action!. Also note that we assume that 192.0.2.1 is the sole remote sender (to keep it simple).qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/KAh0hh]qh9XNote the tilde character, which is the discard action!. Also note that we assume that 192.0.2.1 is the sole remote sender (to keep it simple).qq}q(h hh!hubaubh=)q}q(h XWith multiple rulesets, we can simply define a dedicated ruleset for the remote reception case and bind it to the receiver. This may be written as follows:qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/KDh0hh]qh9XWith multiple rulesets, we can simply define a dedicated ruleset for the remote reception case and bind it to the receiver. This may be written as follows:qq}q(h hh!hubaubh)q}q(h X}# ... module loading ... # process remote messages # define new ruleset and add rules to it: $RuleSet remote *.* /var/log/remotefile # only messages not from 192.0.21 make it past this point # bind ruleset to tcp listener $InputTCPServerBindRuleset remote # and activate it: $InputTCPServerRun 10514 # switch back to the default ruleset: $RuleSet RSYSLOG_DefaultRuleset # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...h!hh"h#h$hh&}q(hhh+]h*]h(]h)]h-]uh/KJh0hh]qh9X}# ... module loading ... # process remote messages # define new ruleset and add rules to it: $RuleSet remote *.* /var/log/remotefile # only messages not from 192.0.21 make it past this point # bind ruleset to tcp listener $InputTCPServerBindRuleset remote # and activate it: $InputTCPServerRun 10514 # switch back to the default ruleset: $RuleSet RSYSLOG_DefaultRuleset # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ...qƅq}q(h Uh!hubaubh=)q}q(h XHere, we need to switch back to the default ruleset after we have defined our custom one. This is why I recommend a different ordering, which I find more intuitive. The sample below has it, and it leads to the same results:qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kbh0hh]qh9XHere, we need to switch back to the default ruleset after we have defined our custom one. This is why I recommend a different ordering, which I find more intuitive. The sample below has it, and it leads to the same results:q΅q}q(h hh!hubaubh)q}q(h Xz# ... module loading ... # at first, this is a copy of the unmodified rsyslog.conf # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ... # end of the "regular" rsyslog.conf. Now come the new definitions: # process remote messages # define new ruleset and add rules to it: $RuleSet remote *.* /var/log/remotefile # bind ruleset to tcp listener $InputTCPServerBindRuleset remote # and activate it: $InputTCPServerRun 10514h!hh"h#h$hh&}q(hhh+]h*]h(]h)]h-]uh/Kih0hh]qh9Xz# ... module loading ... # at first, this is a copy of the unmodified rsyslog.conf # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ... # end of the "regular" rsyslog.conf. Now come the new definitions: # process remote messages # define new ruleset and add rules to it: $RuleSet remote *.* /var/log/remotefile # bind ruleset to tcp listener $InputTCPServerBindRuleset remote # and activate it: $InputTCPServerRun 10514qՅq}q(h Uh!hubaubh=)q}q(h XHere, we do not switch back to the default ruleset, because this is not needed as it is completely defined when we begin the "remote" ruleset.qh!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XHere, we do not switch back to the default ruleset, because this is not needed as it is completely defined when we begin the "remote" ruleset.q݅q}q(h hh!hubaubh=)q}q(h XnNow look at the examples and compare them to the single-ruleset solution. You will notice that we do **not** need a real filter in the multi-ruleset case: we can simply use "\*.\*" as all messages now means all messages that are being processed by this rule set and all of them come in via the TCP receiver! This is what makes using multiple rulesets so much easier.h!hh"h#h$h@h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]q(h9XeNow look at the examples and compare them to the single-ruleset solution. You will notice that we do q䅁q}q(h XeNow look at the examples and compare them to the single-ruleset solution. You will notice that we do h!hubhd)q}q(h X**not**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9Xnotq녁q}q(h Uh!hubah$hlubh9X need a real filter in the multi-ruleset case: we can simply use "*.*" as all messages now means all messages that are being processed by this rule set and all of them come in via the TCP receiver! This is what makes using multiple rulesets so much easier.qq}q(h X need a real filter in the multi-ruleset case: we can simply use "\*.\*" as all messages now means all messages that are being processed by this rule set and all of them come in via the TCP receiver! This is what makes using multiple rulesets so much easier.h!hubeubeubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qh auh/Kh0hh]q(h2)q}q(h X8Split local and remote logging for three different portsqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9X8Split local and remote logging for three different portsqq}q(h hh!hubaubh=)q}r(h XThis example is almost like the first one, but it extends it a little bit. While it is very similar, I hope it is different enough to provide a useful example why you may want to have more than two rulesets.rh!hh"h#h$h@h&}r(h(]h)]h*]h+]h-]uh/Kh0hh]rh9XThis example is almost like the first one, but it extends it a little bit. While it is very similar, I hope it is different enough to provide a useful example why you may want to have more than two rulesets.rr}r(h jh!hubaubh=)r}r(h XAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.\*" priority, shall be written into a specif file and **not** be written to 10516's general log file.h!hh"h#h$h@h&}r (h(]h)]h*]h+]h-]uh/Kh0hh]r (h9XAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.*" priority, shall be written into a specif file and r r }r (h XAgain, we would like to use the "regular" log files for local logging, only. But this time we set up three syslog/tcp listeners, each one listening to a different port (in this example 10514, 10515, and 10516). Logs received from these receivers shall go into different files. Also, logs received from 10516 (and only from that port!) with "mail.\*" priority, shall be written into a specif file and h!jubhd)r}r(h X**not**h&}r(h(]h)]h*]h+]h-]uh!jh]rh9Xnotrr}r(h Uh!jubah$hlubh9X( be written to 10516's general log file.rr}r(h X( be written to 10516's general log file.h!jubeubh=)r}r(h XThis is the config:rh!hh"h#h$h@h&}r(h(]h)]h*]h+]h-]uh/Kh0hh]rh9XThis is the config:rr}r(h jh!jubaubh)r }r!(h X# ... module loading ... # at first, this is a copy of the unmodified rsyslog.conf # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ... # end of the "regular" rsyslog.conf. Now come the new definitions: # process remote messages #define rulesets first $RuleSet remote10514 *.* /var/log/remote10514 $RuleSet remote10515 *.* /var/log/remote10515 $RuleSet remote10516 mail.* /var/log/mail10516 & ~ # note that the discard-action will prevent this messag from # being written to the remote10516 file - as usual... *.* /var/log/remote10516 # and now define listeners bound to the relevant ruleset $InputTCPServerBindRuleset remote10514 $InputTCPServerRun 10514 $InputTCPServerBindRuleset remote10515 $InputTCPServerRun 10515 $InputTCPServerBindRuleset remote10516 $InputTCPServerRun 10516h!hh"h#h$hh&}r"(hhh+]h*]h(]h)]h-]uh/Kh0hh]r#h9X# ... module loading ... # at first, this is a copy of the unmodified rsyslog.conf # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* /var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * ... more ... # end of the "regular" rsyslog.conf. Now come the new definitions: # process remote messages #define rulesets first $RuleSet remote10514 *.* /var/log/remote10514 $RuleSet remote10515 *.* /var/log/remote10515 $RuleSet remote10516 mail.* /var/log/mail10516 & ~ # note that the discard-action will prevent this messag from # being written to the remote10516 file - as usual... *.* /var/log/remote10516 # and now define listeners bound to the relevant ruleset $InputTCPServerBindRuleset remote10514 $InputTCPServerRun 10514 $InputTCPServerBindRuleset remote10515 $InputTCPServerRun 10515 $InputTCPServerBindRuleset remote10516 $InputTCPServerRun 10516r$r%}r&(h Uh!j ubaubh=)r'}r((h XNote that the "mail.\*" rule inside the "remote10516" ruleset does not affect processing inside any other rule set, including the default rule set.h!hh"h#h$h@h&}r)(h(]h)]h*]h+]h-]uh/Kh0hh]r*h9XNote that the "mail.*" rule inside the "remote10516" ruleset does not affect processing inside any other rule set, including the default rule set.r+r,}r-(h XNote that the "mail.\*" rule inside the "remote10516" ruleset does not affect processing inside any other rule set, including the default rule set.h!j'ubaubh=)r.}r/(h XThis documentation is part of the `rsyslog `_ project. Copyright © 2009-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.h!hh"h#h$h@h&}r0(h(]h)]h*]h+]h-]uh/Kh0hh]r1(h9X"This documentation is part of the r2r3}r4(h X"This documentation is part of the h!j.ubcdocutils.nodes reference r5)r6}r7(h X$`rsyslog `_h&}r8(Unameh Urefurir9Xhttp://www.rsyslog.com/r:h+]h*]h(]h)]h-]uh!j.h]r;h9Xrsyslogr<r=}r>(h Uh!j6ubah$U referencer?ubcdocutils.nodes target r@)rA}rB(h X U referencedrCKh!j.h$UtargetrDh&}rE(Urefurij:h+]rFhah*]h(]h)]h-]rGh auh]ubh9X$ project. Copyright © 2009-2014 by rHrI}rJ(h X$ project. Copyright © 2009-2014 by h!j.ubj5)rK}rL(h X3`Rainer Gerhards `_h&}rM(UnameXRainer Gerhardsj9Xhttp://www.gerhards.net/rainerrNh+]h*]h(]h)]h-]uh!j.h]rOh9XRainer GerhardsrPrQ}rR(h Uh!jKubah$j?ubj@)rS}rT(h X! jCKh!j.h$jDh&}rU(UrefurijNh+]rVhah*]h(]h)]h-]rWhauh]ubh9X and rXrY}rZ(h X and h!j.ubj5)r[}r\(h X$`Adiscon `_h&}r](UnameXAdisconj9Xhttp://www.adiscon.com/r^h+]h*]h(]h)]h-]uh!j.h]r_h9XAdisconr`ra}rb(h Uh!j[ubah$j?ubj@)rc}rd(h X jCKh!j.h$jDh&}re(Urefurij^h+]rfhah*]h(]h)]h-]rgh auh]ubh9X1. Released under the GNU GPL version 3 or higher.rhri}rj(h X1. Released under the GNU GPL version 3 or higher.h!j.ubeubeubeubah UU transformerrkNU footnote_refsrl}rmUrefnamesrn}roUsymbol_footnotesrp]rqUautofootnote_refsrr]rsUsymbol_footnote_refsrt]ruU citationsrv]rwh0hU current_linerxNUtransform_messagesry]rzUreporterr{NUid_startr|KU autofootnotesr}]r~U citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh6NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhjchhhjAhhhjSuUsubstitution_namesr}rh$h0h&}r(h(]h+]h*]Usourceh#h)]h-]uU footnotesr]rUrefidsr}rub.build/.doctrees/historical/php_syslog_ng.doctree0000664000175000017500000011334013035122643021111 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$http://www.gnu.org/copyleft/fdl.htmlqXabstractqNXadisconqXmysqlq Xrsyslogdq X copyrightq NXrainer gerhardsq X syslog-ngq X demo serverqXadiscon loganalyzerqX conclusionqNX let me knowqXrevision historyqNX rsyslog.confqXfeedback requestedqNX writing syslog messages to mysqlqX"references and additional materialqNXsetting up the systemqNX!rsyslogd property replacer manualqXoverall system setupqNX using php-syslog-ng with rsyslogqNXmonitorware familyqX php-syslog-ngquUsubstitution_defsq}qUparse_messagesq]q (cdocutils.nodes system_message q!)q"}q#(U rawsourceq$UUparentq%cdocutils.nodes section q&)q'}q((h$Uh%h&)q)}q*(h$Uh%hUsourceq+X?/home/rger/proj/rsyslog-doc/source/historical/php_syslog_ng.rstq,Utagnameq-Usectionq.U attributesq/}q0(Udupnamesq1]Uclassesq2]Ubackrefsq3]Uidsq4]q5U using-php-syslog-ng-with-rsyslogq6aUnamesq7]q8hauUlineq9KUdocumentq:hUchildrenq;]q<(cdocutils.nodes title q=)q>}q?(h$X Using php-syslog-ng with rsyslogq@h%h)h+h,h-UtitleqAh/}qB(h1]h2]h3]h4]h7]uh9Kh:hh;]qCcdocutils.nodes Text qDX Using php-syslog-ng with rsyslogqEqF}qG(h$h@h%h>ubaubcdocutils.nodes paragraph qH)qI}qJ(h$Xe*Written by* `Rainer Gerhards `_ *(2005-08-04)*h%h)h+h,h-U paragraphqKh/}qL(h1]h2]h3]h4]h7]uh9Kh:hh;]qM(cdocutils.nodes emphasis qN)qO}qP(h$X *Written by*h/}qQ(h1]h2]h3]h4]h7]uh%hIh;]qRhDX Written byqSqT}qU(h$Uh%hOubah-UemphasisqVubhDX qW}qX(h$X h%hIubcdocutils.nodes reference qY)qZ}q[(h$XI`Rainer Gerhards `_h/}q\(UnameXRainer GerhardsUrefuriq]X4http://www.adiscon.com/en/people/rainer-gerhards.phpq^h4]h3]h1]h2]h7]uh%hIh;]q_hDXRainer Gerhardsq`qa}qb(h$Uh%hZubah-U referenceqcubcdocutils.nodes target qd)qe}qf(h$X7 U referencedqgKh%hIh-Utargetqhh/}qi(Urefurih^h4]qjUrainer-gerhardsqkah3]h1]h2]h7]qlh auh;]ubhDX qm}qn(h$X h%hIubhN)qo}qp(h$X*(2005-08-04)*h/}qq(h1]h2]h3]h4]h7]uh%hIh;]qrhDX (2005-08-04)qsqt}qu(h$Uh%houbah-hVubeubhH)qv}qw(h$XNote: it has been reported that this guide is somewhat outdated. Most importantly, this guide is for the **original** php-syslog-ng and **cannot** be used for it successor logzilla. Please use the guide with care. Also, please note that **rsyslog's "native" web frontend is** `Adiscon LogAnalyzer `_, which provides best integration and a lot of extra functionality.h%h)h+h,h-hKh/}qx(h1]h2]h3]h4]h7]uh9Kh:hh;]qy(hDXiNote: it has been reported that this guide is somewhat outdated. Most importantly, this guide is for the qzq{}q|(h$XiNote: it has been reported that this guide is somewhat outdated. Most importantly, this guide is for the h%hvubcdocutils.nodes strong q})q~}q(h$X **original**h/}q(h1]h2]h3]h4]h7]uh%hvh;]qhDXoriginalqq}q(h$Uh%h~ubah-UstrongqubhDX php-syslog-ng and qq}q(h$X php-syslog-ng and h%hvubh})q}q(h$X **cannot**h/}q(h1]h2]h3]h4]h7]uh%hvh;]qhDXcannotqq}q(h$Uh%hubah-hubhDX[ be used for it successor logzilla. Please use the guide with care. Also, please note that qq}q(h$X[ be used for it successor logzilla. Please use the guide with care. Also, please note that h%hvubh})q}q(h$X&**rsyslog's "native" web frontend is**h/}q(h1]h2]h3]h4]h7]uh%hvh;]qhDX"rsyslog's "native" web frontend isqq}q(h$Uh%hubah-hubhDX q}q(h$X h%hvubhY)q}q(h$X1`Adiscon LogAnalyzer `_h/}q(UnameXAdiscon LogAnalyzerh]Xhttp://www.phplogcon.orgqh4]h3]h1]h2]h7]uh%hvh;]qhDXAdiscon LogAnalyzerqq}q(h$Uh%hubah-hcubhd)q}q(h$X hgKh%hvh-hhh/}q(Urefurihh4]qUadiscon-loganalyzerqah3]h1]h2]h7]qhauh;]ubhDXC, which provides best integration and a lot of extra functionality.qq}q(h$XC, which provides best integration and a lot of extra functionality.h%hvubeubh&)q}q(h$Uh%h)h+h,h-h.h/}q(h1]h2]h3]h4]qUabstractqah7]qhauh9Kh:hh;]q(h=)q}q(h$XAbstractqh%hh+h,h-hAh/}q(h1]h2]h3]h4]h7]uh9Kh:hh;]qhDXAbstractqq}q(h$hh%hubaubhH)q}q(h$X**In this paper, I describe how to use** `php-syslog-ng `_ **with** `rsyslogd `_. Php-syslog-ng is a popular web interface to syslog data. Its name stem from the fact that it usually picks up its data from a database created by `syslog-ng `_ and some helper scripts. However, there is nothing syslog-ng specific in the database. With rsyslogd's high customizability, it is easy to write to a syslog-ng like schema. I will tell you how to do this, enabling you to use php-syslog-ng as a front-end for rsyslogd - or save the hassle with syslog-ng database configuration and simply go ahead and use rsyslogd instead.*h%hh+h,h-hKh/}q(h1]h2]h3]h4]h7]uh9Kh:hh;]q(h})q}q(h$X(**In this paper, I describe how to use**h/}q(h1]h2]h3]h4]h7]uh%hh;]qhDX$In this paper, I describe how to useqąq}q(h$Uh%hubah-hubhDX q}q(h$X h%hubhY)q}q(h$X@`php-syslog-ng `_h/}q(Unamehh]X-http://www.vermeer.org/projects/php-syslog-ngqh4]h3]h1]h2]h7]uh%hh;]qhDX php-syslog-ngq΅q}q(h$Uh%hubah-hcubhd)q}q(h$X0 hgKh%hh-hhh/}q(Urefurihh4]qU php-syslog-ngqah3]h1]h2]h7]qhauh;]ubhDX q}q(h$X h%hubh})q}q(h$X**with**h/}q(h1]h2]h3]h4]h7]uh%hh;]qhDXwithq݅q}q(h$Uh%hubah-hubhDX q}q(h$X h%hubhY)q}q(h$X%`rsyslogd `_h/}q(Unameh h]Xhttp://www.rsyslog.com/qh4]h3]h1]h2]h7]uh%hh;]qhDXrsyslogdq煁q}q(h$Uh%hubah-hcubhd)q}q(h$X hgKh%hh-hhh/}q(Urefurihh4]qUrsyslogdqah3]h1]h2]h7]qh auh;]ubhDX. Php-syslog-ng is a popular web interface to syslog data. Its name stem from the fact that it usually picks up its data from a database created by qq}q(h$X. Php-syslog-ng is a popular web interface to syslog data. Its name stem from the fact that it usually picks up its data from a database created by h%hubhY)q}q(h$X9`syslog-ng `_h/}q(Unameh h]X*http://www.balabit.com/products/syslog_ng/qh4]h3]h1]h2]h7]uh%hh;]qhDX syslog-ngqq}q(h$Uh%hubah-hcubhd)q}q(h$X- hgKh%hh-hhh/}q(Urefurihh4]qU syslog-ngqah3]h1]h2]h7]rh auh;]ubhDXu and some helper scripts. However, there is nothing syslog-ng specific in the database. With rsyslogd's high customizability, it is easy to write to a syslog-ng like schema. I will tell you how to do this, enabling you to use php-syslog-ng as a front-end for rsyslogd - or save the hassle with syslog-ng database configuration and simply go ahead and use rsyslogd instead.*rr}r(h$Xu and some helper scripts. However, there is nothing syslog-ng specific in the database. With rsyslogd's high customizability, it is easy to write to a syslog-ng like schema. I will tell you how to do this, enabling you to use php-syslog-ng as a front-end for rsyslogd - or save the hassle with syslog-ng database configuration and simply go ahead and use rsyslogd instead.*h%hubeubeubh&)r}r(h$Uh%h)h+h,h-h.h/}r(h1]h2]h3]h4]rUoverall-system-setuprah7]r hauh9K h:hh;]r (h=)r }r (h$XOverall System Setupr h%jh+h,h-hAh/}r(h1]h2]h3]h4]h7]uh9K h:hh;]rhDXOverall System Setuprr}r(h$j h%j ubaubhH)r}r(h$XThe setup is pretty straightforward. Basically, php-syslog-ng's interface to the syslogd is the database. We use the schema that php-syslog-ng expects and make rsyslogd write to it in its format. Because of this, php-syslog-ng does not even know there is no syslog-ng present.rh%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9K"h:hh;]rhDXThe setup is pretty straightforward. Basically, php-syslog-ng's interface to the syslogd is the database. We use the schema that php-syslog-ng expects and make rsyslogd write to it in its format. Because of this, php-syslog-ng does not even know there is no syslog-ng present.rr}r(h$jh%jubaubeubh&)r}r(h$Uh%h)h+h,h-h.h/}r(h1]h2]h3]h4]rUsetting-up-the-systemrah7]r hauh9K)h:hh;]r!(h=)r"}r#(h$XSetting up the systemr$h%jh+h,h-hAh/}r%(h1]h2]h3]h4]h7]uh9K)h:hh;]r&hDXSetting up the systemr'r(}r)(h$j$h%j"ubaubhH)r*}r+(h$X For php-syslog-ng, you can follow its usual setup instructions. Just skip any steps refering to configure syslog-ng. Make sure you create the database schema in `MySQL `_. As of this writing, the expected schema can be created via this script:h%jh+h,h-hKh/}r,(h1]h2]h3]h4]h7]uh9K+h:hh;]r-(hDXFor php-syslog-ng, you can follow its usual setup instructions. Just skip any steps refering to configure syslog-ng. Make sure you create the database schema in r.r/}r0(h$XFor php-syslog-ng, you can follow its usual setup instructions. Just skip any steps refering to configure syslog-ng. Make sure you create the database schema in h%j*ubhY)r1}r2(h$X `MySQL `_h/}r3(UnameXMySQLh]Xhttp://www.mysql.com/r4h4]h3]h1]h2]h7]uh%j*h;]r5hDXMySQLr6r7}r8(h$Uh%j1ubah-hcubhd)r9}r:(h$X hgKh%j*h-hhh/}r;(Urefurij4h4]r<Umysqlr=ah3]h1]h2]h7]r>h auh;]ubhDXI. As of this writing, the expected schema can be created via this script:r?r@}rA(h$XI. As of this writing, the expected schema can be created via this script:h%j*ubeubcdocutils.nodes literal_block rB)rC}rD(h$XbCREATE DATABASE syslog USE syslog CREATE TABLE logs(host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility ) TYPE=MyISAM;``h%jh+h,h-U literal_blockrEh/}rF(U xml:spacerGUpreserverHh4]h3]h1]h2]h7]uh9K2h:hh;]rIhDXbCREATE DATABASE syslog USE syslog CREATE TABLE logs(host varchar(32) default NULL, facility varchar(10) default NULL, priority varchar(10) default NULL, level varchar(10) default NULL, tag varchar(10) default NULL, date date default NULL, time time default NULL, program varchar(15) default NULL, msg text, seq int(10) unsigned NOT NULL auto_increment, PRIMARY KEY (seq), KEY host (host), KEY seq (seq), KEY program (program), KEY time (time), KEY date (date), KEY priority (priority), KEY facility (facility ) TYPE=MyISAM;``rJrK}rL(h$Uh%jCubaubhH)rM}rN(h$XPlease note that at the time you are reading this paper, the schema might have changed. Check for any differences. As we customize rsyslogd to the schema, it is vital to have the correct one. If this paper is outdated, `let me know `_ so that I can fix it.h%jh+h,h-hKh/}rO(h1]h2]h3]h4]h7]uh9KIh:hh;]rP(hDXPlease note that at the time you are reading this paper, the schema might have changed. Check for any differences. As we customize rsyslogd to the schema, it is vital to have the correct one. If this paper is outdated, rQrR}rS(h$XPlease note that at the time you are reading this paper, the schema might have changed. Check for any differences. As we customize rsyslogd to the schema, it is vital to have the correct one. If this paper is outdated, h%jMubhY)rT}rU(h$X-`let me know `_h/}rV(UnameX let me knowh]Xmailto:rgerhards@adiscon.comrWh4]h3]h1]h2]h7]uh%jMh;]rXhDX let me knowrYrZ}r[(h$Uh%jTubah-hcubhd)r\}r](h$X hgKh%jMh-hhh/}r^(UrefurijWh4]r_U let-me-knowr`ah3]h1]h2]h7]rahauh;]ubhDX so that I can fix it.rbrc}rd(h$X so that I can fix it.h%jMubeubhH)re}rf(h$XOnce this schema is created, we simply instruct rsyslogd to store received data in it. I wont go into too much detail here. If you are interested in some more details, you might find my paper "`Writing syslog messages to MySQL `_\ " worth reading. For this article, we simply modify `rsyslog.conf `_\ so that it writes to the database. That is easy. Just these two lines are needed:h%jh+h,h-hKh/}rg(h1]h2]h3]h4]h7]uh9KOh:hh;]rh(hDXOnce this schema is created, we simply instruct rsyslogd to store received data in it. I wont go into too much detail here. If you are interested in some more details, you might find my paper "rirj}rk(h$XOnce this schema is created, we simply instruct rsyslogd to store received data in it. I wont go into too much detail here. If you are interested in some more details, you might find my paper "h%jeubhY)rl}rm(h$X8`Writing syslog messages to MySQL `_h/}rn(UnameX Writing syslog messages to MySQLh]Xrsyslog_mysql.htmlroh4]h3]h1]h2]h7]uh%jeh;]rphDX Writing syslog messages to MySQLrqrr}rs(h$Uh%jlubah-hcubhd)rt}ru(h$X hgKh%jeh-hhh/}rv(Urefurijoh4]rwU writing-syslog-messages-to-mysqlrxah3]h1]h2]h7]ryhauh;]ubhDX4" worth reading. For this article, we simply modify rzr{}r|(h$X6\ " worth reading. For this article, we simply modify h%jeubhY)r}}r~(h$X#`rsyslog.conf `_h/}r(Unamehh]Xrsyslog_conf.htmlrh4]h3]h1]h2]h7]uh%jeh;]rhDX rsyslog.confrr}r(h$Uh%j}ubah-hcubhd)r}r(h$X hgKh%jeh-hhh/}r(Urefurijh4]rU rsyslog-confrah3]h1]h2]h7]rhauh;]ubhDXQso that it writes to the database. That is easy. Just these two lines are needed:rr}r(h$XS\ so that it writes to the database. That is easy. Just these two lines are needed:h%jeubeubjB)r}r(h$X)$template syslog-ng,"insert into logs(host, facility, priority, tag, date, time, msg) values ('%HOSTNAME%', %syslogfacility%, %syslogpriority%, '%syslogtag%', '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%msg%')", SQL *.*,           mysql-server,syslog,user,pass;syslog-ngh%jh+h,h-jEh/}r(jGjHh4]h3]h1]h2]h7]uh9KYh:hh;]rhDX)$template syslog-ng,"insert into logs(host, facility, priority, tag, date, time, msg) values ('%HOSTNAME%', %syslogfacility%, %syslogpriority%, '%syslogtag%', '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%msg%')", SQL *.*,           mysql-server,syslog,user,pass;syslog-ngrr}r(h$Uh%jubaubhH)r}r(h$XThese are just **two** lines. I have color-coded them so that you see what belongs together (the colors have no other meaning). The green line is the actual SQL statement being used to take care of the syslog-ng schema. Rsyslogd allows you to fully control the statement sent to the database. This allows you to write to any database format, including your homegrown one (if you so desire). Please note that there is a small inefficiency in our current usage: the ``'%timereported:::date-mysql%'`` property is used for both the time and the date (if you wonder about what all these funny characters mean, see the `rsyslogd property replacer manual `_) . We could have extracted just the date and time parts of the respective properties. However, this is more complicated and also adds processing time to rsyslogd's processing (substrings must be extracted). So we take a full mysql-formatted timestamp and supply it to MySQL. The sql engine in turn discards the unneeded part. It works pretty well. As of my understanding, the inefficiency of discarding the unneeded part in MySQL is lower than the effciency gain from using the full timestamp in rsyslogd. So it is most probably the best solution.h%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9K\h:hh;]r(hDXThese are just rr}r(h$XThese are just h%jubh})r}r(h$X**two**h/}r(h1]h2]h3]h4]h7]uh%jh;]rhDXtworr}r(h$Uh%jubah-hubhDX lines. I have color-coded them so that you see what belongs together (the colors have no other meaning). The green line is the actual SQL statement being used to take care of the syslog-ng schema. Rsyslogd allows you to fully control the statement sent to the database. This allows you to write to any database format, including your homegrown one (if you so desire). Please note that there is a small inefficiency in our current usage: the rr}r(h$X lines. I have color-coded them so that you see what belongs together (the colors have no other meaning). The green line is the actual SQL statement being used to take care of the syslog-ng schema. Rsyslogd allows you to fully control the statement sent to the database. This allows you to write to any database format, including your homegrown one (if you so desire). Please note that there is a small inefficiency in our current usage: the h%jubcdocutils.nodes literal r)r}r(h$X!``'%timereported:::date-mysql%'``h/}r(h1]h2]h3]h4]h7]uh%jh;]rhDX'%timereported:::date-mysql%'rr}r(h$Uh%jubah-UliteralrubhDXt property is used for both the time and the date (if you wonder about what all these funny characters mean, see the rr}r(h$Xt property is used for both the time and the date (if you wonder about what all these funny characters mean, see the h%jubhY)r}r(h$X=`rsyslogd property replacer manual `_h/}r(UnameX!rsyslogd property replacer manualh]Xproperty_replacer.htmlrh4]h3]h1]h2]h7]uh%jh;]rhDX!rsyslogd property replacer manualrr}r(h$Uh%jubah-hcubhd)r}r(h$X hgKh%jh-hhh/}r(Urefurijh4]rU!rsyslogd-property-replacer-manualrah3]h1]h2]h7]rhauh;]ubhDX$) . We could have extracted just the date and time parts of the respective properties. However, this is more complicated and also adds processing time to rsyslogd's processing (substrings must be extracted). So we take a full mysql-formatted timestamp and supply it to MySQL. The sql engine in turn discards the unneeded part. It works pretty well. As of my understanding, the inefficiency of discarding the unneeded part in MySQL is lower than the effciency gain from using the full timestamp in rsyslogd. So it is most probably the best solution.rr}r(h$X$) . We could have extracted just the date and time parts of the respective properties. However, this is more complicated and also adds processing time to rsyslogd's processing (substrings must be extracted). So we take a full mysql-formatted timestamp and supply it to MySQL. The sql engine in turn discards the unneeded part. It works pretty well. As of my understanding, the inefficiency of discarding the unneeded part in MySQL is lower than the effciency gain from using the full timestamp in rsyslogd. So it is most probably the best solution.h%jubeubhH)r}r(h$XBPlease note that rsyslogd knows two different timestamp properties: one is timereported, used here. It is the timestamp from the message itself. Sometimes that is a good choice, in other cases not. It depends on your environment. The other one is the timegenerated property. This is the time when rsyslogd received the message. For obvious reasons, that timestamp is consistent, even when your devices are in multiple time zones or their clocks are off. However, it is not "the real thing". It's your choice which one you prefer. If you prefer timegenerated ... simply use it ;)rh%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kph:hh;]rhDXBPlease note that rsyslogd knows two different timestamp properties: one is timereported, used here. It is the timestamp from the message itself. Sometimes that is a good choice, in other cases not. It depends on your environment. The other one is the timegenerated property. This is the time when rsyslogd received the message. For obvious reasons, that timestamp is consistent, even when your devices are in multiple time zones or their clocks are off. However, it is not "the real thing". It's your choice which one you prefer. If you prefer timegenerated ... simply use it ;)rr}r(h$jh%jubaubhH)r}r(h$XrThe line in red tells rsyslogd which messages to log and where to store it. The "\*.\*" selects all messages. You can use standard syslog selector line filters here if you do not like to see everything in your database. The ">" tells rsyslogd that a MySQL connection must be established. Then, "mysql-server" is the name or IP address of the server machine, "syslog" is the database name (default from the schema) and "user" and "pass" are the logon credentials. Use a user with low privileges, insert into the logs table is sufficient. "syslog-ng" is the template name and tells rsyslogd to use the SQL statement shown above.h%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kzh:hh;]rhDXpThe line in red tells rsyslogd which messages to log and where to store it. The "*.*" selects all messages. You can use standard syslog selector line filters here if you do not like to see everything in your database. The ">" tells rsyslogd that a MySQL connection must be established. Then, "mysql-server" is the name or IP address of the server machine, "syslog" is the database name (default from the schema) and "user" and "pass" are the logon credentials. Use a user with low privileges, insert into the logs table is sufficient. "syslog-ng" is the template name and tells rsyslogd to use the SQL statement shown above.rr}r(h$XrThe line in red tells rsyslogd which messages to log and where to store it. The "\*.\*" selects all messages. You can use standard syslog selector line filters here if you do not like to see everything in your database. The ">" tells rsyslogd that a MySQL connection must be established. Then, "mysql-server" is the name or IP address of the server machine, "syslog" is the database name (default from the schema) and "user" and "pass" are the logon credentials. Use a user with low privileges, insert into the logs table is sufficient. "syslog-ng" is the template name and tells rsyslogd to use the SQL statement shown above.h%jubaubhH)r}r(h$XOnce you have made the changes, all you need to do is restart rsyslogd. Then, you should see syslog messages flow into your database - and show up in php-syslog-ng.rh%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]rhDXOnce you have made the changes, all you need to do is restart rsyslogd. Then, you should see syslog messages flow into your database - and show up in php-syslog-ng.rr}r(h$jh%jubaubeubh&)r}r(h$Uh%h)h+h,h-h.h/}r(h1]h2]h3]h4]rU conclusionrah7]rhauh9Kh:hh;]r(h=)r}r(h$X Conclusionrh%jh+h,h-hAh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]rhDX Conclusionrr}r(h$jh%jubaubhH)r}r(h$XWith minumal effort, you can use php-syslog-ng together with rsyslogd. For those unfamiliar with syslog-ng, this configuration is probably easier to set up then switching to syslog-ng. For existing rsyslogd users, php-syslog-ng might be a nice add-on to their logging infrastructure.rh%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]rhDXWith minumal effort, you can use php-syslog-ng together with rsyslogd. For those unfamiliar with syslog-ng, this configuration is probably easier to set up then switching to syslog-ng. For existing rsyslogd users, php-syslog-ng might be a nice add-on to their logging infrastructure.rr}r(h$jh%jubaubhH)r}r(h$XPlease note that the `MonitorWare family `_ (to which rsyslog belongs) also offers a web-interface: `Adiscon LogAnalyzer`_. From my point of view, obviously, **phpLogCon is the more natural choice for a web interface to be used together with rsyslog**. It also offers superb functionality and provides, for example,native display of Windows event log entries. I have set up a `demo server `_., You can have a peek at it without installing anything.h%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]r(hDXPlease note that the rr}r(h$XPlease note that the h%jubhY)r}r(h$X6`MonitorWare family `_h/}r(UnameXMonitorWare familyh]Xhttp://www.monitorware.com/en/rh4]h3]h1]h2]h7]uh%jh;]rhDXMonitorWare familyrr}r(h$Uh%jubah-hcubhd)r}r(h$X! hgKh%jh-hhh/}r(Urefurijh4]rUmonitorware-familyrah3]h1]h2]h7]rhauh;]ubhDX9 (to which rsyslog belongs) also offers a web-interface: rr}r(h$X9 (to which rsyslog belongs) also offers a web-interface: h%jubhY)r }r (h$X`Adiscon LogAnalyzer`_Uresolvedr Kh%jh-hch/}r (UnameXAdiscon LogAnalyzerh]hh4]h3]h1]h2]h7]uh;]r hDXAdiscon LogAnalyzerrr}r(h$Uh%j ubaubhDX$. From my point of view, obviously, rr}r(h$X$. From my point of view, obviously, h%jubh})r}r(h$X]**phpLogCon is the more natural choice for a web interface to be used together with rsyslog**h/}r(h1]h2]h3]h4]h7]uh%jh;]rhDXYphpLogCon is the more natural choice for a web interface to be used together with rsyslogrr}r(h$Uh%jubah-hubhDX}. It also offers superb functionality and provides, for example,native display of Windows event log entries. I have set up a rr}r(h$X}. It also offers superb functionality and provides, for example,native display of Windows event log entries. I have set up a h%jubhY)r}r(h$X+`demo server `_h/}r (UnameX demo serverh]Xhttp://demo.phplogcon.org/r!h4]h3]h1]h2]h7]uh%jh;]r"hDX demo serverr#r$}r%(h$Uh%jubah-hcubhd)r&}r'(h$X hgKh%jh-hhh/}r((Urefurij!h4]r)U demo-serverr*ah3]h1]h2]h7]r+hauh;]ubhDX9., You can have a peek at it without installing anything.r,r-}r.(h$X9., You can have a peek at it without installing anything.h%jubeubeubh'h&)r/}r0(h$Uh%h)h+h,h-h.h/}r1(h1]h2]h3]h4]r2U"references-and-additional-materialr3ah7]r4hauh9Kh:hh;]r5(h=)r6}r7(h$X"References and Additional Materialr8h%j/h+h,h-hAh/}r9(h1]h2]h3]h4]h7]uh9Kh:hh;]r:hDX"References and Additional Materialr;r<}r=(h$j8h%j6ubaubcdocutils.nodes bullet_list r>)r?}r@(h$Uh%j/h+h,h-U bullet_listrAh/}rB(UbulletrCX-h4]h3]h1]h2]h7]uh9Kh:hh;]rDcdocutils.nodes list_item rE)rF}rG(h$XA`php-syslog-ng `_ h%j?h+h,h-U list_itemrHh/}rI(h1]h2]h3]h4]h7]uh9Nh:hh;]rJhH)rK}rL(h$X@`php-syslog-ng `_rMh%jFh+h,h-hKh/}rN(h1]h2]h3]h4]h7]uh9Kh;]rO(hY)rP}rQ(h$jMh/}rR(UnameX php-syslog-ngrSh]X-http://www.vermeer.org/projects/php-syslog-ngrTh4]h3]h1]h2]h7]uh%jKh;]rUhDX php-syslog-ngrVrW}rX(h$Uh%jPubah-hcubhd)rY}rZ(h$X0 hgKh%jKh-hhh/}r[(UrefurijTh4]r\Uid2r]ah3]h1]r^jSah2]h7]uh;]ubeubaubaubeubh&)r_}r`(h$Uh%h)h+h,h-h.h/}ra(h1]h2]h3]h4]rbUrevision-historyrcah7]rdhauh9Kh:hh;]re(h=)rf}rg(h$XRevision Historyrhh%j_h+h,h-hAh/}ri(h1]h2]h3]h4]h7]uh9Kh:hh;]rjhDXRevision Historyrkrl}rm(h$jhh%jfubaubj>)rn}ro(h$Uh%j_h+h,h-jAh/}rp(jCX-h4]h3]h1]h2]h7]uh9Kh:hh;]rqjE)rr}rs(h$Xs2005-08-04 \* `Rainer Gerhards `_ \* initial version created h%jnh+h,h-jHh/}rt(h1]h2]h3]h4]h7]uh9Nh:hh;]ruhH)rv}rw(h$Xr2005-08-04 \* `Rainer Gerhards `_ \* initial version createdh%jrh+h,h-hKh/}rx(h1]h2]h3]h4]h7]uh9Kh;]ry(hDX 2005-08-04 * rzr{}r|(h$X2005-08-04 \* h%jvubhY)r}}r~(h$XI`Rainer Gerhards `_h/}r(UnameXRainer Gerhardsh]X4http://www.adiscon.com/en/people/rainer-gerhards.phprh4]h3]h1]h2]h7]uh%jvh;]rhDXRainer Gerhardsrr}r(h$Uh%j}ubah-hcubhd)r}r(h$X7 hgKh%jvh-hhh/}r(Urefurijh4]rUid3rah3]h1]rXrainer gerhardsrah2]h7]uh;]ubhDX * initial version createdrr}r(h$X \* initial version createdh%jvubeubaubaubeubh&)r}r(h$Uh%h)h+h,h-h.h/}r(h1]h2]h3]h4]rU copyrightrah7]rh auh9Kh:hh;]r(h=)r}r(h$X Copyrightrh%jh+h,h-hAh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]rhDX Copyrightrr}r(h$jh%jubaubhH)r}r(h$XCopyright (c) 2005 `Rainer Gerhards `_ and `Adiscon `_.h%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]r(hDXCopyright (c) 2005 rr}r(h$XCopyright (c) 2005 h%jubhY)r}r(h$XI`Rainer Gerhards `_h/}r(UnameXRainer Gerhardsh]X4http://www.adiscon.com/en/people/rainer-gerhards.phprh4]h3]h1]h2]h7]uh%jh;]rhDXRainer Gerhardsrr}r(h$Uh%jubah-hcubhd)r}r(h$X7 hgKh%jh-hhh/}r(Urefurijh4]rUid4rah3]h1]rXrainer gerhardsrah2]h7]uh;]ubhDX and rr}r(h$X and h%jubhY)r}r(h$X'`Adiscon `_h/}r(UnameXAdisconh]Xhttp://www.adiscon.com/en/rh4]h3]h1]h2]h7]uh%jh;]rhDXAdisconrr}r(h$Uh%jubah-hcubhd)r}r(h$X hgKh%jh-hhh/}r(Urefurijh4]rUadisconrah3]h1]h2]h7]rhauh;]ubhDX.r}r(h$X.h%jubeubhH)r}r(h$XPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.h%jh+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]r(hDX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at rr}r(h$X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at h%jubhY)r}r(h$XN`http://www.gnu.org/copyleft/fdl.html `_h/}r(Unamehh]X$http://www.gnu.org/copyleft/fdl.htmlrh4]h3]h1]h2]h7]uh%jh;]rhDX$http://www.gnu.org/copyleft/fdl.htmlrr}r(h$Uh%jubah-hcubhd)r}r(h$X' hgKh%jh-hhh/}r(Urefurijh4]rU"http-www-gnu-org-copyleft-fdl-htmlrah3]h1]h2]h7]rhauh;]ubhDX.r}r(h$X.h%jubeubeubeubh+h,h-h.h/}r(h1]h2]h3]h4]rUfeedback-requestedrah7]rhauh9Kh:hh;]r(h=)r}r(h$XFeedback Requestedrh%h'h+h,h-hAh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]rhDXFeedback Requestedrr}r(h$jh%jubaubhH)r}r(h$XI would appreciate feedback on this paper. If you have additional ideas, comments or find bugs, please `let me know `_.h%h'h+h,h-hKh/}r(h1]h2]h3]h4]h7]uh9Kh:hh;]r(hDXgI would appreciate feedback on this paper. If you have additional ideas, comments or find bugs, please rr}r(h$XgI would appreciate feedback on this paper. If you have additional ideas, comments or find bugs, please h%jubhY)r}r(h$X-`let me know `_h/}r(UnameX let me knowh]Xmailto:rgerhards@adiscon.comrh4]h3]h1]h2]h7]uh%jh;]rhDX let me knowrr}r(h$Uh%jubah-hcubhd)r}r(h$X hgKh%jh-hhh/}r(Urefurijh4]rUid1rah3]h1]rX let me knowrah2]h7]uh;]ubhDX.r}r(h$X.h%jubeubeubh+h,h-Usystem_messagerh/}r(h1]UlevelKh4]h3]rjaUsourceh,h2]h7]UlineKUtypeUINFOruh9Kh:hh;]rhH)r}r (h$X.Duplicate explicit target name: "let me know".h/}r (h1]h2]h3]h4]h7]uh%h"h;]r hDX.Duplicate explicit target name: "let me know".r r }r(h$Uh%jubah-hKubaubh!)r}r(h$Uh/}r(h1]UlevelKh4]h3]rj]aUsourceh,h2]h7]UlineKUtypejuh%jFh;]rhH)r}r(h$X0Duplicate explicit target name: "php-syslog-ng".h/}r(h1]h2]h3]h4]h7]uh%jh;]rhDX0Duplicate explicit target name: "php-syslog-ng".rr}r(h$Uh%jubah-hKubah-jubh!)r}r(h$Uh/}r(h1]UlevelKh4]h3]rjaUsourceh,h2]h7]UlineKUtypejuh%jrh;]rhH)r }r!(h$X2Duplicate explicit target name: "rainer gerhards".h/}r"(h1]h2]h3]h4]h7]uh%jh;]r#hDX2Duplicate explicit target name: "rainer gerhards".r$r%}r&(h$Uh%j ubah-hKubah-jubh!)r'}r((h$Uh%jh+h,h-jh/}r)(h1]UlevelKh4]h3]r*jaUsourceh,h2]h7]UlineKUtypejuh9Kh:hh;]r+hH)r,}r-(h$X2Duplicate explicit target name: "rainer gerhards".h/}r.(h1]h2]h3]h4]h7]uh%j'h;]r/hDX2Duplicate explicit target name: "rainer gerhards".r0r1}r2(h$Uh%j,ubah-hKubaubeUcurrent_sourcer3NU decorationr4NUautofootnote_startr5KUnameidsr6}r7(hjhhhjh j=h hh jh hkh hhj*hhhjhj`hjchjhjhjxhj3hjhjhjhh6hjhhuh;]r8h)ah$UU transformerr9NU footnote_refsr:}r;Urefnamesr<}r=Xadiscon loganalyzer]r>j asUsymbol_footnotesr?]r@Uautofootnote_refsrA]rBUsymbol_footnote_refsrC]rDU citationsrE]rFh:hU current_linerGNUtransform_messagesrH]rIUreporterrJNUid_startrKKU autofootnotesrL]rMU citation_refsrN}rOUindirect_targetsrP]rQUsettingsrR(cdocutils.frontend Values rSorT}rU(Ufootnote_backlinksrVKUrecord_dependenciesrWNU rfc_base_urlrXUhttps://tools.ietf.org/html/rYU tracebackrZUpep_referencesr[NUstrip_commentsr\NU toc_backlinksr]Uentryr^U language_coder_Uenr`U datestampraNU report_levelrbKU _destinationrcNU halt_levelrdKU strip_classesreNhANUerror_encoding_error_handlerrfUbackslashreplacergUdebugrhNUembed_stylesheetriUoutput_encoding_error_handlerrjUstrictrkU sectnum_xformrlKUdump_transformsrmNU docinfo_xformrnKUwarning_streamroNUpep_file_url_templaterpUpep-%04drqUexit_status_levelrrKUconfigrsNUstrict_visitorrtNUcloak_email_addressesruUtrim_footnote_reference_spacervUenvrwNUdump_pseudo_xmlrxNUexpose_internalsryNUsectsubtitle_xformrzU source_linkr{NUrfc_referencesr|NUoutput_encodingr}Uutf-8r~U source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh,Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjkUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(jjjcj_j*j&j]jYhhjjjjjjj=j9hhhhj3j/jjjjhhjjjjjh'jjjxjtjjh6h)jjjjj`j\hhhkheuUsubstitution_namesr}rh-h:h/}r(h1]h4]h3]Usourceh,h2]h7]uU footnotesr]rUrefidsr}rub.build/.doctrees/historical/module_devel.doctree0000664000175000017500000005230713035122643020707 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xnaming conventionsqNXmodule securityqNX copyrightqNXsourceq NXaction selectorsq NXoverviewq NX rainer's blogq Xadisconq Xmodule "generation"qNXGhttp://www.rsyslog.com/index.php?name=pnphpbb2&file=viewtopic&p=678#678qX%developing rsyslog modules (outdated)qNXrainer gerhardsqX$http://www.gnu.org/copyleft/fdl.htmlquUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUnaming-conventionsqhUmodule-securityqhU copyrightqh Usourceqh Uaction-selectorsq h Uoverviewq!h U rainer-s-blogq"h Uadisconq#hUmodule-generationq$hUEhttp-www-rsyslog-com-index-php-name-pnphpbb2-file-viewtopic-p-678-678q%hU#developing-rsyslog-modules-outdatedq&hUrainer-gerhardsq'hU"http-www-gnu-org-copyleft-fdl-htmlq(uUchildrenq)]q*cdocutils.nodes section q+)q,}q-(U rawsourceq.UUparentq/hUsourceq0X>/home/rger/proj/rsyslog-doc/source/historical/module_devel.rstq1Utagnameq2Usectionq3U attributesq4}q5(Udupnamesq6]Uclassesq7]Ubackrefsq8]Uidsq9]q:h&aUnamesq;]qhh)]q?(cdocutils.nodes title q@)qA}qB(h.X%Developing rsyslog modules (outdated)qCh/h,h0h1h2UtitleqDh4}qE(h6]h7]h8]h9]h;]uh=Kh>hh)]qFcdocutils.nodes Text qGX%Developing rsyslog modules (outdated)qHqI}qJ(h.hCh/hAubaubcdocutils.nodes paragraph qK)qL}qM(h.Xe*Written by `Rainer Gerhards* `_ *(2007-07-28)*h/h,h0h1h2U paragraphqNh4}qO(h6]h7]h8]h9]h;]uh=Kh>hh)]qP(cdocutils.nodes emphasis qQ)qR}qS(h.X*Written by `Rainer Gerhards*h4}qT(h6]h7]h8]h9]h;]uh/hLh)]qUhGXWritten by `Rainer GerhardsqVqW}qX(h.Uh/hRubah2UemphasisqYubhGX `_ qgqh}qi(h.X>`_ h/hLubhQ)qj}qk(h.X*(2007-07-28)*h4}ql(h6]h7]h8]h9]h;]uh/hLh)]qmhGX (2007-07-28)qnqo}qp(h.Uh/hjubah2hYubeubhK)qq}qr(h.X**This document is outdated and primarily contains historical information. Do not trust it to build code. It currently is under review.**qsh/h,h0h1h2hNh4}qt(h6]h7]h8]h9]h;]uh=Kh>hh)]qucdocutils.nodes strong qv)qw}qx(h.hsh4}qy(h6]h7]h8]h9]h;]uh/hqh)]qzhGXThis document is outdated and primarily contains historical information. Do not trust it to build code. It currently is under review.q{q|}q}(h.Uh/hwubah2Ustrongq~ubaubhK)q}q(h.XThis document is incomplete. The module interface is also quite incomplete and under development. Do not currently use it! You may want to visit `Rainer's blog `_ to learn what's going on.h/h,h0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=K h>hh)]q(hGXThis document is incomplete. The module interface is also quite incomplete and under development. Do not currently use it! You may want to visit qq}q(h.XThis document is incomplete. The module interface is also quite incomplete and under development. Do not currently use it! You may want to visit h/hubh])q}q(h.X1`Rainer's blog `_h4}q(UnameX Rainer's blogUrefuriqXhttp://rgerhards.blogspot.com/qh9]h8]h6]h7]h;]uh/hh)]qhGX Rainer's blogqq}q(h.Uh/hubah2hfubcdocutils.nodes target q)q}q(h.X! U referencedqKh/hh2Utargetqh4}q(Urefurihh9]qh"ah8]h6]h7]h;]qh auh)]ubhGX to learn what's going on.qq}q(h.X to learn what's going on.h/hubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qh!ah;]qh auh=Kh>hh)]q(h@)q}q(h.XOverviewqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXOverviewqq}q(h.hh/hubaubhK)q}q(h.XIn theory, modules provide input and output, among other functions, in rsyslog. In practice, modules are only utilized for output in the current release. The module interface is not yet completed and a moving target. We do not recommend to write a module based on the current specification. If you do, please be prepared that future released of rsyslog will probably break your module.qh/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXIn theory, modules provide input and output, among other functions, in rsyslog. In practice, modules are only utilized for output in the current release. The module interface is not yet completed and a moving target. We do not recommend to write a module based on the current specification. If you do, please be prepared that future released of rsyslog will probably break your module.qq}q(h.hh/hubaubhK)q}q(h.XA goal of modularization is to provide an easy to use plug-in interface. However, this goal is not yet reached and all modules must be statically linked.qh/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXA goal of modularization is to provide an easy to use plug-in interface. However, this goal is not yet reached and all modules must be statically linked.qq}q(h.hh/hubaubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qh$ah;]qhauh=K h>hh)]q(h@)q}q(h.XModule "generation"qh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=K h>hh)]qhGXModule "generation"qÅq}q(h.hh/hubaubhK)q}q(h.XmThere is a lot of plumbing that is always the same in all modules. For example, the interface definitions, answering function pointer queries and such. To get rid of these laborious things, I generate most of them automatically from a single file. This file is named module-template.h. It also contains the current best description of the interface "specification".qh/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=K"h>hh)]qhGXmThere is a lot of plumbing that is always the same in all modules. For example, the interface definitions, answering function pointer queries and such. To get rid of these laborious things, I generate most of them automatically from a single file. This file is named module-template.h. It also contains the current best description of the interface "specification".q˅q}q(h.hh/hubaubhK)q}q(h.XOne thing that can also be achieved with it is the capability to cope with a rapidly changing interface specification. The module interface is evolving. Currently, it is far from being finished. As I moved the monolithic code to modules, I needed (and still need) to make many "non-clean" code hacks, just to get it working. These things are now gradually being removed. However, this requires frequent changes to the interfaces, as things move in and out while working towards a clean interface. All the interim is necessary to reach the goal. This volatility of specifications is the number one reasons I currently advise against implementing your own modules (hint: if you do, be sure to use module-template.h and be prepared to fix newly appearing and disappearing data elements).qh/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=K)h>hh)]qhGXOne thing that can also be achieved with it is the capability to cope with a rapidly changing interface specification. The module interface is evolving. Currently, it is far from being finished. As I moved the monolithic code to modules, I needed (and still need) to make many "non-clean" code hacks, just to get it working. These things are now gradually being removed. However, this requires frequent changes to the interfaces, as things move in and out while working towards a clean interface. All the interim is necessary to reach the goal. This volatility of specifications is the number one reasons I currently advise against implementing your own modules (hint: if you do, be sure to use module-template.h and be prepared to fix newly appearing and disappearing data elements).qӅq}q(h.hh/hubaubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qhah;]qhauh=K7h>hh)]q(h@)q}q(h.XNaming Conventionsqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=K7h>hh)]qhGXNaming Conventionsqᅁq}q(h.hh/hubaubh+)q}q(h.Uh/hh0h1h2h3h4}q(h6]h7]h8]h9]qhah;]qh auh=K:h>hh)]q(h@)q}q(h.XSourceqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=K:h>hh)]qhGXSourceqq}q(h.hh/hubaubhK)q}q(h.XOutput modules, and only output modules, should start with a file name of "om" (e.g. "omfile.c", "omshell.c"). Similarly, input modules will use "im" and filter modules "fm". The third character shall not be a hyphen.qh/hh0h1h2hNh4}q(h6]h7]h8]h9]h;]uh=Khh)]qhGXOutput modules, and only output modules, should start with a file name of "om" (e.g. "omfile.c", "omshell.c"). Similarly, input modules will use "im" and filter modules "fm". The third character shall not be a hyphen.qq}q(h.hh/hubaubeubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qhah;]qhauh=KBh>hh)]q(h@)r}r(h.XModule Securityrh/hh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=KBh>hh)]rhGXModule Securityrr}r(h.jh/jubaubhK)r}r (h.XiModules are directly loaded into rsyslog's address space. As such, any module is provided a big level of trust. Please note that further module interfaces might provide a way to load a module into an isolated address space. This, however, is far from being completed. So the number one rule about module security is to run only code that you know you can trust.r h/hh0h1h2hNh4}r (h6]h7]h8]h9]h;]uh=KDh>hh)]r hGXiModules are directly loaded into rsyslog's address space. As such, any module is provided a big level of trust. Please note that further module interfaces might provide a way to load a module into an isolated address space. This, however, is far from being completed. So the number one rule about module security is to run only code that you know you can trust.r r}r(h.j h/jubaubhK)r}r(h.XTo minimize the security risks associated with modules, rsyslog provides only the most minimalistic access to data structures to its modules. For that reason, the output modules do not receive any direct pointers to the selector\_t structure, the syslogd action structures and - most importantly - the msg structure itself. Access to these structures would enable modules to access data that is none of their business, creating a potential security weakness.h/hh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=KKh>hh)]rhGXTo minimize the security risks associated with modules, rsyslog provides only the most minimalistic access to data structures to its modules. For that reason, the output modules do not receive any direct pointers to the selector_t structure, the syslogd action structures and - most importantly - the msg structure itself. Access to these structures would enable modules to access data that is none of their business, creating a potential security weakness.rr}r(h.XTo minimize the security risks associated with modules, rsyslog provides only the most minimalistic access to data structures to its modules. For that reason, the output modules do not receive any direct pointers to the selector\_t structure, the syslogd action structures and - most importantly - the msg structure itself. Access to these structures would enable modules to access data that is none of their business, creating a potential security weakness.h/jubaubhK)r}r(h.XNot having access to these structures also simplifies further queueing and error handling cases. As we do not need to provide e.g. full access to the msg object itself, we do not need to serialize and cache it. Instead, strings needed by the module are created by syslogd and then the final result is provided to the module. That, for example, means that in a queued case $NOW is the actual timestamp of when the message was processed, which may be even days before it being dequeued. Think about it: If we wouldn't cache the resulting string, $NOW would be the actual date if the action were suspended and messages queued for some time. That could potentially result in big confusion.rh/hh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=KSh>hh)]rhGXNot having access to these structures also simplifies further queueing and error handling cases. As we do not need to provide e.g. full access to the msg object itself, we do not need to serialize and cache it. Instead, strings needed by the module are created by syslogd and then the final result is provided to the module. That, for example, means that in a queued case $NOW is the actual timestamp of when the message was processed, which may be even days before it being dequeued. Think about it: If we wouldn't cache the resulting string, $NOW would be the actual date if the action were suspended and messages queued for some time. That could potentially result in big confusion.rr}r(h.jh/jubaubhK)r}r (h.XIt is thought that if an output module actually needs access to the while msg object, we will (then) introduce a way to serialize it (e.g. to XML) in the property replacer. Then, the output module can work with this serialized object. The key point is that output modules never deal directly with msg objects (and other internal structures). Besides security, this also greatly simplifies the job of the output module developer.r!h/hh0h1h2hNh4}r"(h6]h7]h8]h9]h;]uh=K^h>hh)]r#hGXIt is thought that if an output module actually needs access to the while msg object, we will (then) introduce a way to serialize it (e.g. to XML) in the property replacer. Then, the output module can work with this serialized object. The key point is that output modules never deal directly with msg objects (and other internal structures). Besides security, this also greatly simplifies the job of the output module developer.r$r%}r&(h.j!h/jubaubeubh+)r'}r((h.Uh/h,h0h1h2h3h4}r)(h6]h7]h8]h9]r*h ah;]r+h auh=Kgh>hh)]r,(h@)r-}r.(h.XAction Selectorsr/h/j'h0h1h2hDh4}r0(h6]h7]h8]h9]h;]uh=Kgh>hh)]r1hGXAction Selectorsr2r3}r4(h.j/h/j-ubaubhK)r5}r6(h.XModules (and rsyslog) need to know when they are called. For this, there must a an action identification in selector lines. There are two syntaxes: the single-character syntax, where a single characters identifies a module (e.g. "\*" for a wall message) and the modules designator syntax, where the module name is given between colons (e.g. ":ommysql:"). The single character syntax is depreciated and should not be used for new plugins.h/j'h0h1h2hNh4}r7(h6]h7]h8]h9]h;]uh=Kih>hh)]r8hGXModules (and rsyslog) need to know when they are called. For this, there must a an action identification in selector lines. There are two syntaxes: the single-character syntax, where a single characters identifies a module (e.g. "*" for a wall message) and the modules designator syntax, where the module name is given between colons (e.g. ":ommysql:"). The single character syntax is depreciated and should not be used for new plugins.r9r:}r;(h.XModules (and rsyslog) need to know when they are called. For this, there must a an action identification in selector lines. There are two syntaxes: the single-character syntax, where a single characters identifies a module (e.g. "\*" for a wall message) and the modules designator syntax, where the module name is given between colons (e.g. ":ommysql:"). The single character syntax is depreciated and should not be used for new plugins.h/j5ubaubhK)r<}r=(h.XcAn in-depth discussion of module designation in action selectors can be found in this forum thread:r>h/j'h0h1h2hNh4}r?(h6]h7]h8]h9]h;]uh=Kqh>hh)]r@hGXcAn in-depth discussion of module designation in action selectors can be found in this forum thread:rArB}rC(h.j>h/j<ubaubhK)rD}rE(h.X`http://www.rsyslog.com/index.php?name=PNphpBB2&file=viewtopic&p=678#678 `_rFh/j'h0h1h2hNh4}rG(h6]h7]h8]h9]h;]uh=Kth>hh)]rH(h])rI}rJ(h.jFh4}rK(UnameXGhttp://www.rsyslog.com/index.php?name=PNphpBB2&file=viewtopic&p=678#678hXGhttp://www.rsyslog.com/index.php?name=PNphpBB2&file=viewtopic&p=678#678rLh9]h8]h6]h7]h;]uh/jDh)]rMhGXGhttp://www.rsyslog.com/index.php?name=PNphpBB2&file=viewtopic&p=678#678rNrO}rP(h.Uh/jIubah2hfubh)rQ}rR(h.XJ hKh/jDh2hh4}rS(UrefurijLh9]rTh%ah8]h6]h7]h;]rUhauh)]ubeubeubh+)rV}rW(h.Uh/h,h0h1h2h3h4}rX(h6]h7]h8]h9]rYhah;]rZhauh=Kwh>hh)]r[(h@)r\}r](h.X Copyrightr^h/jVh0h1h2hDh4}r_(h6]h7]h8]h9]h;]uh=Kwh>hh)]r`hGX Copyrightrarb}rc(h.j^h/j\ubaubhK)rd}re(h.XCopyright (c) 2007 `Rainer Gerhards `_ and `Adiscon `_.h/jVh0h1h2hNh4}rf(h6]h7]h8]h9]h;]uh=Kyh>hh)]rg(hGXCopyright (c) 2007 rhri}rj(h.XCopyright (c) 2007 h/jdubh])rk}rl(h.XI`Rainer Gerhards `_h4}rm(UnameXRainer GerhardshX4http://www.adiscon.com/en/people/rainer-gerhards.phprnh9]h8]h6]h7]h;]uh/jdh)]rohGXRainer Gerhardsrprq}rr(h.Uh/jkubah2hfubh)rs}rt(h.X7 hKh/jdh2hh4}ru(Urefurijnh9]rvh'ah8]h6]h7]h;]rwhauh)]ubhGX and rxry}rz(h.X and h/jdubh])r{}r|(h.X'`Adiscon `_h4}r}(UnameXAdisconhXhttp://www.adiscon.com/en/r~h9]h8]h6]h7]h;]uh/jdh)]rhGXAdisconrr}r(h.Uh/j{ubah2hfubh)r}r(h.X hKh/jdh2hh4}r(Urefurij~h9]rh#ah8]h6]h7]h;]rh auh)]ubhGX.r}r(h.X.h/jdubeubhK)r}r(h.XPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.h/jVh0h1h2hNh4}r(h6]h7]h8]h9]h;]uh=K}h>hh)]r(hGX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at rr}r(h.X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at h/jubh])r}r(h.XN`http://www.gnu.org/copyleft/fdl.html `_h4}r(UnamehhX$http://www.gnu.org/copyleft/fdl.htmlrh9]h8]h6]h7]h;]uh/jh)]rhGX$http://www.gnu.org/copyleft/fdl.htmlrr}r(h.Uh/jubah2hfubh)r}r(h.X' hKh/jh2hh4}r(Urefurijh9]rh(ah8]h6]h7]h;]rhauh)]ubhGX.r}r(h.X.h/jubeubeubeubah.UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh>hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhDNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh1Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(h(jh%jQhhh$hh'jsh"hh&h,hhh#jhhh!hhjVh j'uUsubstitution_namesr}rh2h>h4}r(h6]h9]h8]Usourceh1h7]h;]uU footnotesr]rUrefidsr}rub.build/.doctrees/historical/index.doctree0000664000175000017500000000644313035122643017352 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXhistorical documentsqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUhistorical-documentsqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX7/home/rger/proj/rsyslog-doc/source/historical/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXHistorical Documentsq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XHistorical Documentsq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXThis part of the documentation set contains historical documents which are still of interest or may be useful in some more exotic environments.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XThis part of the documentation set contains historical documents which are still of interest or may be useful in some more exotic environments.q:q;}q<(hh6hh4ubaubcdocutils.nodes compound q=)q>}q?(hUhhhhhUcompoundq@h}qA(h]h]qBUtoctree-wrapperqCah ]h!]h#]uh%Nh&hh]qDcsphinx.addnodes toctree qE)qF}qG(hUhh>hhhUtoctreeqHh}qI(UnumberedqJKU includehiddenqKhXhistorical/indexqLUcaptionqMNUglobqNh!]h ]U titlesonlyqOh]h]h#]UentriesqP]qQ(NXhistorical/php_syslog_ngqRqSNXhistorical/stunnelqTqUNX.historical/multi_ruleset_legacy_format_samplesqVqWNXhistorical/module_develqXqYeUhiddenqZU includefilesq[]q\(hRhThVhXeUmaxdepthq]Kuh%Kh]ubaubeubahUU transformerq^NU footnote_refsq_}q`Urefnamesqa}qbUsymbol_footnotesqc]qdUautofootnote_refsqe]qfUsymbol_footnote_refsqg]qhU citationsqi]qjh&hU current_lineqkNUtransform_messagesql]qmUreporterqnNUid_startqoKU autofootnotesqp]qqU citation_refsqr}qsUindirect_targetsqt]quUsettingsqv(cdocutils.frontend Values qwoqx}qy(Ufootnote_backlinksqzKUrecord_dependenciesq{NU rfc_base_urlq|Uhttps://tools.ietf.org/html/q}U tracebackq~Upep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/historical/stunnel.doctree0000664000175000017500000016004213035122643017727 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xred hatqX$http://www.gnu.org/copyleft/fdl.htmlqXabstractqNX"ssl encrypting syslog with stunnelq NXstunnelq Xsyslogq Xdoneq NXrsyslogq X eventreporterqXrsyslogdqXsysklogdqX%http://www.stunnel.org/faq/certs.htmlqX copyrightqNXrainer gerhardsqX*rsyslog provides native tls/ssl encryptionqX conclusionqNX let me knowqX client setupqNXrfc 3195qXfeedback requestedqNXadisconqX backgroundqNXrevision historyqNXsecuring syslog with tlsqXdebianqXipsecqXsetting up the systemq NX>preventing systems from talking directly to the rsyslog serverq!NXoverall system setupq"NX server setupq#NuUsubstitution_defsq$}q%Uparse_messagesq&]q'cdocutils.nodes system_message q()q)}q*(U rawsourceq+UUparentq,cdocutils.nodes section q-)q.}q/(h+Uh,h-)q0}q1(h+Uh,h-)q2}q3(h+Uh,hUsourceq4X9/home/rger/proj/rsyslog-doc/source/historical/stunnel.rstq5Utagnameq6Usectionq7U attributesq8}q9(Udupnamesq:]Uclassesq;]Ubackrefsq<]Uidsq=]q>U"ssl-encrypting-syslog-with-stunnelq?aUnamesq@]qAh auUlineqBKUdocumentqChUchildrenqD]qE(cdocutils.nodes title qF)qG}qH(h+X"SSL Encrypting Syslog with StunnelqIh,h2h4h5h6UtitleqJh8}qK(h:]h;]h<]h=]h@]uhBKhChhD]qLcdocutils.nodes Text qMX"SSL Encrypting Syslog with StunnelqNqO}qP(h+hIh,hGubaubcdocutils.nodes paragraph qQ)qR}qS(h+Xe*Written by* `Rainer Gerhards `_ *(2005-07-22)*h,h2h4h5h6U paragraphqTh8}qU(h:]h;]h<]h=]h@]uhBKhChhD]qV(cdocutils.nodes emphasis qW)qX}qY(h+X *Written by*h8}qZ(h:]h;]h<]h=]h@]uh,hRhD]q[hMX Written byq\q]}q^(h+Uh,hXubah6Uemphasisq_ubhMX q`}qa(h+X h,hRubcdocutils.nodes reference qb)qc}qd(h+XI`Rainer Gerhards `_h8}qe(UnameXRainer GerhardsUrefuriqfX4http://www.adiscon.com/en/people/rainer-gerhards.phpqgh=]h<]h:]h;]h@]uh,hRhD]qhhMXRainer Gerhardsqiqj}qk(h+Uh,hcubah6U referenceqlubcdocutils.nodes target qm)qn}qo(h+X7 U referencedqpKh,hRh6Utargetqqh8}qr(Urefurihgh=]qsUrainer-gerhardsqtah<]h:]h;]h@]quhauhD]ubhMX qv}qw(h+X h,hRubhW)qx}qy(h+X*(2005-07-22)*h8}qz(h:]h;]h<]h=]h@]uh,hRhD]q{hMX (2005-07-22)q|q}}q~(h+Uh,hxubah6h_ubeubhQ)q}q(h+X**HISTORICAL DOCUMENT**qh,h2h4h5h6hTh8}q(h:]h;]h<]h=]h@]uhBKhChhD]qcdocutils.nodes strong q)q}q(h+hh8}q(h:]h;]h<]h=]h@]uh,hhD]qhMXHISTORICAL DOCUMENTqq}q(h+Uh,hubah6UstrongqubaubhQ)q}q(h+X**Note: this is an outdated HISTORICAL document.** A much better description on `securing syslog with TLS `_ is available.h,h2h4h5h6hTh8}q(h:]h;]h<]h=]h@]uhBK hChhD]q(h)q}q(h+X2**Note: this is an outdated HISTORICAL document.**h8}q(h:]h;]h<]h=]h@]uh,hhD]qhMX.Note: this is an outdated HISTORICAL document.qq}q(h+Uh,hubah6hubhMX A much better description on qq}q(h+X A much better description on h,hubhb)q}q(h+X``securing syslog with TLS `_h8}q(UnameXsecuring syslog with TLShfXAhttp://www.rsyslog.com/doc/master/tutorials/tls_cert_summary.htmlqh=]h<]h:]h;]h@]uh,hhD]qhMXsecuring syslog with TLSqq}q(h+Uh,hubah6hlubhm)q}q(h+XE hpKh,hh6hqh8}q(Urefurihh=]qUsecuring-syslog-with-tlsqah<]h:]h;]h@]qhauhD]ubhMX is available.qq}q(h+X is available.h,hubeubh-)q}q(h+Uh,h2h4h5h6h7h8}q(h:]h;]h<]h=]qUabstractqah@]qhauhBKhChhD]q(hF)q}q(h+XAbstractqh,hh4h5h6hJh8}q(h:]h;]h<]h=]h@]uhBKhChhD]qhMXAbstractqq}q(h+hh,hubaubhQ)q}q(h+Xm**In this paper, I describe how to encrypt** `syslog `_ **messages on the network.** Encryption is vital to keep the confidiental content of syslog messages secure. I describe the overall approach and provide an HOWTO do it with the help of `rsyslogd `_ and `stunnel `_.*h,hh4h5h6hTh8}q(h:]h;]h<]h=]h@]uhBKhChhD]q(h)q}q(h+X,**In this paper, I describe how to encrypt**h8}q(h:]h;]h<]h=]h@]uh,hhD]qhMX(In this paper, I describe how to encryptqÅq}q(h+Uh,hubah6hubhMX q}q(h+X h,hubhb)q}q(h+X8`syslog `_h8}q(Unameh hfX,http://www.monitorware.com/en/topics/syslog/qh=]h<]h:]h;]h@]uh,hhD]qhMXsyslogqͅq}q(h+Uh,hubah6hlubhm)q}q(h+X/ hpKh,hh6hqh8}q(Urefurihh=]qUsyslogqah<]h:]h;]h@]qh auhD]ubhMX q}q(h+X h,hubh)q}q(h+X**messages on the network.**h8}q(h:]h;]h<]h=]h@]uh,hhD]qhMXmessages on the network.q܅q}q(h+Uh,hubah6hubhMX Encryption is vital to keep the confidiental content of syslog messages secure. I describe the overall approach and provide an HOWTO do it with the help of q߅q}q(h+X Encryption is vital to keep the confidiental content of syslog messages secure. I describe the overall approach and provide an HOWTO do it with the help of h,hubhb)q}q(h+X$`rsyslogd `_h8}q(UnamehhfXhttp://www.rsyslog.comqh=]h<]h:]h;]h@]uh,hhD]qhMXrsyslogdq煁q}q(h+Uh,hubah6hlubhm)q}q(h+X hpKh,hh6hqh8}q(Urefurihh=]qUrsyslogdqah<]h:]h;]h@]qhauhD]ubhMX and qq}q(h+X and h,hubhb)q}q(h+X#`stunnel `_h8}q(Unameh hfXhttp://www.stunnel.orgqh=]h<]h:]h;]h@]uh,hhD]qhMXstunnelqq}q(h+Uh,hubah6hlubhm)q}q(h+X hpKh,hh6hqh8}q(Urefurihh=]qUstunnelqah<]h:]h;]h@]rh auhD]ubhMX.*rr}r(h+X.*h,hubeubhQ)r}r(h+XOPlease note that starting with rsyslog 3.19.0, `rsyslog provides native TLS/SSL encryption `_ without the need of stunnel. I strongly recomend to use that feature instead of stunnel. The stunnel documentation here is mostly provided for backwards compatibility. New deployments are advised to use native TLS mode.\ **h,hh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]r(hMX/Please note that starting with rsyslog 3.19.0, rr }r (h+X/Please note that starting with rsyslog 3.19.0, h,jubhb)r }r (h+X@`rsyslog provides native TLS/SSL encryption `_h8}r (UnameX*rsyslog provides native TLS/SSL encryptionhfXrsyslog_tls.htmlrh=]h<]h:]h;]h@]uh,jhD]rhMX*rsyslog provides native TLS/SSL encryptionrr}r(h+Uh,j ubah6hlubhm)r}r(h+X hpKh,jh6hqh8}r(Urefurijh=]rU*rsyslog-provides-native-tls-ssl-encryptionrah<]h:]h;]h@]rhauhD]ubhMX without the need of stunnel. I strongly recomend to use that feature instead of stunnel. The stunnel documentation here is mostly provided for backwards compatibility. New deployments are advised to use native TLS mode.**rr}r(h+X without the need of stunnel. I strongly recomend to use that feature instead of stunnel. The stunnel documentation here is mostly provided for backwards compatibility. New deployments are advised to use native TLS mode.\ **h,jubeubeubh-)r}r(h+Uh,h2h4h5h6h7h8}r(h:]h;]h<]h=]rU backgroundr ah@]r!hauhBKhChhD]r"(hF)r#}r$(h+X Backgroundr%h,jh4h5h6hJh8}r&(h:]h;]h<]h=]h@]uhBKhChhD]r'hMX Backgroundr(r)}r*(h+j%h,j#ubaubhQ)r+}r,(h+X\**Syslog is a clear-text protocol. That means anyone with a sniffer can have a peek at your data.** In some environments, this is no problem at all. In others, it is a huge setback, probably even preventing deployment of syslog solutions. Thankfully, there is an easy way to encrypt syslog communication. I will describe one approach in this paper.h,jh4h5h6hTh8}r-(h:]h;]h<]h=]h@]uhBK!hChhD]r.(h)r/}r0(h+Xc**Syslog is a clear-text protocol. That means anyone with a sniffer can have a peek at your data.**h8}r1(h:]h;]h<]h=]h@]uh,j+hD]r2hMX_Syslog is a clear-text protocol. That means anyone with a sniffer can have a peek at your data.r3r4}r5(h+Uh,j/ubah6hubhMX In some environments, this is no problem at all. In others, it is a huge setback, probably even preventing deployment of syslog solutions. Thankfully, there is an easy way to encrypt syslog communication. I will describe one approach in this paper.r6r7}r8(h+X In some environments, this is no problem at all. In others, it is a huge setback, probably even preventing deployment of syslog solutions. Thankfully, there is an easy way to encrypt syslog communication. I will describe one approach in this paper.h,j+ubeubhQ)r9}r:(h+X0The most straightforward solution would be that the syslogd itself encrypts messages. Unfortuantely, encryption is only standardized in `RFC 3195 `_. But there is currently no syslogd that implements RFC 3195's encryption features, so this route leads to nothing. Another approach would be to use vendor- or project-specific syslog extensions. There are a few around, but the problem here is that they have compatibility issues. However, there is one surprisingly easy and interoperable solution: though not standardized, many vendors and projects implement plain tcp syslog. In a nutshell, plain tcp syslog is a mode where standard syslog messages are transmitted via tcp and records are separated by newline characters. This mode is supported by all major syslogd's (both on Linux/Unix and Windows) as well as log sources (for example, `EventReporter `_ for Windows Event Log forwarding). Plain tcp syslog offers reliability, but it does not offer encryption in itself. However, since it operates on a tcp stream, it is now easy to add encryption. There are various ways to do that. In this paper, I will describe how it is done with stunnel (an other alternative would be `IPSec `_, for example).h,jh4h5h6hTh8}r;(h:]h;]h<]h=]h@]uhBK(hChhD]r<(hMXThe most straightforward solution would be that the syslogd itself encrypts messages. Unfortuantely, encryption is only standardized in r=r>}r?(h+XThe most straightforward solution would be that the syslogd itself encrypts messages. Unfortuantely, encryption is only standardized in h,j9ubhb)r@}rA(h+XG`RFC 3195 `_h8}rB(UnameXRFC 3195hfX9http://www.monitorware.com/Common/en/glossary/rfc3195.phprCh=]h<]h:]h;]h@]uh,j9hD]rDhMXRFC 3195rErF}rG(h+Uh,j@ubah6hlubhm)rH}rI(h+X< hpKh,j9h6hqh8}rJ(UrefurijCh=]rKUrfc-3195rLah<]h:]h;]h@]rMhauhD]ubhMX. But there is currently no syslogd that implements RFC 3195's encryption features, so this route leads to nothing. Another approach would be to use vendor- or project-specific syslog extensions. There are a few around, but the problem here is that they have compatibility issues. However, there is one surprisingly easy and interoperable solution: though not standardized, many vendors and projects implement plain tcp syslog. In a nutshell, plain tcp syslog is a mode where standard syslog messages are transmitted via tcp and records are separated by newline characters. This mode is supported by all major syslogd's (both on Linux/Unix and Windows) as well as log sources (for example, rNrO}rP(h+X. But there is currently no syslogd that implements RFC 3195's encryption features, so this route leads to nothing. Another approach would be to use vendor- or project-specific syslog extensions. There are a few around, but the problem here is that they have compatibility issues. However, there is one surprisingly easy and interoperable solution: though not standardized, many vendors and projects implement plain tcp syslog. In a nutshell, plain tcp syslog is a mode where standard syslog messages are transmitted via tcp and records are separated by newline characters. This mode is supported by all major syslogd's (both on Linux/Unix and Windows) as well as log sources (for example, h,j9ubhb)rQ}rR(h+X3`EventReporter `_h8}rS(UnameX EventReporterhfX http://www.eventreporter.com/en/rTh=]h<]h:]h;]h@]uh,j9hD]rUhMX EventReporterrVrW}rX(h+Uh,jQubah6hlubhm)rY}rZ(h+X# hpKh,j9h6hqh8}r[(UrefurijTh=]r\U eventreporterr]ah<]h:]h;]h@]r^hauhD]ubhMX@ for Windows Event Log forwarding). Plain tcp syslog offers reliability, but it does not offer encryption in itself. However, since it operates on a tcp stream, it is now easy to add encryption. There are various ways to do that. In this paper, I will describe how it is done with stunnel (an other alternative would be r_r`}ra(h+X@ for Windows Event Log forwarding). Plain tcp syslog offers reliability, but it does not offer encryption in itself. However, since it operates on a tcp stream, it is now easy to add encryption. There are various ways to do that. In this paper, I will describe how it is done with stunnel (an other alternative would be h,j9ubhb)rb}rc(h+X-`IPSec `_h8}rd(UnameXIPSechfX"http://en.wikipedia.org/wiki/IPSecreh=]h<]h:]h;]h@]uh,j9hD]rfhMXIPSecrgrh}ri(h+Uh,jbubah6hlubhm)rj}rk(h+X% hpKh,j9h6hqh8}rl(Urefurijeh=]rmUipsecrnah<]h:]h;]h@]rohauhD]ubhMX, for example).rprq}rr(h+X, for example).h,j9ubeubhQ)rs}rt(h+XStunnel is open source and it is available both for Unix/Linux and Windows. It provides a way to use ssl communication for any non-ssl aware client and server - in this case, our syslogd.ruh,jh4h5h6hTh8}rv(h:]h;]h<]h=]h@]uhBK=hChhD]rwhMXStunnel is open source and it is available both for Unix/Linux and Windows. It provides a way to use ssl communication for any non-ssl aware client and server - in this case, our syslogd.rxry}rz(h+juh,jsubaubhQ)r{}r|(h+XStunnel works much like a wrapper. Both on the client and on the server machine, tunnel portals are created. The non-ssl aware client and server software is configured to not directly talk to the remote partner, but to the local (s)tunnel portal instead. Stunnel, in turn, takes the data received from the client, encrypts it via ssl, sends it to the remote tunnel portal and that remote portal sends it to the recipient process on the remote machine. The transfer to the portals is done via unencrypted communication. As such, it is vital that the portal and the respective program that is talking to it are on the same machine, otherwise data would travel partly unencrypted. Tunneling, as done by stunnel, requires connection oriented communication. This is why you need to use tcp-based syslog. As a side-note, you can also encrypt a plain-text RFC 3195 session via stunnel, though this definitely is not what the protocol designers had on their mind ;)r}h,jh4h5h6hTh8}r~(h:]h;]h<]h=]h@]uhBKAhChhD]rhMXStunnel works much like a wrapper. Both on the client and on the server machine, tunnel portals are created. The non-ssl aware client and server software is configured to not directly talk to the remote partner, but to the local (s)tunnel portal instead. Stunnel, in turn, takes the data received from the client, encrypts it via ssl, sends it to the remote tunnel portal and that remote portal sends it to the recipient process on the remote machine. The transfer to the portals is done via unencrypted communication. As such, it is vital that the portal and the respective program that is talking to it are on the same machine, otherwise data would travel partly unencrypted. Tunneling, as done by stunnel, requires connection oriented communication. This is why you need to use tcp-based syslog. As a side-note, you can also encrypt a plain-text RFC 3195 session via stunnel, though this definitely is not what the protocol designers had on their mind ;)rr}r(h+j}h,j{ubaubhQ)r}r(h+XIn the rest of this document, I assume that you use rsyslog on both the client and the server. For the samples, I use `Debian `_. Interestingly, there are some annoying differences between stunnel implementations. For example, on Debian a comment line starts with a semicolon (';'). On `Red Hat `_, it starts with a hash sign ('#'). So you need to watch out for subtle issues when setting up your system.h,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKPhChhD]r(hMXvIn the rest of this document, I assume that you use rsyslog on both the client and the server. For the samples, I use rr}r(h+XvIn the rest of this document, I assume that you use rsyslog on both the client and the server. For the samples, I use h,jubhb)r}r(h+X"`Debian `_h8}r(UnameXDebianhfXhttp://www.debian.org/rh=]h<]h:]h;]h@]uh,jhD]rhMXDebianrr}r(h+Uh,jubah6hlubhm)r}r(h+X hpKh,jh6hqh8}r(Urefurijh=]rUdebianrah<]h:]h;]h@]rhauhD]ubhMX. Interestingly, there are some annoying differences between stunnel implementations. For example, on Debian a comment line starts with a semicolon (';'). On rr}r(h+X. Interestingly, there are some annoying differences between stunnel implementations. For example, on Debian a comment line starts with a semicolon (';'). On h,jubhb)r}r(h+X"`Red Hat `_h8}r(UnameXRed HathfXhttp://www.redhat.comrh=]h<]h:]h;]h@]uh,jhD]rhMXRed Hatrr}r(h+Uh,jubah6hlubhm)r}r(h+X hpKh,jh6hqh8}r(Urefurijh=]rUred-hatrah<]h:]h;]h@]rhauhD]ubhMXk, it starts with a hash sign ('#'). So you need to watch out for subtle issues when setting up your system.rr}r(h+Xk, it starts with a hash sign ('#'). So you need to watch out for subtle issues when setting up your system.h,jubeubeubh-)r}r(h+Uh,h2h4h5h6h7h8}r(h:]h;]h<]h=]rUoverall-system-setuprah@]rh"auhBKYhChhD]r(hF)r}r(h+XOverall System Setuprh,jh4h5h6hJh8}r(h:]h;]h<]h=]h@]uhBKYhChhD]rhMXOverall System Setuprr}r(h+jh,jubaubhQ)r}r(h+XDIn ths paper, I assume two machines, one named "client" and the other named "server". It is obvious that, in practice, you will probably have multiple clients but only one server. Syslog traffic shall be transmitted via stunnel over the network. Port 60514 is to be used for that purpose. The machines are set up as follows:rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBK[hChhD]rhMXDIn ths paper, I assume two machines, one named "client" and the other named "server". It is obvious that, in practice, you will probably have multiple clients but only one server. Syslog traffic shall be transmitted via stunnel over the network. Port 60514 is to be used for that purpose. The machines are set up as follows:rr}r(h+jh,jubaubhQ)r}r(h+X **Client**rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKahChhD]rh)r}r(h+jh8}r(h:]h;]h<]h=]h@]uh,jhD]rhMXClientrr}r(h+Uh,jubah6hubaubcdocutils.nodes bullet_list r)r}r(h+Uh,jh4h5h6U bullet_listrh8}r(UbulletrX-h=]h<]h:]h;]h@]uhBKchChhD]r(cdocutils.nodes list_item r)r}r(h+X@rsyslog forwards  message to stunnel local portal at port 61514rh,jh4h5h6U list_itemrh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+jh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKchD]rhMX@rsyslog forwards  message to stunnel local portal at port 61514rr}r(h+jh,jubaubaubj)r}r(h+XMlocal stunnel forwards data via the network to port 60514 to its remote peer h,jh4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+XLlocal stunnel forwards data via the network to port 60514 to its remote peerrh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKdhD]rhMXLlocal stunnel forwards data via the network to port 60514 to its remote peerrr}r(h+jh,jubaubaubeubhQ)r}r(h+X **Server**rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKghChhD]rh)r}r(h+jh8}r(h:]h;]h<]h=]h@]uh,jhD]rhMXServerrr}r(h+Uh,jubah6hubaubj)r}r(h+Uh,jh4h5h6jh8}r(jX-h=]h<]h:]h;]h@]uhBKihChhD]r(j)r}r(h+XBstunnel listens on port 60514 to connections from its client peersrh,jh4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+jh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKihD]rhMXBstunnel listens on port 60514 to connections from its client peersr r }r (h+jh,jubaubaubj)r }r (h+XUall connections are forwarded to the locally-running rsyslog listening at port 61514 h,jh4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+XTall connections are forwarded to the locally-running rsyslog listening at port 61514rh,j h4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKjhD]rhMXTall connections are forwarded to the locally-running rsyslog listening at port 61514rr}r(h+jh,jubaubaubeubeubh0h-)r}r(h+Uh,h2h4h5h6h7h8}r(h:]h;]h<]h=]rU>preventing-systems-from-talking-directly-to-the-rsyslog-serverrah@]rh!auhBMhChhD]r(hF)r}r (h+X>Preventing Systems from talking directly to the rsyslog Serverr!h,jh4h5h6hJh8}r"(h:]h;]h<]h=]h@]uhBMhChhD]r#hMX>Preventing Systems from talking directly to the rsyslog Serverr$r%}r&(h+j!h,jubaubhQ)r'}r((h+X~It is possible that remote systems (or attackers) talk to the rsyslog server by directly connecting to its port 61514. Currently (July of 2005), rsyslog does not offer the ability to bind to the local host, only. This feature is planned, but as long as it is missing, rsyslog must be protected via a firewall. This can easily be done via e.g iptables. Just be sure not to forget it.r)h,jh4h5h6hTh8}r*(h:]h;]h<]h=]h@]uhBM hChhD]r+hMX~It is possible that remote systems (or attackers) talk to the rsyslog server by directly connecting to its port 61514. Currently (July of 2005), rsyslog does not offer the ability to bind to the local host, only. This feature is planned, but as long as it is missing, rsyslog must be protected via a firewall. This can easily be done via e.g iptables. Just be sure not to forget it.r,r-}r.(h+j)h,j'ubaubeubh-)r/}r0(h+Uh,h2h4h5h6h7h8}r1(h:]h;]h<]h=]r2U conclusionr3ah@]r4hauhBMhChhD]r5(hF)r6}r7(h+X Conclusionr8h,j/h4h5h6hJh8}r9(h:]h;]h<]h=]h@]uhBMhChhD]r:hMX Conclusionr;r<}r=(h+j8h,j6ubaubhQ)r>}r?(h+XWith minumal effort, you can set up a secure logging infrastructure employing ssl encrypted syslog message transmission. As a side note, you also have the benefit of reliable tcp delivery which is far less prone to message loss than udp.r@h,j/h4h5h6hTh8}rA(h:]h;]h<]h=]h@]uhBMhChhD]rBhMXWith minumal effort, you can set up a secure logging infrastructure employing ssl encrypted syslog message transmission. As a side note, you also have the benefit of reliable tcp delivery which is far less prone to message loss than udp.rCrD}rE(h+j@h,j>ubaubh-)rF}rG(h+Uh,j/h4h5h6h7h8}rH(h:]h;]h<]h=]rIUfeedback-requestedrJah@]rKhauhBMhChhD]rL(hF)rM}rN(h+XFeedback requestedrOh,jFh4h5h6hJh8}rP(h:]h;]h<]h=]h@]uhBMhChhD]rQhMXFeedback requestedrRrS}rT(h+jOh,jMubaubhQ)rU}rV(h+XI would appreciate feedback on this tutorial. If you have additional ideas, comments or find bugs (I \*do\* bugs - no way... ;)), please `let me know `_.h,jFh4h5h6hTh8}rW(h:]h;]h<]h=]h@]uhBMhChhD]rX(hMXI would appreciate feedback on this tutorial. If you have additional ideas, comments or find bugs (I *do* bugs - no way... ;)), please rYrZ}r[(h+XI would appreciate feedback on this tutorial. If you have additional ideas, comments or find bugs (I \*do\* bugs - no way... ;)), please h,jUubhb)r\}r](h+X-`let me know `_h8}r^(UnameX let me knowhfXmailto:rgerhards@adiscon.comr_h=]h<]h:]h;]h@]uh,jUhD]r`hMX let me knowrarb}rc(h+Uh,j\ubah6hlubhm)rd}re(h+X hpKh,jUh6hqh8}rf(Urefurij_h=]rgU let-me-knowrhah<]h:]h;]h@]rihauhD]ubhMX.rj}rk(h+X.h,jUubeubeubeubh-)rl}rm(h+Uh,h2h4h5h6h7h8}rn(h:]h;]h<]h=]roUrevision-historyrpah@]rqhauhBM!hChhD]rr(hF)rs}rt(h+XRevision Historyruh,jlh4h5h6hJh8}rv(h:]h;]h<]h=]h@]uhBM!hChhD]rwhMXRevision Historyrxry}rz(h+juh,jsubaubj)r{}r|(h+Uh,jlh4h5h6jh8}r}(jX-h=]h<]h:]h;]h@]uhBM#hChhD]r~(j)r}r(h+X;2005-07-22 \* `Rainer Gerhards`_ \* Initial Version createdh,j{h4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+X;2005-07-22 \* `Rainer Gerhards`_ \* Initial Version createdh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM#hD]r(hMX 2005-07-22 * rr}r(h+X2005-07-22 \* h,jubhb)r}r(h+X`Rainer Gerhards`_UresolvedrKh,jh6hlh8}r(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]rhMXRainer Gerhardsrr}r(h+Uh,jubaubhMX * Initial Version createdrr}r(h+X \* Initial Version createdh,jubeubaubj)r}r(h+XH2005-07-26 \* `Rainer Gerhards`_ \* Some text brush-up, hyperlinks addedh,j{h4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+XH2005-07-26 \* `Rainer Gerhards`_ \* Some text brush-up, hyperlinks addedh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM%hD]r(hMX 2005-07-26 * rr}r(h+X2005-07-26 \* h,jubhb)r}r(h+X`Rainer Gerhards`_jKh,jh6hlh8}r(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]rhMXRainer Gerhardsrr}r(h+Uh,jubaubhMX' * Some text brush-up, hyperlinks addedrr}r(h+X( \* Some text brush-up, hyperlinks addedh,jubeubaubj)r}r(h+X12005-08-03 \* `Rainer Gerhards`_ \* license addedh,j{h4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+X12005-08-03 \* `Rainer Gerhards`_ \* license addedh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM'hD]r(hMX 2005-08-03 * rr}r(h+X2005-08-03 \* h,jubhb)r}r(h+X`Rainer Gerhards`_jKh,jh6hlh8}r(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]rhMXRainer Gerhardsrr}r(h+Uh,jubaubhMX * license addedrr}r(h+X \* license addedh,jubeubaubj)r}r(h+Xi2008-05-05 \* `Rainer Gerhards`_ \* updated to reflect native TLS capability of rsyslog 3.19.0 and above h,j{h4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rhQ)r}r(h+Xh2008-05-05 \* `Rainer Gerhards`_ \* updated to reflect native TLS capability of rsyslog 3.19.0 and aboveh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM)hD]r(hMX 2008-05-05 * rr}r(h+X2008-05-05 \* h,jubhb)r}r(h+X`Rainer Gerhards`_jKh,jh6hlh8}r(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]rhMXRainer Gerhardsrr}r(h+Uh,jubaubhMXG * updated to reflect native TLS capability of rsyslog 3.19.0 and aboverr}r(h+XH \* updated to reflect native TLS capability of rsyslog 3.19.0 and aboveh,jubeubaubeubeubh-)r}r(h+Uh,h2h4h5h6h7h8}r(h:]h;]h<]h=]rU copyrightrah@]rhauhBM-hChhD]r(hF)r}r(h+X Copyrightrh,jh4h5h6hJh8}r(h:]h;]h<]h=]h@]uhBM-hChhD]rhMX Copyrightrr}r(h+jh,jubaubhQ)r}r(h+X5Copyright (c) 2008 `Rainer Gerhards`_ and `Adiscon`_.h,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM/hChhD]r(hMXCopyright (c) 2008 rr}r(h+XCopyright (c) 2008 h,jubhb)r}r(h+X`Rainer Gerhards`_jKh,jh6hlh8}r(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]rhMXRainer Gerhardsrr}r(h+Uh,jubaubhMX and rr}r(h+X and h,jubhb)r}r(h+X `Adiscon`_jKh,jh6hlh8}r(UnameXAdisconhfXhttp://www.adiscon.com/rh=]h<]h:]h;]h@]uhD]rhMXAdisconrr}r(h+Uh,jubaubhMX.r}r(h+X.h,jubeubhQ)r}r(h+XPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.h,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM2hChhD]r(hMX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at rr}r(h+X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at h,jubhb)r}r(h+XN`http://www.gnu.org/copyleft/fdl.html `_h8}r(UnamehhfX$http://www.gnu.org/copyleft/fdl.htmlrh=]h<]h:]h;]h@]uh,jhD]r hMX$http://www.gnu.org/copyleft/fdl.htmlr r }r (h+Uh,jubah6hlubhm)r }r(h+X' hpKh,jh6hqh8}r(Urefurijh=]rU"http-www-gnu-org-copyleft-fdl-htmlrah<]h:]h;]h@]rhauhD]ubhMX.r}r(h+X.h,jubeubhQ)r}r(h+XThis documentation is part of the `rsyslog `_ project. Copyright © 2008 by `Rainer Gerhards`_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBM9hChhD]r(hMX"This documentation is part of the rr}r(h+X"This documentation is part of the h,jubhb)r}r(h+X$`rsyslog `_h8}r(Unameh hfXhttp://www.rsyslog.com/rh=]h<]h:]h;]h@]uh,jhD]r hMXrsyslogr!r"}r#(h+Uh,jubah6hlubhm)r$}r%(h+X hpKh,jh6hqh8}r&(Urefurijh=]r'Ursyslogr(ah<]h:]h;]h@]r)h auhD]ubhMX project. Copyright © 2008 by r*r+}r,(h+X project. Copyright © 2008 by h,jubhb)r-}r.(h+X`Rainer Gerhards`_jKh,jh6hlh8}r/(UnameXRainer Gerhardshfhgh=]h<]h:]h;]h@]uhD]r0hMXRainer Gerhardsr1r2}r3(h+Uh,j-ubaubhMX and r4r5}r6(h+X and h,jubhb)r7}r8(h+X$`Adiscon `_h8}r9(UnameXAdisconhfjh=]h<]h:]h;]h@]uh,jhD]r:hMXAdisconr;r<}r=(h+Uh,j7ubah6hlubhm)r>}r?(h+X hpKh,jh6hqh8}r@(Urefurijh=]rAUadisconrBah<]h:]h;]h@]rChauhD]ubhMX1. Released under the GNU GPL version 2 or higher.rDrE}rF(h+X1. Released under the GNU GPL version 2 or higher.h,jubeubeubeubh4h5h6h7h8}rG(h:]h;]h<]h=]rHUsetting-up-the-systemrIah@]rJh auhBKnhChhD]rK(hF)rL}rM(h+XSetting up the systemrNh,h0h4h5h6hJh8}rO(h:]h;]h<]h=]h@]uhBKnhChhD]rPhMXSetting up the systemrQrR}rS(h+jNh,jLubaubhQ)rT}rU(h+XFor Debian, you need the "stunnel4" package. The "stunnel" package is the older 3.x release, which will not support the configuration I describe below. Other distributions might have other names. For example, on Red Hat it is just "stunnel". Make sure that you install the appropriate package on both the client and the server. It is also a good idea to check if there are updates for either stunnel or openssl (which stunnel uses) - there are often security fixes available and often the latest fixes are not included in the default package.rVh,h0h4h5h6hTh8}rW(h:]h;]h<]h=]h@]uhBKphChhD]rXhMXFor Debian, you need the "stunnel4" package. The "stunnel" package is the older 3.x release, which will not support the configuration I describe below. Other distributions might have other names. For example, on Red Hat it is just "stunnel". Make sure that you install the appropriate package on both the client and the server. It is also a good idea to check if there are updates for either stunnel or openssl (which stunnel uses) - there are often security fixes available and often the latest fixes are not included in the default package.rYrZ}r[(h+jVh,jTubaubhQ)r\}r](h+XIn my sample setup, I use only the bare minimum of options. For example, I do not make the server check client cerficiates. Also, I do not talk much about certificates at all. If you intend to really secure your system, you should probably learn about certificates and how to manage and deploy them. This is beyond the scope of this paper. For additional information, `http://www.stunnel.org/faq/certs.html `_ is a good starting point.h,h0h4h5h6hTh8}r^(h:]h;]h<]h=]h@]uhBKyhChhD]r_(hMXpIn my sample setup, I use only the bare minimum of options. For example, I do not make the server check client cerficiates. Also, I do not talk much about certificates at all. If you intend to really secure your system, you should probably learn about certificates and how to manage and deploy them. This is beyond the scope of this paper. For additional information, r`ra}rb(h+XpIn my sample setup, I use only the bare minimum of options. For example, I do not make the server check client cerficiates. Also, I do not talk much about certificates at all. If you intend to really secure your system, you should probably learn about certificates and how to manage and deploy them. This is beyond the scope of this paper. For additional information, h,j\ubhb)rc}rd(h+XP`http://www.stunnel.org/faq/certs.html `_h8}re(UnamehhfX%http://www.stunnel.org/faq/certs.htmlrfh=]h<]h:]h;]h@]uh,j\hD]rghMX%http://www.stunnel.org/faq/certs.htmlrhri}rj(h+Uh,jcubah6hlubhm)rk}rl(h+X( hpKh,j\h6hqh8}rm(Urefurijfh=]rnU#http-www-stunnel-org-faq-certs-htmlroah<]h:]h;]h@]rphauhD]ubhMX is a good starting point.rqrr}rs(h+X is a good starting point.h,j\ubeubhQ)rt}ru(h+XYou also need to install rsyslogd on both machines. Do this before starting with the configuration. You should also familarize yourself with its configuration file syntax, so that you know which actions you can trigger with it. Rsyslogd can work as a drop-in replacement for stock `sysklogd `_. So if you know the standard syslog.conf syntax, you do not need to learn any more to follow this paper.h,h0h4h5h6hTh8}rv(h:]h;]h<]h=]h@]uhBKhChhD]rw(hMXYou also need to install rsyslogd on both machines. Do this before starting with the configuration. You should also familarize yourself with its configuration file syntax, so that you know which actions you can trigger with it. Rsyslogd can work as a drop-in replacement for stock rxry}rz(h+XYou also need to install rsyslogd on both machines. Do this before starting with the configuration. You should also familarize yourself with its configuration file syntax, so that you know which actions you can trigger with it. Rsyslogd can work as a drop-in replacement for stock h,jtubhb)r{}r|(h+X8`sysklogd `_h8}r}(UnamehhfX*http://www.infodrom.org/projects/sysklogd/r~h=]h<]h:]h;]h@]uh,jthD]rhMXsysklogdrr}r(h+Uh,j{ubah6hlubhm)r}r(h+X- hpKh,jth6hqh8}r(Urefurij~h=]rUsysklogdrah<]h:]h;]h@]rhauhD]ubhMXi. So if you know the standard syslog.conf syntax, you do not need to learn any more to follow this paper.rr}r(h+Xi. So if you know the standard syslog.conf syntax, you do not need to learn any more to follow this paper.h,jtubeubh.h-)r}r(h+Uh,h0h4h5h6h7h8}r(h:]h;]h<]h=]rU client-setuprah@]rhauhBKhChhD]r(hF)r}r(h+X Client Setuprh,jh4h5h6hJh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMX Client Setuprr}r(h+jh,jubaubhQ)r}r(h+XThe client setup is simpler. Most importantly, you do not need a certificate (of course, you can use one if you would like to authenticate the client, but this is beyond the scope of this paper). So the basic thing you need to do is create the stunnel configuration file.rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXThe client setup is simpler. Most importantly, you do not need a certificate (of course, you can use one if you would like to authenticate the client, but this is beyond the scope of this paper). So the basic thing you need to do is create the stunnel configuration file.rr}r(h+jh,jubaubcdocutils.nodes block_quote r)r}r(h+Uh,jh4h5h6U block_quoterh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rcdocutils.nodes literal_block r)r}r(h+X; Some debugging stuff useful for troubleshootingdebug = 7foreground=yes client=yes [ssyslog] accept = 127.0.0.1:61514 connect = 192.0.2.1:60514h,jh6U literal_blockrh8}r(U xml:spacerUpreserverh=]h<]h:]h;]h@]uhBKhD]rhMX; Some debugging stuff useful for troubleshootingdebug = 7foreground=yes client=yes [ssyslog] accept = 127.0.0.1:61514 connect = 192.0.2.1:60514rr}r(h+Uh,jubaubaubhQ)r}r(h+XmAgain, the text in *italics* is for debugging purposes only. I suggest you leave it in during your initial testing and then remove it. The most important difference to the server configuration outlined above is the "client=yes" directive. It is what makes this stunnel behave like a client. The accept directive binds stunnel only to the local host, so that it is protected from receiving messages from the network (somebody might fake to be the local sender). The address "192.0.2.1" is the address of the server machine. You must change it to match your configuration. Save this file to /etc/stunnel/syslog-client.conf.h,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]r(hMXAgain, the text in rr}r(h+XAgain, the text in h,jubhW)r}r(h+X *italics*h8}r(h:]h;]h<]h=]h@]uh,jhD]rhMXitalicsrr}r(h+Uh,jubah6h_ubhMXQ is for debugging purposes only. I suggest you leave it in during your initial testing and then remove it. The most important difference to the server configuration outlined above is the "client=yes" directive. It is what makes this stunnel behave like a client. The accept directive binds stunnel only to the local host, so that it is protected from receiving messages from the network (somebody might fake to be the local sender). The address "192.0.2.1" is the address of the server machine. You must change it to match your configuration. Save this file to /etc/stunnel/syslog-client.conf.rr}r(h+XQ is for debugging purposes only. I suggest you leave it in during your initial testing and then remove it. The most important difference to the server configuration outlined above is the "client=yes" directive. It is what makes this stunnel behave like a client. The accept directive binds stunnel only to the local host, so that it is protected from receiving messages from the network (somebody might fake to be the local sender). The address "192.0.2.1" is the address of the server machine. You must change it to match your configuration. Save this file to /etc/stunnel/syslog-client.conf.h,jubeubhQ)r}r(h+XThen, start stunnel via "stunnel4 /etc/stunnel/syslog-client.conf".  Now you should see some startup messages. If no errors appear, you have a running client stunnel instance.rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXThen, start stunnel via "stunnel4 /etc/stunnel/syslog-client.conf".  Now you should see some startup messages. If no errors appear, you have a running client stunnel instance.rr}r(h+jh,jubaubhQ)r}r(h+XFinally, you need to tell rsyslogd to send data to the remote host. In stock syslogd, you do this via the "@host" forwarding directive. The same works with rsyslog, but it suppports extensions to use tcp. Add the following line to your /etc/rsyslog.conf:rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXFinally, you need to tell rsyslogd to send data to the remote host. In stock syslogd, you do this via the "@host" forwarding directive. The same works with rsyslog, but it suppports extensions to use tcp. Add the following line to your /etc/rsyslog.conf:rr}r(h+jh,jubaubj)r}r(h+Uh,jh4h5h6jh8}r(h:]h;]h<]h=]h@]uhBNhChhD]rj)r}r(h+X*.* @@127.0.0.1:61514h,jh6jh8}r(jjh=]h<]h:]h;]h@]uhBKhD]rhMX*.* @@127.0.0.1:61514rr}r(h+Uh,jubaubaubhQ)r}r(h+XPlease note the double at-sign (@@). This is no typo. It tells rsyslog to use tcp instead of udp delivery. In this sample, all messages are forwarded to the remote host. Obviously, you may want to limit this via the usual rsyslog.conf settings (if in doubt, use man rsyslog.con).rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXPlease note the double at-sign (@@). This is no typo. It tells rsyslog to use tcp instead of udp delivery. In this sample, all messages are forwarded to the remote host. Obviously, you may want to limit this via the usual rsyslog.conf settings (if in doubt, use man rsyslog.con).rr}r(h+jh,jubaubhQ)r}r(h+XYou do not need to add any special startup settings to rsyslog on the client. Start or restart rsyslog so that the new configuration setting takes place.rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXYou do not need to add any special startup settings to rsyslog on the client. Start or restart rsyslog so that the new configuration setting takes place.rr}r(h+jh,jubaubeubh-)r}r(h+Uh,h0h4h5h6h7h8}r(h:]h;]h<]h=]rUdonerah@]rh auhBKhChhD]r(hF)r}r(h+XDonerh,jh4h5h6hJh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXDonerr}r(h+jh,jubaubhQ)r}r(h+XAfter following these steps, you should have a working secure syslog forwarding system. To verify, you can type "logger test" or a similar smart command on the client. It should show up in the respective server log file. If you dig out you sniffer, you should see that the traffic on the wire is actually protected. In the configuration use above, the two stunnel endpoints should be quite chatty, so that you can follow the action going on on your system.rh,jh4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXAfter following these steps, you should have a working secure syslog forwarding system. To verify, you can type "logger test" or a similar smart command on the client. It should show up in the respective server log file. If you dig out you sniffer, you should see that the traffic on the wire is actually protected. In the configuration use above, the two stunnel endpoints should be quite chatty, so that you can follow the action going on on your system.rr}r(h+jh,jubaubhQ)r}r(h+X If you have only basic security needs, you can probably just remove the debug settings and take the rest of the configuration to production. If you are security-sensitve, you should have a look at the various stunnel settings that help you further secure the system.r h,jh4h5h6hTh8}r (h:]h;]h<]h=]h@]uhBMhChhD]r hMX If you have only basic security needs, you can probably just remove the debug settings and take the rest of the configuration to production. If you are security-sensitve, you should have a look at the various stunnel settings that help you further secure the system.r r }r(h+j h,jubaubeubeubh4h5h6h7h8}r(h:]h;]h<]h=]rU server-setuprah@]rh#auhBKhChhD]r(hF)r}r(h+X Server Setuprh,h.h4h5h6hJh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMX Server Setuprr}r(h+jh,jubaubhQ)r}r(h+X3At the server, you need to have a digital certificate. That certificate enables SSL operation, as it provides the necessary crypto keys being used to secure the connection. Many versions of stunnel come with a default certificate, often found in /etc/stunnel/stunnel.pem. If you have it, it is good for testing only. If you use it in production, it is very easy to break into your secure channel as everybody is able to get hold of your private key. I didn't find an stunnel.pem on my Debian machine. I guess the Debian folks removed it because of its insecurity.rh,h.h4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]r hMX3At the server, you need to have a digital certificate. That certificate enables SSL operation, as it provides the necessary crypto keys being used to secure the connection. Many versions of stunnel come with a default certificate, often found in /etc/stunnel/stunnel.pem. If you have it, it is good for testing only. If you use it in production, it is very easy to break into your secure channel as everybody is able to get hold of your private key. I didn't find an stunnel.pem on my Debian machine. I guess the Debian folks removed it because of its insecurity.r!r"}r#(h+jh,jubaubhQ)r$}r%(h+XYou can create your own certificate with a simple openssl tool - you need to do it if you have none and I highly recommend to create one in any case. To create it, cd to /etc/stunnel and type:r&h,h.h4h5h6hTh8}r'(h:]h;]h<]h=]h@]uhBKhChhD]r(hMXYou can create your own certificate with a simple openssl tool - you need to do it if you have none and I highly recommend to create one in any case. To create it, cd to /etc/stunnel and type:r)r*}r+(h+j&h,j$ubaubj)r,}r-(h+Uh,h.h4h5h6jh8}r.(h:]h;]h<]h=]h@]uhBNhChhD]r/hQ)r0}r1(h+XR``openssl req -new -x509 -days 3650 -nodes -out stunnel.pem -keyout stunnel.pem``r2h,j,h4h5h6hTh8}r3(h:]h;]h<]h=]h@]uhBKhD]r4cdocutils.nodes literal r5)r6}r7(h+j2h8}r8(h:]h;]h<]h=]h@]uh,j0hD]r9hMXNopenssl req -new -x509 -days 3650 -nodes -out stunnel.pem -keyout stunnel.pemr:r;}r<(h+Uh,j6ubah6Uliteralr=ubaubaubhQ)r>}r?(h+XThat command will ask you a number of questions. Provide some answer for them. If you are unsure, read `http://www.stunnel.org/faq/certs.html `_. After the command has finished, you should have a usable stunnel.pem in your working directory.h,h.h4h5h6hTh8}r@(h:]h;]h<]h=]h@]uhBKhChhD]rA(hMXgThat command will ask you a number of questions. Provide some answer for them. If you are unsure, read rBrC}rD(h+XgThat command will ask you a number of questions. Provide some answer for them. If you are unsure, read h,j>ubhb)rE}rF(h+XP`http://www.stunnel.org/faq/certs.html `_h8}rG(UnameX%http://www.stunnel.org/faq/certs.htmlrHhfX%http://www.stunnel.org/faq/certs.htmlrIh=]h<]h:]h;]h@]uh,j>hD]rJhMX%http://www.stunnel.org/faq/certs.htmlrKrL}rM(h+Uh,jEubah6hlubhm)rN}rO(h+X( hpKh,j>h6hqh8}rP(UrefurijIh=]rQUid1rRah<]h:]rSjHah;]h@]uhD]ubhMXa. After the command has finished, you should have a usable stunnel.pem in your working directory.rTrU}rV(h+Xa. After the command has finished, you should have a usable stunnel.pem in your working directory.h,j>ubeubhQ)rW}rX(h+X|Next is to create a configuration file for stunnel. It will direct stunnel what to do. You can use the following basic file:rYh,h.h4h5h6hTh8}rZ(h:]h;]h<]h=]h@]uhBKhChhD]r[hMX|Next is to create a configuration file for stunnel. It will direct stunnel what to do. You can use the following basic file:r\r]}r^(h+jYh,jWubaubj)r_}r`(h+X; Certificate/key is needed in server modecert = /etc/stunnel/stunnel.pem; Some debugging stuff useful for troubleshootingdebug = 7foreground=yesrah,h.h4h5h6jh8}rb(jjh=]h<]h:]h;]h@]uhBKhChhD]rchMX; Certificate/key is needed in server modecert = /etc/stunnel/stunnel.pem; Some debugging stuff useful for troubleshootingdebug = 7foreground=yesrdre}rf(h+Uh,j_ubaubj)rg}rh(h+Uh,h.h4h5h6jh8}ri(h:]h;]h<]h=]h@]uhBNhChhD]rjhQ)rk}rl(h+X)[ssyslog] accept = 60514 connect = 61514rmh,jgh4h5h6hTh8}rn(h:]h;]h<]h=]h@]uhBKhD]rohMX)[ssyslog] accept = 60514 connect = 61514rprq}rr(h+jmh,jkubaubaubhQ)rs}rt(h+XYSave this file to e.g. /etc/stunnel/syslog-server.conf. Please note that the settings in *italics* are for debugging only. They run stunnel with a lot of debug information in the foreground. This is very valuable while you setup the system - and very useless once everything works well. So be sure to remove these lines when going to production.h,h.h4h5h6hTh8}ru(h:]h;]h<]h=]h@]uhBKhChhD]rv(hMXYSave this file to e.g. /etc/stunnel/syslog-server.conf. Please note that the settings in rwrx}ry(h+XYSave this file to e.g. /etc/stunnel/syslog-server.conf. Please note that the settings in h,jsubhW)rz}r{(h+X *italics*h8}r|(h:]h;]h<]h=]h@]uh,jshD]r}hMXitalicsr~r}r(h+Uh,jzubah6h_ubhMX are for debugging only. They run stunnel with a lot of debug information in the foreground. This is very valuable while you setup the system - and very useless once everything works well. So be sure to remove these lines when going to production.rr}r(h+X are for debugging only. They run stunnel with a lot of debug information in the foreground. This is very valuable while you setup the system - and very useless once everything works well. So be sure to remove these lines when going to production.h,jsubeubhQ)r}r(h+XFinally, you need to start the stunnel daemon. Under Debian, this is done via "stunnel /etc/stunnel/syslog.server.conf". If you have enabled the debug settings, you will immediately see a lot of nice messages.rh,h.h4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMXFinally, you need to start the stunnel daemon. Under Debian, this is done via "stunnel /etc/stunnel/syslog.server.conf". If you have enabled the debug settings, you will immediately see a lot of nice messages.rr}r(h+jh,jubaubhQ)r}r(h+X^Now you have stunnel running, but it obviously unable to talk to rsyslog - because it is not yet running. If not already done, configure it so that it does everything you want. If in doubt, you can simply copy /etc/syslog.conf to /etc/rsyslog.conf and you probably have what you want. The really important thing in rsyslogd configuration is that you must make it listen to tcp port 61514 (remember: this is where stunnel send the messages to). Thankfully, this is easy to achive: just add "-t 61514" to the rsyslogd startup options in your system startup script. After done so, start (or restart) rsyslogd.rh,h.h4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMX^Now you have stunnel running, but it obviously unable to talk to rsyslog - because it is not yet running. If not already done, configure it so that it does everything you want. If in doubt, you can simply copy /etc/syslog.conf to /etc/rsyslog.conf and you probably have what you want. The really important thing in rsyslogd configuration is that you must make it listen to tcp port 61514 (remember: this is where stunnel send the messages to). Thankfully, this is easy to achive: just add "-t 61514" to the rsyslogd startup options in your system startup script. After done so, start (or restart) rsyslogd.rr}r(h+jh,jubaubhQ)r}r(h+X+The server should now be fully operational.rh,h.h4h5h6hTh8}r(h:]h;]h<]h=]h@]uhBKhChhD]rhMX+The server should now be fully operational.rr}r(h+jh,jubaubeubh4h5h6Usystem_messagerh8}r(h:]UlevelKh=]h<]rjRaUsourceh5h;]h@]UlineKUtypeUINFOruhBKhChhD]rhQ)r}r(h+XHDuplicate explicit target name: "http://www.stunnel.org/faq/certs.html".h8}r(h:]h;]h<]h=]h@]uh,h)hD]rhMXHDuplicate explicit target name: "http://www.stunnel.org/faq/certs.html".rr}r(h+Uh,jubah6hTubaubaUcurrent_sourcerNU decorationrNUautofootnote_startrKUnameidsr}r(hjhjhhh h?h hh hh jh j(hj]hhhjhjohjhhthjhj3hjhhjhjLhjJhjBhj hjphhhjhjnh jIh!jh"jh#juhD]rh2ah+UU transformerrNU footnote_refsr}rUrefnamesr}r(Xrainer gerhards]r(jjjjjj-eXadiscon]rjauUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhChU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhJNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh5Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformr Ustrip_elements_with_classesr NU _config_filesr ]Ufile_insertion_enabledr U raw_enabledr KU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(jpjlhhjojkhhjjhhjjhhjjjjj(j$jh.j]jYjLjHhhjjjjjRjNjJjFjIh0h?h2j3j/jj jjjBj>j jjjjnjjjjjhjdhthnuUsubstitution_namesr}rh6hCh8}r(h:]h=]h<]Usourceh5h;]h@]uU footnotesr]rUrefidsr}rub.build/.doctrees/development/0000775000175000017500000000000013035122643015046 5ustar rgerrgerbuild/.doctrees/development/config_data_model.doctree0000664000175000017500000006514013035122643022041 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xvariables/propertiesqNXglobal parametersqNXexpression evaluationqNX flat elementsq NXmodulesq NXnote on queue objectsq NXthe rsyslog config data modelq NXrulesetsq NXcontrol-of-flow statementsqNXexecution statementsqNXinputsqNXobjectsqNXhierarchical elementsqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUvariables-propertiesqhUglobal-parametersqhUexpression-evaluationqh U flat-elementsqh Umodulesq h Unote-on-queue-objectsq!h Uthe-rsyslog-config-data-modelq"h Urulesetsq#hUcontrol-of-flow-statementsq$hUexecution-statementsq%hUinputsq&hUobjectsq'hUhierarchical-elementsq(uUchildrenq)]q*(cdocutils.nodes section q+)q,}q-(U rawsourceq.UUparentq/hUsourceq0XD/home/rger/proj/rsyslog-doc/source/development/config_data_model.rstq1Utagnameq2Usectionq3U attributesq4}q5(Udupnamesq6]Uclassesq7]Ubackrefsq8]Uidsq9]q:h"aUnamesq;]qhh)]q?(cdocutils.nodes title q@)qA}qB(h.XThe rsyslog config data modelqCh/h,h0h1h2UtitleqDh4}qE(h6]h7]h8]h9]h;]uh=Kh>hh)]qFcdocutils.nodes Text qGXThe rsyslog config data modelqHqI}qJ(h.hCh/hAubaubcdocutils.nodes paragraph qK)qL}qM(h.XThis document describes the config data model on a high layer. For details, it is suggested to review the actual source code. The aim of this document is to provide general understanding for both rsyslog developers as well as developers writing config management systems.qNh/h,h0h1h2U paragraphqOh4}qP(h6]h7]h8]h9]h;]uh=Kh>hh)]qQhGXThis document describes the config data model on a high layer. For details, it is suggested to review the actual source code. The aim of this document is to provide general understanding for both rsyslog developers as well as developers writing config management systems.qRqS}qT(h.hNh/hLubaubeubh+)qU}qV(h.Uh/hh0h1h2h3h4}qW(h6]h7]h8]h9]qXh'ah;]qYhauh=K h>hh)]qZ(h@)q[}q\(h.XObjectsq]h/hUh0h1h2hDh4}q^(h6]h7]h8]h9]h;]uh=K h>hh)]q_hGXObjectsq`qa}qb(h.h]h/h[ubaubhK)qc}qd(h.XMost config objects life in a flat space and are global to rsyslog. However, actual rule processing is done via a script-like language. These config scripts need to be represented via a tree structure.qeh/hUh0h1h2hOh4}qf(h6]h7]h8]h9]h;]uh=K h>hh)]qghGXMost config objects life in a flat space and are global to rsyslog. However, actual rule processing is done via a script-like language. These config scripts need to be represented via a tree structure.qhqi}qj(h.heh/hcubaubhK)qk}ql(h.X6Note that the language as currently implemented is Turing-complete if the user makes use of very tricky constructs. It was never our intention to provide a Turing-complete language and we will probably try to disable these tricks in the future. However, this is not a priority for us, as these users get what they deserve. For someone involved with the config, it probably is sufficient to know that loops are **not** supported by the config language (even though you can create loop-like structures). Thus, a tree is fully sufficient to represent any configuration.h/hUh0h1h2hOh4}qm(h6]h7]h8]h9]h;]uh=Kh>hh)]qn(hGXNote that the language as currently implemented is Turing-complete if the user makes use of very tricky constructs. It was never our intention to provide a Turing-complete language and we will probably try to disable these tricks in the future. However, this is not a priority for us, as these users get what they deserve. For someone involved with the config, it probably is sufficient to know that loops are qoqp}qq(h.XNote that the language as currently implemented is Turing-complete if the user makes use of very tricky constructs. It was never our intention to provide a Turing-complete language and we will probably try to disable these tricks in the future. However, this is not a priority for us, as these users get what they deserve. For someone involved with the config, it probably is sufficient to know that loops are h/hkubcdocutils.nodes strong qr)qs}qt(h.X**not**h4}qu(h6]h7]h8]h9]h;]uh/hkh)]qvhGXnotqwqx}qy(h.Uh/hsubah2UstrongqzubhGX supported by the config language (even though you can create loop-like structures). Thus, a tree is fully sufficient to represent any configuration.q{q|}q}(h.X supported by the config language (even though you can create loop-like structures). Thus, a tree is fully sufficient to represent any configuration.h/hkubeubhK)q~}q(h.XwIn the following sections, we'll quickly describe variables/properties, flat structure elements and the execution tree.qh/hUh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXwIn the following sections, we'll quickly describe variables/properties, flat structure elements and the execution tree.qq}q(h.hh/h~ubaubh+)q}q(h.Uh/hUh0h1h2h3h4}q(h6]h7]h8]h9]qhah;]qhauh=Kh>hh)]q(h@)q}q(h.XVariables/Propertiesqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXVariables/Propertiesqq}q(h.hh/hubaubhK)q}q(h.XRsyslog supportsqh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGXRsyslog supportsqq}q(h.hh/hubaubcdocutils.nodes bullet_list q)q}q(h.Uh/hh0h1h2U bullet_listqh4}q(UbulletqX*h9]h8]h6]h7]h;]uh=K!h>hh)]q(cdocutils.nodes list_item q)q}q(h.X1traditional syslog (RFC-based) message propertiesqh/hh0h1h2U list_itemqh4}q(h6]h7]h8]h9]h;]uh=Nh>hh)]qhK)q}q(h.hh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K!h)]qhGX1traditional syslog (RFC-based) message propertiesqq}q(h.hh/hubaubaubh)q}q(h.X<structured data content, including any non-syslog propertiesqh/hh0h1h2hh4}q(h6]h7]h8]h9]h;]uh=Nh>hh)]qhK)q}q(h.hh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K"h)]qhGX<structured data content, including any non-syslog propertiesqq}q(h.hh/hubaubaubh)q}q(h.XJVariables - global - local - message-enhancing (like message properties) h/hh0Nh2hh4}q(h6]h7]h8]h9]h;]uh=Nh>hh)]q(hK)q}q(h.X Variablesqh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K#h)]qhGX Variablesqƅq}q(h.hh/hubaubh)q}q(h.Uh4}q(hX-h9]h8]h6]h7]h;]uh/hh)]q(h)q}q(h.Xglobalqh4}q(h6]h7]h8]h9]h;]uh/hh)]qhK)q}q(h.hh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K%h)]qhGXglobalqօq}q(h.hh/hubaubah2hubh)q}q(h.Xlocalqh4}q(h6]h7]h8]h9]h;]uh/hh)]qhK)q}q(h.hh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K&h)]qhGXlocalq⅁q}q(h.hh/hubaubah2hubh)q}q(h.X,message-enhancing (like message properties) h4}q(h6]h7]h8]h9]h;]uh/hh)]qhK)q}q(h.X+message-enhancing (like message properties)qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K'h)]qhGX+message-enhancing (like message properties)qq}q(h.hh/hubaubah2hubeh2hubeubeubhK)q}q(h.XA description of these properties and variables is available elsewhere. As far as a config processor is concerned, the important thing to know is that they be used during template definitions and script operations.qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K)h>hh)]qhGXA description of these properties and variables is available elsewhere. As far as a config processor is concerned, the important thing to know is that they be used during template definitions and script operations.qq}q(h.hh/hubaubeubh+)q}q(h.Uh/hUh0h1h2h3h4}q(h6]h7]h8]h9]qhah;]qh auh=K.h>hh)]q(h@)q}r(h.X Flat Elementsrh/hh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=K.h>hh)]rhGX Flat Elementsrr}r(h.jh/hubaubh+)r}r(h.Uh/hh0h1h2h3h4}r (h6]h7]h8]h9]r hah;]r hauh=K1h>hh)]r (h@)r }r(h.XGlobal Parametersrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=K1h>hh)]rhGXGlobal Parametersrr}r(h.jh/j ubaubhK)r}r(h.XThis element must contain all global parameters settable by rsyslog. This includes elements from the global() as well as main_queue() config statements. As of this writing, some global parameter can only be set by legacy statements.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=K2h>hh)]rhGXThis element must contain all global parameters settable by rsyslog. This includes elements from the global() as well as main_queue() config statements. As of this writing, some global parameter can only be set by legacy statements.rr}r(h.jh/jubaubhK)r}r(h.X:Note that main_queue() actually is a full queue defintion.rh/jh0h1h2hOh4}r (h6]h7]h8]h9]h;]uh=K7h>hh)]r!hGX:Note that main_queue() actually is a full queue defintion.r"r#}r$(h.jh/jubaubeubh+)r%}r&(h.Uh/hh0h1h2h3h4}r'(h6]h7]h8]h9]r(h ah;]r)h auh=K:h>hh)]r*(h@)r+}r,(h.XModulesr-h/j%h0h1h2hDh4}r.(h6]h7]h8]h9]h;]uh=K:h>hh)]r/hGXModulesr0r1}r2(h.j-h/j+ubaubhK)r3}r4(h.X/This contains all loaded modules, among others:r5h/j%h0h1h2hOh4}r6(h6]h7]h8]h9]h;]uh=K;h>hh)]r7hGX/This contains all loaded modules, among others:r8r9}r:(h.j5h/j3ubaubh)r;}r<(h.Uh/j%h0h1h2hh4}r=(hX*h9]h8]h6]h7]h;]uh=K=h>hh)]r>(h)r?}r@(h.X input modulesrAh/j;h0h1h2hh4}rB(h6]h7]h8]h9]h;]uh=Nh>hh)]rChK)rD}rE(h.jAh/j?h0h1h2hOh4}rF(h6]h7]h8]h9]h;]uh=K=h)]rGhGX input modulesrHrI}rJ(h.jAh/jDubaubaubh)rK}rL(h.Xoutput modulesrMh/j;h0h1h2hh4}rN(h6]h7]h8]h9]h;]uh=Nh>hh)]rOhK)rP}rQ(h.jMh/jKh0h1h2hOh4}rR(h6]h7]h8]h9]h;]uh=K>h)]rShGXoutput modulesrTrU}rV(h.jMh/jPubaubaubh)rW}rX(h.Xmessage modification modulesrYh/j;h0h1h2hh4}rZ(h6]h7]h8]h9]h;]uh=Nh>hh)]r[hK)r\}r](h.jYh/jWh0h1h2hOh4}r^(h6]h7]h8]h9]h;]uh=K?h)]r_hGXmessage modification modulesr`ra}rb(h.jYh/j\ubaubaubh)rc}rd(h.Xmessage parsers h/j;h0h1h2hh4}re(h6]h7]h8]h9]h;]uh=Nh>hh)]rfhK)rg}rh(h.Xmessage parsersrih/jch0h1h2hOh4}rj(h6]h7]h8]h9]h;]uh=K@h)]rkhGXmessage parsersrlrm}rn(h.jih/jgubaubaubeubhK)ro}rp(h.XpNote that for historical reasons some output modules are directly linked into rsyslog and must not be specified.rqh/j%h0h1h2hOh4}rr(h6]h7]h8]h9]h;]uh=KBh>hh)]rshGXpNote that for historical reasons some output modules are directly linked into rsyslog and must not be specified.rtru}rv(h.jqh/joubaubhK)rw}rx(h.X_Each module must be given only once. The data object must contain all module-global parameters.ryh/j%h0h1h2hOh4}rz(h6]h7]h8]h9]h;]uh=KEh>hh)]r{hGX_Each module must be given only once. The data object must contain all module-global parameters.r|r}}r~(h.jyh/jwubaubeubh+)r}r(h.Uh/hh0h1h2h3h4}r(h6]h7]h8]h9]rh&ah;]rhauh=KIh>hh)]r(h@)r}r(h.XInputsrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=KIh>hh)]rhGXInputsrr}r(h.jh/jubaubhK)r}r(h.XDescribes all defined inputs with their parameters. Is build from the input() statement or its legacy equivalent (ugly). Contains links torh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KJh>hh)]rhGXDescribes all defined inputs with their parameters. Is build from the input() statement or its legacy equivalent (ugly). Contains links torr}r(h.jh/jubaubh)r}r(h.Uh/jh0h1h2hh4}r(hX*h9]h8]h6]h7]h;]uh=KMh>hh)]r(h)r}r(h.Xmodule used for inputrh/jh0h1h2hh4}r(h6]h7]h8]h9]h;]uh=Nh>hh)]rhK)r}r(h.jh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KMh)]rhGXmodule used for inputrr}r(h.jh/jubaubaubh)r}r(h.Xruleset used for processing h/jh0h1h2hh4}r(h6]h7]h8]h9]h;]uh=Nh>hh)]rhK)r}r(h.Xruleset used for processingrh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KNh)]rhGXruleset used for processingrr}r(h.jh/jubaubaubeubeubh+)r}r(h.Uh/hh0h1h2h3h4}r(h6]h7]h8]h9]rh#ah;]rh auh=KQh>hh)]r(h@)r}r(h.XRulesetsrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=KQh>hh)]rhGXRulesetsrr}r(h.jh/jubaubhK)r}r(h.XThey contain the tree-like execution structure. However, rulesets itself are flat and cannot be nested. Note that there exists statements that permit rulesets to call into each other, but all rulesets are in the same flat top-level space.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KRh>hh)]rhGXThey contain the tree-like execution structure. However, rulesets itself are flat and cannot be nested. Note that there exists statements that permit rulesets to call into each other, but all rulesets are in the same flat top-level space.rr}r(h.jh/jubaubhK)r}r(h.XNote that a ruleset has an associated queue object. In most cases, it needs not to be configured as a real queue (not one in direct mode) is only required in special cases.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KWh>hh)]rhGXNote that a ruleset has an associated queue object. In most cases, it needs not to be configured as a real queue (not one in direct mode) is only required in special cases.rr}r(h.jh/jubaubeubeubh+)r}r(h.Uh/hUh0h1h2h3h4}r(h6]h7]h8]h9]rh(ah;]rhauh=K\h>hh)]r(h@)r}r(h.XHierarchical Elementsrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=K\h>hh)]rhGXHierarchical Elementsrr}r(h.jh/jubaubhK)r}r(h.XThese are used for rule exection. They are somewhat hard to fit into a traditional config scheme, as they provide full tree-like branching structure.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=K]h>hh)]rhGXThese are used for rule exection. They are somewhat hard to fit into a traditional config scheme, as they provide full tree-like branching structure.rr}r(h.jh/jubaubhK)r}r(h.XBasically, a tree consists of statements and evaluations. Consider the ruleset to be the root of the execution tree. It is rather common that the tree's main level is a long linked list, with only actions being branched out. This, for example, happens with a traditional rsyslog.conf setting, which only contains files to be written based on some priority filters. However, one must not be tricked into thinking that this basic case is sufficient to support as enterprise users typically create far more complex cases.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kah>hh)]rhGXBasically, a tree consists of statements and evaluations. Consider the ruleset to be the root of the execution tree. It is rather common that the tree's main level is a long linked list, with only actions being branched out. This, for example, happens with a traditional rsyslog.conf setting, which only contains files to be written based on some priority filters. However, one must not be tricked into thinking that this basic case is sufficient to support as enterprise users typically create far more complex cases.rr}r(h.jh/jubaubhK)r}r(h.XIn essence, rsyslog walks the tree, and executes statements while it does so. Usually, a filter needs to be evaluated and execution branches based on the filter outcome. The tree actually **is** an AST.h/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kjh>hh)]r(hGXIn essence, rsyslog walks the tree, and executes statements while it does so. Usually, a filter needs to be evaluated and execution branches based on the filter outcome. The tree actually rr}r(h.XIn essence, rsyslog walks the tree, and executes statements while it does so. Usually, a filter needs to be evaluated and execution branches based on the filter outcome. The tree actually h/jubhr)r}r(h.X**is**h4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXisrr}r(h.Uh/jubah2hzubhGX an AST.rr}r(h.X an AST.h/jubeubh+)r}r(h.Uh/jh0h1h2h3h4}r(h6]h7]h8]h9]rh%ah;]rhauh=Koh>hh)]r(h@)r}r(h.XExecution Statementsrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=Koh>hh)]rhGXExecution Statementsr r }r (h.jh/jubaubhK)r }r (h.X8These are most easy to implement as they are end nodes (and as such nothing can be nested under them). They are most importantly created by the action() config object, but also with statements like "set" and "unset". Note that "call" is also considered a terminal node, even though it executes *another* ruleset.h/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kph>hh)]r(hGX&These are most easy to implement as they are end nodes (and as such nothing can be nested under them). They are most importantly created by the action() config object, but also with statements like "set" and "unset". Note that "call" is also considered a terminal node, even though it executes rr}r(h.X&These are most easy to implement as they are end nodes (and as such nothing can be nested under them). They are most importantly created by the action() config object, but also with statements like "set" and "unset". Note that "call" is also considered a terminal node, even though it executes h/j ubcdocutils.nodes emphasis r)r}r(h.X *another*h4}r(h6]h7]h8]h9]h;]uh/j h)]rhGXanotherrr}r(h.Uh/jubah2UemphasisrubhGX ruleset.rr}r(h.X ruleset.h/j ubeubhK)r}r (h.XSNote that actions have associated queues, so a queue object and its parameter need to be present. When building configurations interactively, it is suggested that the default is either not to configure queue parameters by default or to do this only for actions where it makes sense (e.g. connection to remote systems which may go offline).r!h/jh0h1h2hOh4}r"(h6]h7]h8]h9]h;]uh=Kvh>hh)]r#hGXSNote that actions have associated queues, so a queue object and its parameter need to be present. When building configurations interactively, it is suggested that the default is either not to configure queue parameters by default or to do this only for actions where it makes sense (e.g. connection to remote systems which may go offline).r$r%}r&(h.j!h/jubaubeubh+)r'}r((h.Uh/jh0h1h2h3h4}r)(h6]h7]h8]h9]r*hah;]r+hauh=K}h>hh)]r,(h@)r-}r.(h.XExpression Evaluationr/h/j'h0h1h2hDh4}r0(h6]h7]h8]h9]h;]uh=K}h>hh)]r1hGXExpression Evaluationr2r3}r4(h.j/h/j-ubaubhK)r5}r6(h.XA full expression evaluation engine is available who does the typical programming-language type of expression processing. The usual mathematical, boolean and string operations are supported, as well as functions. As of this writing, functions are hardcoded into rsyslog but may in the future be part of a loadable module. Evaluations can access all rsyslog properties and variables. They may be nested arbitrarily deep.r7h/j'h0h1h2hOh4}r8(h6]h7]h8]h9]h;]uh=K~h>hh)]r9hGXA full expression evaluation engine is available who does the typical programming-language type of expression processing. The usual mathematical, boolean and string operations are supported, as well as functions. As of this writing, functions are hardcoded into rsyslog but may in the future be part of a loadable module. Evaluations can access all rsyslog properties and variables. They may be nested arbitrarily deep.r:r;}r<(h.j7h/j5ubaubeubh+)r=}r>(h.Uh/jh0h1h2h3h4}r?(h6]h7]h8]h9]r@h$ah;]rAhauh=Kh>hh)]rB(h@)rC}rD(h.XControl-of-Flow StatementsrEh/j=h0h1h2hDh4}rF(h6]h7]h8]h9]h;]uh=Kh>hh)]rGhGXControl-of-Flow StatementsrHrI}rJ(h.jEh/jCubaubhK)rK}rL(h.XfRemember that rsyslog does intentionally not support loop statements. So control-of-flow boils down torMh/j=h0h1h2hOh4}rN(h6]h7]h8]h9]h;]uh=Kh>hh)]rOhGXfRemember that rsyslog does intentionally not support loop statements. So control-of-flow boils down torPrQ}rR(h.jMh/jKubaubh)rS}rT(h.Uh/j=h0h1h2hh4}rU(hX*h9]h8]h6]h7]h;]uh=Kh>hh)]rV(h)rW}rX(h.Xiconditional statements - "if ... then ... else ..." - syslog PRI-based filters - property-based filters h/jSh0Nh2hh4}rY(h6]h7]h8]h9]h;]uh=Nh>hh)]rZ(hK)r[}r\(h.Xconditional statementsr]h/jWh0h1h2hOh4}r^(h6]h7]h8]h9]h;]uh=Kh)]r_hGXconditional statementsr`ra}rb(h.j]h/j[ubaubh)rc}rd(h.Uh4}re(hX-h9]h8]h6]h7]h;]uh/jWh)]rf(h)rg}rh(h.X"if ... then ... else ..."rih4}rj(h6]h7]h8]h9]h;]uh/jch)]rkhK)rl}rm(h.jih/jgh0h1h2hOh4}rn(h6]h7]h8]h9]h;]uh=Kh)]rohGX"if ... then ... else ..."rprq}rr(h.jih/jlubaubah2hubh)rs}rt(h.Xsyslog PRI-based filtersruh4}rv(h6]h7]h8]h9]h;]uh/jch)]rwhK)rx}ry(h.juh/jsh0h1h2hOh4}rz(h6]h7]h8]h9]h;]uh=Kh)]r{hGXsyslog PRI-based filtersr|r}}r~(h.juh/jxubaubah2hubh)r}r(h.Xproperty-based filters h4}r(h6]h7]h8]h9]h;]uh/jch)]rhK)r}r(h.Xproperty-based filtersrh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh)]rhGXproperty-based filtersrr}r(h.jh/jubaubah2hubeh2hubeubh)r}r(h.Xstop h/jSh0h1h2hh4}r(h6]h7]h8]h9]h;]uh=Nh>hh)]rhK)r}r(h.Xstoprh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh)]rhGXstoprr}r(h.jh/jubaubaubeubhK)r}r(h.XpWhere "stop" terminates processing of this message. The conditional statements contain subbranches, where "if" contains both "then" and "else" subbranches and the other two only the "then" subranch (Note: inside the execution engine, the others may also have "else" branches, but these are result of the rsyslog config optimizer run and cannot configured by the user).rh/j=h0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXpWhere "stop" terminates processing of this message. The conditional statements contain subbranches, where "if" contains both "then" and "else" subbranches and the other two only the "then" subranch (Note: inside the execution engine, the others may also have "else" branches, but these are result of the rsyslog config optimizer run and cannot configured by the user).rr}r(h.jh/jubaubhK)r}r(h.XWhen executing a config script, rsyslog executes the subbranch in question and then continues to evaluate the next statement in the currently executing branch that contained the conditional statement. If there is no next statement, it goes up one layer. This is continued until the last statement of the root statement list is reached. At that point execution of the message is terminated and the message object destructed. Again, think AST, as this is exactly what it is.rh/j=h0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXWhen executing a config script, rsyslog executes the subbranch in question and then continues to evaluate the next statement in the currently executing branch that contained the conditional statement. If there is no next statement, it goes up one layer. This is continued until the last statement of the root statement list is reached. At that point execution of the message is terminated and the message object destructed. Again, think AST, as this is exactly what it is.rr}r(h.jh/jubaubeubeubh+)r}r(h.Uh/hUh0h1h2h3h4}r(h6]h7]h8]h9]rh!ah;]rh auh=Kh>hh)]r(h@)r}r(h.XNote on Queue Objectsrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXNote on Queue Objectsrr}r(h.jh/jubaubhK)r}r(h.X Queue objects are **not** named objects inside the rsyslog configuration. So their data is always contained with the object that uses the queue (action(), ruleset(), main_queue()). From a UI perspective, this unfortunately tends to complicate a config builder a bit.h/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(hGXQueue objects are rr}r(h.XQueue objects are h/jubhr)r}r(h.X**not**h4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXnotrr}r(h.Uh/jubah2hzubhGX named objects inside the rsyslog configuration. So their data is always contained with the object that uses the queue (action(), ruleset(), main_queue()). From a UI perspective, this unfortunately tends to complicate a config builder a bit.rr}r(h.X named objects inside the rsyslog configuration. So their data is always contained with the object that uses the queue (action(), ruleset(), main_queue()). From a UI perspective, this unfortunately tends to complicate a config builder a bit.h/jubeubeubeubeh.UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh>hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhDNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingr Uutf-8r U source_urlr NUinput_encodingr U utf-8-sigr U_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh1Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesr NU _config_filesr!]Ufile_insertion_enabledr"U raw_enabledr#KU dump_settingsr$NubUsymbol_footnote_startr%KUidsr&}r'(h&jh%jh!jhjh j%h#jh(jhhhhh'hUh"h,hj'h$j=uUsubstitution_namesr(}r)h2h>h4}r*(h6]h9]h8]Usourceh1h7]h;]uU footnotesr+]r,Urefidsr-}r.ub.build/.doctrees/development/dev_queue.doctree0000664000175000017500000016330613035122643020410 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$http://www.gnu.org/copyleft/fdl.htmlqXda run mode shutdownqNX copyrightqNXthe rsyslog queue objectq NXsome definitionsq NXda run mode initializationq NXadisconq Xdisk-assisted modeq NXimplementation detailsqNXrsyslogqXqueue destructionqNXrainer gerhardsquUsubstitution_defsq}qXimage0qcdocutils.nodes substitution_definition q)q}q(U rawsourceqX).. |image0| image:: queueWorkerLogic.jpg Uparentqcdocutils.nodes section q)q}q(hUhh)q}q(hUhh)q}q (hUhhUsourceq!X</home/rger/proj/rsyslog-doc/source/development/dev_queue.rstq"Utagnameq#Usectionq$U attributesq%}q&(Udupnamesq']Uclassesq(]Ubackrefsq)]Uidsq*]q+Uthe-rsyslog-queue-objectq,aUnamesq-]q.h auUlineq/KUdocumentq0hUchildrenq1]q2(cdocutils.nodes title q3)q4}q5(hXThe rsyslog queue objectq6hhh!h"h#Utitleq7h%}q8(h']h(]h)]h*]h-]uh/Kh0hh1]q9cdocutils.nodes Text q:XThe rsyslog queue objectq;q<}q=(hh6hh4ubaubcdocutils.nodes paragraph q>)q?}q@(hXThis page reflects the status as of 2008-01-17. The documentation is still incomplete. Target audience is developers and users who would like to get an in-depth understanding of queues as used in `rsyslog `_.hhh!h"h#U paragraphqAh%}qB(h']h(]h)]h*]h-]uh/Kh0hh1]qC(h:XThis page reflects the status as of 2008-01-17. The documentation is still incomplete. Target audience is developers and users who would like to get an in-depth understanding of queues as used in qDqE}qF(hXThis page reflects the status as of 2008-01-17. The documentation is still incomplete. Target audience is developers and users who would like to get an in-depth understanding of queues as used in hh?ubcdocutils.nodes reference qG)qH}qI(hX$`rsyslog `_h%}qJ(UnamehUrefuriqKXhttp://www.rsyslog.com/qLh*]h)]h']h(]h-]uhh?h1]qMh:XrsyslogqNqO}qP(hUhhHubah#U referenceqQubcdocutils.nodes target qR)qS}qT(hX U referencedqUKhh?h#UtargetqVh%}qW(UrefurihLh*]qXUrsyslogqYah)]h']h(]h-]qZhauh1]ubh:X.q[}q\(hX.hh?ubeubh>)q]}q^(hX;**Please note that this document is outdated and does not longer reflect the specifics of the queue object. However, I have decided to leave it in the doc set, as the overall picture provided still is quite OK. I intend to update this document somewhat later when I have reached the "store-and-forward" milestone.**q_hhh!h"h#hAh%}q`(h']h(]h)]h*]h-]uh/K h0hh1]qacdocutils.nodes strong qb)qc}qd(hh_h%}qe(h']h(]h)]h*]h-]uhh]h1]qfh:X7Please note that this document is outdated and does not longer reflect the specifics of the queue object. However, I have decided to leave it in the doc set, as the overall picture provided still is quite OK. I intend to update this document somewhat later when I have reached the "store-and-forward" milestone.qgqh}qi(hUhhcubah#Ustrongqjubaubh)qk}ql(hUhhh!h"h#h$h%}qm(h']h(]h)]h*]qnUsome-definitionsqoah-]qph auh/Kh0hh1]qq(h3)qr}qs(hXSome definitionsqthhkh!h"h#h7h%}qu(h']h(]h)]h*]h-]uh/Kh0hh1]qvh:XSome definitionsqwqx}qy(hhthhrubaubh>)qz}q{(hXA queue is DA-enabled if it is configured to use disk-assisted mode when there is need to. A queue is in DA mode (or DA run mode), when it actually runs disk assisted.q|hhkh!h"h#hAh%}q}(h']h(]h)]h*]h-]uh/Kh0hh1]q~h:XA queue is DA-enabled if it is configured to use disk-assisted mode when there is need to. A queue is in DA mode (or DA run mode), when it actually runs disk assisted.qq}q(hh|hhzubaubeubheubh!h"h#h$h%}q(h']h(]h)]h*]qUimplementation-detailsqah-]qhauh/Kh0hh1]q(h3)q}q(hXImplementation Detailsqhhh!h"h#h7h%}q(h']h(]h)]h*]h-]uh/Kh0hh1]qh:XImplementation Detailsqq}q(hhhhubaubh)q}q(hUhhh!h"h#h$h%}q(h']h(]h)]h*]qUdisk-assisted-modeqah-]qh auh/Kh0hh1]q(h3)q}q(hXDisk-Assisted Modeqhhh!h"h#h7h%}q(h']h(]h)]h*]h-]uh/Kh0hh1]qh:XDisk-Assisted Modeqq}q(hhhhubaubh>)q}q(hXZMemory-Type queues may utilize disk-assisted (DA) mode. DA mode is enabled whenever a queue file name prefix is provided. This is called DA-enabled mode. If DA-enabled, the queue operates as a regular memory queue until a high water mark is reached. If that happens, the queue activates disk assistance (called "runs disk assisted" or "runs DA" - you can find that often in source file comments). To do so, it creates a helper queue instance (the DA queue). At that point, there are two queues running - the primary queue's consumer changes to a shuffle-to-DA-queue consumer and the original primary consumer is assigned to the DA queue. Existing and new messages are spooled to the disk queue, where the DA worker takes them from and passes them for execution to the actual consumer. In essence, the primary queue has now become a memory buffer for the DA queue. The primary queue will be drained until a low water mark is reached. At that point, processing is held. New messages enqueued to the primary queue will not be processed but kept in memory. Processing resumes when either the high water mark is reached again or the DA queue indicates it is empty. If the DA queue is empty, it is shut down and processing of the primary queue continues as a regular in-memory queue (aka "DA mode is shut down"). The whole thing iterates once the high water mark is hit again.qhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/Kh0hh1]qh:XZMemory-Type queues may utilize disk-assisted (DA) mode. DA mode is enabled whenever a queue file name prefix is provided. This is called DA-enabled mode. If DA-enabled, the queue operates as a regular memory queue until a high water mark is reached. If that happens, the queue activates disk assistance (called "runs disk assisted" or "runs DA" - you can find that often in source file comments). To do so, it creates a helper queue instance (the DA queue). At that point, there are two queues running - the primary queue's consumer changes to a shuffle-to-DA-queue consumer and the original primary consumer is assigned to the DA queue. Existing and new messages are spooled to the disk queue, where the DA worker takes them from and passes them for execution to the actual consumer. In essence, the primary queue has now become a memory buffer for the DA queue. The primary queue will be drained until a low water mark is reached. At that point, processing is held. New messages enqueued to the primary queue will not be processed but kept in memory. Processing resumes when either the high water mark is reached again or the DA queue indicates it is empty. If the DA queue is empty, it is shut down and processing of the primary queue continues as a regular in-memory queue (aka "DA mode is shut down"). The whole thing iterates once the high water mark is hit again.qq}q(hhhhubaubh>)q}q(hX There is one special case: if the primary queue is shut down and could not finish processing all messages within the configured timeout periods, the DA queue is instantiated to take up the remaining messages. These will be preserved and be processed during the next run. During that period, the DA queue runs in "enqueue-only" mode and does not execute any consumer. Draining the primary queue is typically very fast. If that behaviour is not desired, it can be turned of via parameters. In that case, any remaining in-memory messages are lost.qhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/K1h0hh1]qh:X There is one special case: if the primary queue is shut down and could not finish processing all messages within the configured timeout periods, the DA queue is instantiated to take up the remaining messages. These will be preserved and be processed during the next run. During that period, the DA queue runs in "enqueue-only" mode and does not execute any consumer. Draining the primary queue is typically very fast. If that behaviour is not desired, it can be turned of via parameters. In that case, any remaining in-memory messages are lost.qq}q(hhhhubaubh>)q}q(hXDue to the fact that when running DA two queues work closely together and worker threads (including the DA worker) may shut down at any time (due to timeout), processing synchronization and startup and shutdown is somewhat complex. I'll outline the exact conditions and steps down here. I also do this so that I know clearly what to develop to, so please be patient if the information is a bit too in-depth ;)qhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/K:h0hh1]qh:XDue to the fact that when running DA two queues work closely together and worker threads (including the DA worker) may shut down at any time (due to timeout), processing synchronization and startup and shutdown is somewhat complex. I'll outline the exact conditions and steps down here. I also do this so that I know clearly what to develop to, so please be patient if the information is a bit too in-depth ;)qq}q(hhhhubaubeubh)q}q(hUhhh!h"h#h$h%}q(h']h(]h)]h*]qUda-run-mode-initializationqah-]qh auh/KBh0hh1]q(h3)q}q(hXDA Run Mode Initializationqhhh!h"h#h7h%}q(h']h(]h)]h*]h-]uh/KBh0hh1]qh:XDA Run Mode Initializationq…q}q(hhhhubaubh>)q}q(hX Three cases:qhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/KDh0hh1]qh:X Three cases:qʅq}q(hhhhubaubcdocutils.nodes enumerated_list q)q}q(hUhhh!h"h#Uenumerated_listqh%}q(UsuffixqU.h*]h)]h']UprefixqUh(]h-]UenumtypeqUarabicquh/KFh0hh1]q(cdocutils.nodes list_item q)q}q(hX=any time during queueEnqObj() when the high water mark is hitqhhh!h"h#U list_itemqh%}q(h']h(]h)]h*]h-]uh/Nh0hh1]qh>)q}q(hhhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/KFh1]qh:X=any time during queueEnqObj() when the high water mark is hitq⅁q}q(hhhhubaubaubh)q}q(hXlat queue startup if there is an on-disk queue present (presence of QI file indicates presence of queue data)hhh!h"h#hh%}q(h']h(]h)]h*]h-]uh/Nh0hh1]qh>)q}q(hXlat queue startup if there is an on-disk queue present (presence of QI file indicates presence of queue data)qhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/KGh1]qh:Xlat queue startup if there is an on-disk queue present (presence of QI file indicates presence of queue data)qq}q(hhhhubaubaubh)q}q(hXLat queue shutdown if remaining in-memory data needs to be persisted to disk hhh!h"h#hh%}q(h']h(]h)]h*]h-]uh/Nh0hh1]qh>)q}q(hXKat queue shutdown if remaining in-memory data needs to be persisted to diskqhhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/KIh1]qh:XKat queue shutdown if remaining in-memory data needs to be persisted to diskqq}q(hhhhubaubaubeubh>)q}q(hXXIn **case 1**, the worker pool is running. When switching to DA mode, all regular workers are sent termination commands. The DA worker is initiated. Regular workers may run in parallel to the DA worker until they terminate. Regular workers shall terminate as soon as their current consumer has completed. They shall not execute the DA consumer.hhh!h"h#hAh%}q(h']h(]h)]h*]h-]uh/KLh0hh1]r(h:XIn rr}r(hXIn hhubhb)r}r(hX **case 1**h%}r(h']h(]h)]h*]h-]uhhh1]rh:Xcase 1rr }r (hUhjubah#hjubh:XK, the worker pool is running. When switching to DA mode, all regular workers are sent termination commands. The DA worker is initiated. Regular workers may run in parallel to the DA worker until they terminate. Regular workers shall terminate as soon as their current consumer has completed. They shall not execute the DA consumer.r r }r (hXK, the worker pool is running. When switching to DA mode, all regular workers are sent termination commands. The DA worker is initiated. Regular workers may run in parallel to the DA worker until they terminate. Regular workers shall terminate as soon as their current consumer has completed. They shall not execute the DA consumer.hhubeubh>)r}r(hXaIn **case 2**, the worker pool is not yet running and is NOT started. The DA worker is initiated.hhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/KRh0hh1]r(h:XIn rr}r(hXIn hjubhb)r}r(hX **case 2**h%}r(h']h(]h)]h*]h-]uhjh1]rh:Xcase 2rr}r(hUhjubah#hjubh:XT, the worker pool is not yet running and is NOT started. The DA worker is initiated.rr}r(hXT, the worker pool is not yet running and is NOT started. The DA worker is initiated.hjubeubh>)r}r (hXxIn **case 3**, the worker pool is already shut down. The DA worker is initiated. The DA queue runs in enqueue-only mode.hhh!h"h#hAh%}r!(h']h(]h)]h*]h-]uh/KUh0hh1]r"(h:XIn r#r$}r%(hXIn hjubhb)r&}r'(hX **case 3**h%}r((h']h(]h)]h*]h-]uhjh1]r)h:Xcase 3r*r+}r,(hUhj&ubah#hjubh:Xk, the worker pool is already shut down. The DA worker is initiated. The DA queue runs in enqueue-only mode.r-r.}r/(hXk, the worker pool is already shut down. The DA worker is initiated. The DA queue runs in enqueue-only mode.hjubeubh>)r0}r1(hXIn all cases, the DA worker starts up and checks if DA mode is already fully initialized. If not, it initializes it, what most importantly means construction of the queue.r2hhh!h"h#hAh%}r3(h']h(]h)]h*]h-]uh/KXh0hh1]r4h:XIn all cases, the DA worker starts up and checks if DA mode is already fully initialized. If not, it initializes it, what most importantly means construction of the queue.r5r6}r7(hj2hj0ubaubh>)r8}r9(hXThen, regular worker processing is carried out. That is, the queue worker will wait on empty queue and terminate after an timeout. However, If any message is received, the DA consumer is executed. That consumer checks the low water mark. If the low water mark is reached, it stops processing until either the high water mark is reached again or the DA queue indicates it is empty (there is a pthread\_cond\_t for this synchronization).hhh!h"h#hAh%}r:(h']h(]h)]h*]h-]uh/K\h0hh1]r;h:XThen, regular worker processing is carried out. That is, the queue worker will wait on empty queue and terminate after an timeout. However, If any message is received, the DA consumer is executed. That consumer checks the low water mark. If the low water mark is reached, it stops processing until either the high water mark is reached again or the DA queue indicates it is empty (there is a pthread_cond_t for this synchronization).r<r=}r>(hXThen, regular worker processing is carried out. That is, the queue worker will wait on empty queue and terminate after an timeout. However, If any message is received, the DA consumer is executed. That consumer checks the low water mark. If the low water mark is reached, it stops processing until either the high water mark is reached again or the DA queue indicates it is empty (there is a pthread\_cond\_t for this synchronization).hj8ubaubh>)r?}r@(hXIn theory, a **case-2** startup could lead to the worker becoming inactive and terminating while waiting on the primary queue to fill. In practice, this is highly unlikely (but only for the main message queue) because rsyslog issues a startup message. HOWEVER, we can not rely on that, it would introduce a race. If the primary rsyslog thread (the one that issues the message) is scheduled very late and there is a low inactivity timeout for queue workers, the queue worker may terminate before the startup message is issued. And if the on-disk queue holds only a few messages, it may become empty before the DA worker is re-initiated again. So it is possible that the DA run mode termination criteria occurs while no DA worker is running on the primary queue.hhh!h"h#hAh%}rA(h']h(]h)]h*]h-]uh/Kdh0hh1]rB(h:X In theory, a rCrD}rE(hX In theory, a hj?ubhb)rF}rG(hX **case-2**h%}rH(h']h(]h)]h*]h-]uhj?h1]rIh:Xcase-2rJrK}rL(hUhjFubah#hjubh:X startup could lead to the worker becoming inactive and terminating while waiting on the primary queue to fill. In practice, this is highly unlikely (but only for the main message queue) because rsyslog issues a startup message. HOWEVER, we can not rely on that, it would introduce a race. If the primary rsyslog thread (the one that issues the message) is scheduled very late and there is a low inactivity timeout for queue workers, the queue worker may terminate before the startup message is issued. And if the on-disk queue holds only a few messages, it may become empty before the DA worker is re-initiated again. So it is possible that the DA run mode termination criteria occurs while no DA worker is running on the primary queue.rMrN}rO(hX startup could lead to the worker becoming inactive and terminating while waiting on the primary queue to fill. In practice, this is highly unlikely (but only for the main message queue) because rsyslog issues a startup message. HOWEVER, we can not rely on that, it would introduce a race. If the primary rsyslog thread (the one that issues the message) is scheduled very late and there is a low inactivity timeout for queue workers, the queue worker may terminate before the startup message is issued. And if the on-disk queue holds only a few messages, it may become empty before the DA worker is re-initiated again. So it is possible that the DA run mode termination criteria occurs while no DA worker is running on the primary queue.hj?ubeubh>)rP}rQ(hXIn cases 1 and 3, the DA worker can never become inactive without hitting the DA shutdown criteria. In **case 1**, it either shuffles messages from the primary to the DA queue or it waits because it has the hit low water mark.hhh!h"h#hAh%}rR(h']h(]h)]h*]h-]uh/Kph0hh1]rS(h:XgIn cases 1 and 3, the DA worker can never become inactive without hitting the DA shutdown criteria. In rTrU}rV(hXgIn cases 1 and 3, the DA worker can never become inactive without hitting the DA shutdown criteria. In hjPubhb)rW}rX(hX **case 1**h%}rY(h']h(]h)]h*]h-]uhjPh1]rZh:Xcase 1r[r\}r](hUhjWubah#hjubh:Xq, it either shuffles messages from the primary to the DA queue or it waits because it has the hit low water mark.r^r_}r`(hXq, it either shuffles messages from the primary to the DA queue or it waits because it has the hit low water mark.hjPubeubh>)ra}rb(hXIn **case 3**, it always shuffles messages between the queues (because, that's the sole purpose of that run). In order for this to happen, the high water mark has been set to the value of 1 when DA run mode has been initialized. This ensures that the regular logic can be applied to drain the primary queue. To prevent a hold due to reaching the low water mark, that mark must be changed to 0 before the DA worker starts.hhh!h"h#hAh%}rc(h']h(]h)]h*]h-]uh/Kuh0hh1]rd(h:XIn rerf}rg(hXIn hjaubhb)rh}ri(hX **case 3**h%}rj(h']h(]h)]h*]h-]uhjah1]rkh:Xcase 3rlrm}rn(hUhjhubah#hjubh:X, it always shuffles messages between the queues (because, that's the sole purpose of that run). In order for this to happen, the high water mark has been set to the value of 1 when DA run mode has been initialized. This ensures that the regular logic can be applied to drain the primary queue. To prevent a hold due to reaching the low water mark, that mark must be changed to 0 before the DA worker starts.rorp}rq(hX, it always shuffles messages between the queues (because, that's the sole purpose of that run). In order for this to happen, the high water mark has been set to the value of 1 when DA run mode has been initialized. This ensures that the regular logic can be applied to drain the primary queue. To prevent a hold due to reaching the low water mark, that mark must be changed to 0 before the DA worker starts.hjaubeubeubhh)rr}rs(hUhhh!h"h#h$h%}rt(h']h(]h)]h*]ruUqueue-destructionrvah-]rwhauh/Kh0hh1]rx(h3)ry}rz(hXQueue Destructionr{hjrh!h"h#h7h%}r|(h']h(]h)]h*]h-]uh/Kh0hh1]r}h:XQueue Destructionr~r}r(hj{hjyubaubh>)r}r(hX.Now let's consider **the case of destruction of the primary queue.**\ During destruction, our focus is on loosing as few messages as possible. If the queue is not DA-enabled, there is nothing but the configured timeouts to handle that situation. However, with a DA-enabled queue there are more options.hjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(h:XNow let's consider rr}r(hXNow let's consider hjubhb)r}r(hX1**the case of destruction of the primary queue.**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X-the case of destruction of the primary queue.rr}r(hUhjubah#hjubh:XDuring destruction, our focus is on loosing as few messages as possible. If the queue is not DA-enabled, there is nothing but the configured timeouts to handle that situation. However, with a DA-enabled queue there are more options.rr}r(hX\ During destruction, our focus is on loosing as few messages as possible. If the queue is not DA-enabled, there is nothing but the configured timeouts to handle that situation. However, with a DA-enabled queue there are more options.hjubeubh>)r}r(hX If the queue is DA-enabled, it may be *configured to persist messages to disk before it is terminated*. In that case, loss of messages never occurs (at the price of a potentially lengthy shutdown). Even if that setting is not applied, the queue should drain as many messages as possible to the disk. For that reason, it makes no sense to wait on a low water mark. Also, if the queue is already in DA run mode, it does not make any sense to switch back to regular run mode during termination and then try to process some messages via the regular consumer. It is much more appropriate the try completely drain the queue during the remaining timeout period. For the same reason, it is preferred that no new consumers be activated (via the DA queue's worker), as they only cost valuable CPU cycles and, more importantly, would potentially be long(er)-running and possibly be needed to be cancelled. To prevent all of that, **queue parameters are changed for DA-enabled queues:** the high water mark is to 1 and the low water mark to 0 on the primary queue. The DA queue is commanded to run in enqueue-only mode. If the primary queue is *configured to persist messages to disk before it is terminated*, its SHUTDOWN timeout is changed to to eternal. These parameters will cause the queue to drain as much as possible to disk (and they may cause a case 3 DA run mode initiation). Please note that once the primary queue has been drained, the DA queue's worker will automatically switch back to regular (non-DA) run mode. **It must be ensured that no worker cancellation occurs during that switchback**. Please note that the queue may not switch back to regular run mode if it is not *configured to persist messages to disk before it is terminated*. In order to apply the new parameters, **worker threads must be awakened.** Remember we may not be in DA run mode at this stage. In that case, the regular workers must be awakened, which then will switch to DA run mode. No worker may be active, in that case one must be initiated. If in DA run mode and the DA worker is inactive, the  "*DA worker startup initiation*\ " must be called to activate it. That routine ensures only one DA worker is started even with multiple concurrent callers - this may be the case here. The DA queue's worker may have requested DA worker startup in order to terminate on empty queue (which will probably not be honored as we have changed the low water mark).hjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(h:X&If the queue is DA-enabled, it may be rr}r(hX&If the queue is DA-enabled, it may be hjubcdocutils.nodes emphasis r)r}r(hX@*configured to persist messages to disk before it is terminated*h%}r(h']h(]h)]h*]h-]uhjh1]rh:X>configured to persist messages to disk before it is terminatedrr}r(hUhjubah#Uemphasisrubh:X1. In that case, loss of messages never occurs (at the price of a potentially lengthy shutdown). Even if that setting is not applied, the queue should drain as many messages as possible to the disk. For that reason, it makes no sense to wait on a low water mark. Also, if the queue is already in DA run mode, it does not make any sense to switch back to regular run mode during termination and then try to process some messages via the regular consumer. It is much more appropriate the try completely drain the queue during the remaining timeout period. For the same reason, it is preferred that no new consumers be activated (via the DA queue's worker), as they only cost valuable CPU cycles and, more importantly, would potentially be long(er)-running and possibly be needed to be cancelled. To prevent all of that, rr}r(hX1. In that case, loss of messages never occurs (at the price of a potentially lengthy shutdown). Even if that setting is not applied, the queue should drain as many messages as possible to the disk. For that reason, it makes no sense to wait on a low water mark. Also, if the queue is already in DA run mode, it does not make any sense to switch back to regular run mode during termination and then try to process some messages via the regular consumer. It is much more appropriate the try completely drain the queue during the remaining timeout period. For the same reason, it is preferred that no new consumers be activated (via the DA queue's worker), as they only cost valuable CPU cycles and, more importantly, would potentially be long(er)-running and possibly be needed to be cancelled. To prevent all of that, hjubhb)r}r(hX7**queue parameters are changed for DA-enabled queues:**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X3queue parameters are changed for DA-enabled queues:rr}r(hUhjubah#hjubh:X the high water mark is to 1 and the low water mark to 0 on the primary queue. The DA queue is commanded to run in enqueue-only mode. If the primary queue is rr}r(hX the high water mark is to 1 and the low water mark to 0 on the primary queue. The DA queue is commanded to run in enqueue-only mode. If the primary queue is hjubj)r}r(hX@*configured to persist messages to disk before it is terminated*h%}r(h']h(]h)]h*]h-]uhjh1]rh:X>configured to persist messages to disk before it is terminatedrr}r(hUhjubah#jubh:X?, its SHUTDOWN timeout is changed to to eternal. These parameters will cause the queue to drain as much as possible to disk (and they may cause a case 3 DA run mode initiation). Please note that once the primary queue has been drained, the DA queue's worker will automatically switch back to regular (non-DA) run mode. rr}r(hX?, its SHUTDOWN timeout is changed to to eternal. These parameters will cause the queue to drain as much as possible to disk (and they may cause a case 3 DA run mode initiation). Please note that once the primary queue has been drained, the DA queue's worker will automatically switch back to regular (non-DA) run mode. hjubhb)r}r(hXP**It must be ensured that no worker cancellation occurs during that switchback**h%}r(h']h(]h)]h*]h-]uhjh1]rh:XLIt must be ensured that no worker cancellation occurs during that switchbackrr}r(hUhjubah#hjubh:XR. Please note that the queue may not switch back to regular run mode if it is not rr}r(hXR. Please note that the queue may not switch back to regular run mode if it is not hjubj)r}r(hX@*configured to persist messages to disk before it is terminated*h%}r(h']h(]h)]h*]h-]uhjh1]rh:X>configured to persist messages to disk before it is terminatedrr}r(hUhjubah#jubh:X(. In order to apply the new parameters, rr}r(hX(. In order to apply the new parameters, hjubhb)r}r(hX$**worker threads must be awakened.**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X worker threads must be awakened.rr}r(hUhjubah#hjubh:X Remember we may not be in DA run mode at this stage. In that case, the regular workers must be awakened, which then will switch to DA run mode. No worker may be active, in that case one must be initiated. If in DA run mode and the DA worker is inactive, the  "rr}r(hX Remember we may not be in DA run mode at this stage. In that case, the regular workers must be awakened, which then will switch to DA run mode. No worker may be active, in that case one must be initiated. If in DA run mode and the DA worker is inactive, the  "hjubj)r}r(hX*DA worker startup initiation*h%}r(h']h(]h)]h*]h-]uhjh1]rh:XDA worker startup initiationrr}r(hUhjubah#jubh:XB" must be called to activate it. That routine ensures only one DA worker is started even with multiple concurrent callers - this may be the case here. The DA queue's worker may have requested DA worker startup in order to terminate on empty queue (which will probably not be honored as we have changed the low water mark).rr}r(hXD\ " must be called to activate it. That routine ensures only one DA worker is started even with multiple concurrent callers - this may be the case here. The DA queue's worker may have requested DA worker startup in order to terminate on empty queue (which will probably not be honored as we have changed the low water mark).hjubeubh>)r}r(hXXAfter all this is done, the queue destructor requests termination of the queue's worker threads. It will use the normal timeouts and potentially cancel too-long running worker threads. **The shutdown process must ensure that all workers reach running state before they are commanded to terminate**. Otherwise it may run into a race condition that could lead to a false shutdown with workers running asynchronously. As a few workers may have just been started to initialize (to apply new parameter settings), the probability for this race condition is extremely high, especially on single-CPU systems.hjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Mh0hh1]r(h:XAfter all this is done, the queue destructor requests termination of the queue's worker threads. It will use the normal timeouts and potentially cancel too-long running worker threads. rr}r(hXAfter all this is done, the queue destructor requests termination of the queue's worker threads. It will use the normal timeouts and potentially cancel too-long running worker threads. hjubhb)r}r(hXp**The shutdown process must ensure that all workers reach running state before they are commanded to terminate**h%}r(h']h(]h)]h*]h-]uhjh1]rh:XlThe shutdown process must ensure that all workers reach running state before they are commanded to terminaterr}r(hUhjubah#hjubh:X/. Otherwise it may run into a race condition that could lead to a false shutdown with workers running asynchronously. As a few workers may have just been started to initialize (to apply new parameter settings), the probability for this race condition is extremely high, especially on single-CPU systems.rr}r(hX/. Otherwise it may run into a race condition that could lead to a false shutdown with workers running asynchronously. As a few workers may have just been started to initialize (to apply new parameter settings), the probability for this race condition is extremely high, especially on single-CPU systems.hjubeubh>)r}r(hX9After all workers have been shut down (or cancelled), the queue may still be in DA run mode. If so, this must be terminated, which now can simply be done by destructing the DA queue object. This is not a real switchback to regular run mode, but that doesn't matter because the queue object will soon be gone away.rhjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Mh0hh1]rh:X9After all workers have been shut down (or cancelled), the queue may still be in DA run mode. If so, this must be terminated, which now can simply be done by destructing the DA queue object. This is not a real switchback to regular run mode, but that doesn't matter because the queue object will soon be gone away.rr}r(hjhjubaubh>)r}r(hXsFinally, the queue is mostly shut down and ready to be actually destructed. As a last try, the queuePersists() entry point is called. It is used to persists a non-DA-enabled queue in whatever way is possible for that queue. There may be no implementation for the specific queue type. Please note that this is not just a theoretical construct. This is an extremely important code path when the DA queue itself is destructed. Remember that it is a queue object in its own right. The DA queue is obviously not DA-enabled, so it calls into queuePersists() during its destruction - this is what enables us to persist the disk queue!rhjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Mh0hh1]rh:XsFinally, the queue is mostly shut down and ready to be actually destructed. As a last try, the queuePersists() entry point is called. It is used to persists a non-DA-enabled queue in whatever way is possible for that queue. There may be no implementation for the specific queue type. Please note that this is not just a theoretical construct. This is an extremely important code path when the DA queue itself is destructed. Remember that it is a queue object in its own right. The DA queue is obviously not DA-enabled, so it calls into queuePersists() during its destruction - this is what enables us to persist the disk queue!rr}r(hjhjubaubh>)r}r(hXAfter that point, left over queue resources (mutexes, dynamic memory, ...) are freed and the queue object is actually destructed.rhjrh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/M)h0hh1]rh:XAfter that point, left over queue resources (mutexes, dynamic memory, ...) are freed and the queue object is actually destructed.rr}r (hjhjubaubeubh)r }r (hUhhh!h"h#h$h%}r (h']h(]h)]h*]r U copyrightrah-]rhauh/M/h0hh1]r(h3)r}r(hX Copyrightrhj h!h"h#h7h%}r(h']h(]h)]h*]h-]uh/M/h0hh1]rh:X Copyrightrr}r(hjhjubaubh>)r}r(hXxCopyright (c) 2008-2014 `Rainer Gerhards `_ and `Adiscon `_.hj h!h"h#hAh%}r(h']h(]h)]h*]h-]uh/M1h0hh1]r(h:XCopyright (c) 2008-2014 rr}r(hXCopyright (c) 2008-2014 hjubhG)r }r!(hX3`Rainer Gerhards `_h%}r"(UnameXRainer GerhardshKXhttp://www.gerhards.net/rainerr#h*]h)]h']h(]h-]uhjh1]r$h:XRainer Gerhardsr%r&}r'(hUhj ubah#hQubhR)r(}r)(hX! hUKhjh#hVh%}r*(Urefurij#h*]r+Urainer-gerhardsr,ah)]h']h(]h-]r-hauh1]ubh:X and r.r/}r0(hX and hjubhG)r1}r2(hX'`Adiscon `_h%}r3(UnameXAdisconhKXhttp://www.adiscon.com/en/r4h*]h)]h']h(]h-]uhjh1]r5h:XAdisconr6r7}r8(hUhj1ubah#hQubhR)r9}r:(hX hUKhjh#hVh%}r;(Urefurij4h*]r<Uadisconr=ah)]h']h(]h-]r>h auh1]ubh:X.r?}r@(hX.hjubeubh>)rA}rB(hXPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.hj h!h"h#hAh%}rC(h']h(]h)]h*]h-]uh/M4h0hh1]rD(h:X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at rErF}rG(hX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at hjAubhG)rH}rI(hXN`http://www.gnu.org/copyleft/fdl.html `_h%}rJ(UnamehhKX$http://www.gnu.org/copyleft/fdl.htmlrKh*]h)]h']h(]h-]uhjAh1]rLh:X$http://www.gnu.org/copyleft/fdl.htmlrMrN}rO(hUhjHubah#hQubhR)rP}rQ(hX' hUKhjAh#hVh%}rR(UrefurijKh*]rSU"http-www-gnu-org-copyleft-fdl-htmlrTah)]h']h(]h-]rUhauh1]ubh:X.rV}rW(hX.hjAubeubeubeubh!h"h#h$h%}rX(h']h(]h)]h*]rYUda-run-mode-shutdownrZah-]r[hauh/K}h0hh1]r\(h3)r]}r^(hXDA Run Mode Shutdownr_hhh!h"h#h7h%}r`(h']h(]h)]h*]h-]uh/K}h0hh1]rah:XDA Run Mode Shutdownrbrc}rd(hj_hj]ubaubh>)re}rf(hXIn essence, DA run mode is terminated when the DA queue is empty and the primary worker queue size is below the high water mark. It is also terminated when the primary queue is shut down. The decision to switch back to regular (non-DA) run mode is typically made by the DA worker. If it switches, the DA queue is destructed and the regular worker pool is restarted. In some cases, the queue shutdown process may initiate the "switch" (in this case more or less a clean shutdown of the DA queue).rghhh!h"h#hAh%}rh(h']h(]h)]h*]h-]uh/Kh0hh1]rih:XIn essence, DA run mode is terminated when the DA queue is empty and the primary worker queue size is below the high water mark. It is also terminated when the primary queue is shut down. The decision to switch back to regular (non-DA) run mode is typically made by the DA worker. If it switches, the DA queue is destructed and the regular worker pool is restarted. In some cases, the queue shutdown process may initiate the "switch" (in this case more or less a clean shutdown of the DA queue).rjrk}rl(hjghjeubaubh>)rm}rn(hXOne might think that it would be more natural for the DA queue to detect being idle and shut down itself. However, there are some issues associated with that. Most importantly, all queue worker threads need to be shut down during queue destruction. Only after that has happened, final destruction steps can happen (else we would have a myriad of races). However, it is the DA queues worker thread that detects it is empty (empty queue detection always happens at the consumer side and must so). That would lead to the DA queue worker thread to initiate DA queue destruction which in turn would lead to that very same thread being canceled (because workers must shut down before the queue can be destructed). Obviously, this does not work out (and I didn't even mention the other issues - so let's forget about it). As such, the thread that enqueues messages must destruct the queue - and that is the primary queue's DA worker thread.rohhh!h"h#hAh%}rp(h']h(]h)]h*]h-]uh/Kh0hh1]rqh:XOne might think that it would be more natural for the DA queue to detect being idle and shut down itself. However, there are some issues associated with that. Most importantly, all queue worker threads need to be shut down during queue destruction. Only after that has happened, final destruction steps can happen (else we would have a myriad of races). However, it is the DA queues worker thread that detects it is empty (empty queue detection always happens at the consumer side and must so). That would lead to the DA queue worker thread to initiate DA queue destruction which in turn would lead to that very same thread being canceled (because workers must shut down before the queue can be destructed). Obviously, this does not work out (and I didn't even mention the other issues - so let's forget about it). As such, the thread that enqueues messages must destruct the queue - and that is the primary queue's DA worker thread.rrrs}rt(hjohjmubaubh>)ru}rv(hXThere are some subtleties due to thread synchronization and the fact that the DA consumer may not be running (in a **case-2 startup**). So it is not trivial to reliably change the queue back from DA run mode to regular run mode. The priority is a clean switch. We accept the fact that there may be situations where we cleanly shut down DA run mode, just to re-enable it with the very next message being enqueued. While unlikely, this will happen from time to time and is considered perfectly legal. We can't predict the future and it would introduce too great complexity to try to do something against that (that would most probably even lead to worse performance under regular conditions).hhh!h"h#hAh%}rw(h']h(]h)]h*]h-]uh/Kh0hh1]rx(h:XsThere are some subtleties due to thread synchronization and the fact that the DA consumer may not be running (in a ryrz}r{(hXsThere are some subtleties due to thread synchronization and the fact that the DA consumer may not be running (in a hjuubhb)r|}r}(hX**case-2 startup**h%}r~(h']h(]h)]h*]h-]uhjuh1]rh:Xcase-2 startuprr}r(hUhj|ubah#hjubh:X-). So it is not trivial to reliably change the queue back from DA run mode to regular run mode. The priority is a clean switch. We accept the fact that there may be situations where we cleanly shut down DA run mode, just to re-enable it with the very next message being enqueued. While unlikely, this will happen from time to time and is considered perfectly legal. We can't predict the future and it would introduce too great complexity to try to do something against that (that would most probably even lead to worse performance under regular conditions).rr}r(hX-). So it is not trivial to reliably change the queue back from DA run mode to regular run mode. The priority is a clean switch. We accept the fact that there may be situations where we cleanly shut down DA run mode, just to re-enable it with the very next message being enqueued. While unlikely, this will happen from time to time and is considered perfectly legal. We can't predict the future and it would introduce too great complexity to try to do something against that (that would most probably even lead to worse performance under regular conditions).hjuubeubh>)r}r(hXFThe primary queue's DA worker thread may wait at two different places:rhhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]rh:XFThe primary queue's DA worker thread may wait at two different places:rr}r(hjhjubaubh)r}r(hUhhh!h"h#hh%}r(hU.h*]h)]h']hUh(]h-]hhuh/Kh0hh1]r(h)r}r(hXUafter reaching the low water mark and waiting for either high water or DA queue emptyhjh!h"h#hh%}r(h']h(]h)]h*]h-]uh/Nh0hh1]rh>)r}r(hXUafter reaching the low water mark and waiting for either high water or DA queue emptyrhjh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh1]rh:XUafter reaching the low water mark and waiting for either high water or DA queue emptyrr}r(hjhjubaubaubh)r}r(hX?at the regular pthread\_cond\_wait() on an empty primary queue hjh!h"h#hh%}r(h']h(]h)]h*]h-]uh/Nh0hh1]rh>)r}r(hX>at the regular pthread\_cond\_wait() on an empty primary queuerhjh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh1]rh:X<at the regular pthread_cond_wait() on an empty primary queuerr}r(hX>at the regular pthread\_cond\_wait() on an empty primary queuehjubaubaubeubh>)r}r(hXHCase 2 is unlikely, but may happen (see info above on a case 2 startup).rhhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]rh:XHCase 2 is unlikely, but may happen (see info above on a case 2 startup).rr}r(hjhjubaubh>)r}r(hX**The DA worker may also not wait at all,** because it is actively executing and shuffling messages between the queues. In that case, however, the program flow passes both of the two wait conditions but simply does not wait.hhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(hb)r}r(hX+**The DA worker may also not wait at all,**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X'The DA worker may also not wait at all,rr}r(hUhjubah#hjubh:X because it is actively executing and shuffling messages between the queues. In that case, however, the program flow passes both of the two wait conditions but simply does not wait.rr}r(hX because it is actively executing and shuffling messages between the queues. In that case, however, the program flow passes both of the two wait conditions but simply does not wait.hjubeubh>)r}r(hX**Finally, the DA worker may be inactive**\ (again, with a case-2 startup). In that case no work(er) at all is executed. Most importantly, without the DA worker being active, nobody will ever detect the need to change back to regular mode. If we have this situation, the very next message enqueued will cause the switch, because then the DA run mode shutdown criteria is met. However, it may take close to eternal for this message to arrive. During that time, disk and memory resources for the DA queue remain allocated. This also leaves processing in a sub-optimal state and it may take longer than necessary to switch back to regular queue mode when a message burst happens. In extreme cases, this could even lead to shutdown of DA run mode, which takes so long that the high water mark is passed and DA run mode is immediately re-initialized - while with an immediate switch, the message burst may have been able to be processed by the in-memory queue without DA support.hhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(hb)r}r(hX***Finally, the DA worker may be inactive**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X&Finally, the DA worker may be inactiverr}r(hUhjubah#hjubh:X(again, with a case-2 startup). In that case no work(er) at all is executed. Most importantly, without the DA worker being active, nobody will ever detect the need to change back to regular mode. If we have this situation, the very next message enqueued will cause the switch, because then the DA run mode shutdown criteria is met. However, it may take close to eternal for this message to arrive. During that time, disk and memory resources for the DA queue remain allocated. This also leaves processing in a sub-optimal state and it may take longer than necessary to switch back to regular queue mode when a message burst happens. In extreme cases, this could even lead to shutdown of DA run mode, which takes so long that the high water mark is passed and DA run mode is immediately re-initialized - while with an immediate switch, the message burst may have been able to be processed by the in-memory queue without DA support.rr}r(hX\ (again, with a case-2 startup). In that case no work(er) at all is executed. Most importantly, without the DA worker being active, nobody will ever detect the need to change back to regular mode. If we have this situation, the very next message enqueued will cause the switch, because then the DA run mode shutdown criteria is met. However, it may take close to eternal for this message to arrive. During that time, disk and memory resources for the DA queue remain allocated. This also leaves processing in a sub-optimal state and it may take longer than necessary to switch back to regular queue mode when a message burst happens. In extreme cases, this could even lead to shutdown of DA run mode, which takes so long that the high water mark is passed and DA run mode is immediately re-initialized - while with an immediate switch, the message burst may have been able to be processed by the in-memory queue without DA support.hjubeubh>)r}r(hXSo in short, it is desirable switch to regular run mode as soon as possible. To do this, we need an active DA worker. The easy solution is to initiate DA worker startup from the DA queue's worker once it detects empty condition. To do so, the DA queue's worker must call into a "*DA worker startup initiation*\ " routine inside the main queue. As a reminder, the DA worker will most probably not receive the "DA queue empty" signal in that case, because it will be long sent (in most cases) before the DA worker even waits for it. So **it is vital that DA run mode termination checks be done in the DA worker before it goes into any wait condition**.hhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(h:XSo in short, it is desirable switch to regular run mode as soon as possible. To do this, we need an active DA worker. The easy solution is to initiate DA worker startup from the DA queue's worker once it detects empty condition. To do so, the DA queue's worker must call into a "rr}r(hXSo in short, it is desirable switch to regular run mode as soon as possible. To do this, we need an active DA worker. The easy solution is to initiate DA worker startup from the DA queue's worker once it detects empty condition. To do so, the DA queue's worker must call into a "hjubj)r}r(hX*DA worker startup initiation*h%}r(h']h(]h)]h*]h-]uhjh1]rh:XDA worker startup initiationrr}r(hUhjubah#jubh:X" routine inside the main queue. As a reminder, the DA worker will most probably not receive the "DA queue empty" signal in that case, because it will be long sent (in most cases) before the DA worker even waits for it. So rr}r(hX\ " routine inside the main queue. As a reminder, the DA worker will most probably not receive the "DA queue empty" signal in that case, because it will be long sent (in most cases) before the DA worker even waits for it. So hjubhb)r}r(hXs**it is vital that DA run mode termination checks be done in the DA worker before it goes into any wait condition**h%}r(h']h(]h)]h*]h-]uhjh1]rh:Xoit is vital that DA run mode termination checks be done in the DA worker before it goes into any wait conditionrr}r(hUhjubah#hjubh:X.r}r(hX.hjubeubh>)r}r(hX Please note that the "*DA worker startup initiation*\ " routine may be called concurrently from multiple initiators. **To prevent a race, it must be guarded by the queue mutex**\ and return without any action (and no error code!) if the DA worker is already initiated.hhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]r(h:XPlease note that the "rr}r(hXPlease note that the "hjubj)r}r(hX*DA worker startup initiation*h%}r(h']h(]h)]h*]h-]uhjh1]rh:XDA worker startup initiationrr}r(hUhjubah#jubh:X?" routine may be called concurrently from multiple initiators. rr}r(hXA\ " routine may be called concurrently from multiple initiators. hjubhb)r}r(hX<**To prevent a race, it must be guarded by the queue mutex**h%}r(h']h(]h)]h*]h-]uhjh1]rh:X8To prevent a race, it must be guarded by the queue mutexrr}r(hUhjubah#hjubh:XYand return without any action (and no error code!) if the DA worker is already initiated.rr}r(hX[\ and return without any action (and no error code!) if the DA worker is already initiated.hjubeubh>)r}r(hXAll other cases can be handled by checking the termination criteria immediately at the start of the worker and then once again for each run. The logic follows this simplified flow diagram:rhhh!h"h#hAh%}r(h']h(]h)]h*]h-]uh/Kh0hh1]rh:XAll other cases can be handled by checking the termination criteria immediately at the start of the worker and then once again for each run. The logic follows this simplified flow diagram:rr }r (hjhjubaubhh>)r }r (hXSome of the more subtle aspects of worker processing (e.g. enqueue thread signaling and other fine things) have been left out in order to get the big picture. What is called "check DA mode switchback..." right after "worker init" is actually a check for the worker's termination criteria. Typically, **the worker termination criteria is a shutdown request**. However, **for a DA worker, termination is also requested if the queue size is below the high water mark AND the DA queue is empty**. There is also a third termination criteria and it is not even on the chart: that is the inactivity timeout, which exists in all modes. Note that while the inactivity timeout shuts down a thread, it logically does not terminate the worker pool (or DA worker): workers are restarted on an as-needed basis. However, inactivity timeouts are very important because they require us to restart workers in some situations where we may expect a running one. So always keep them on your mind.hhh!h"h#hAh%}r (h']h(]h)]h*]h-]uh/Kh0hh1]r(h:X,Some of the more subtle aspects of worker processing (e.g. enqueue thread signaling and other fine things) have been left out in order to get the big picture. What is called "check DA mode switchback..." right after "worker init" is actually a check for the worker's termination criteria. Typically, rr}r(hX,Some of the more subtle aspects of worker processing (e.g. enqueue thread signaling and other fine things) have been left out in order to get the big picture. What is called "check DA mode switchback..." right after "worker init" is actually a check for the worker's termination criteria. Typically, hj ubhb)r}r(hX9**the worker termination criteria is a shutdown request**h%}r(h']h(]h)]h*]h-]uhj h1]rh:X5the worker termination criteria is a shutdown requestrr}r(hUhjubah#hjubh:X . However, rr}r(hX . However, hj ubhb)r}r(hX{**for a DA worker, termination is also requested if the queue size is below the high water mark AND the DA queue is empty**h%}r(h']h(]h)]h*]h-]uhj h1]rh:Xwfor a DA worker, termination is also requested if the queue size is below the high water mark AND the DA queue is emptyr r!}r"(hUhjubah#hjubh:X. There is also a third termination criteria and it is not even on the chart: that is the inactivity timeout, which exists in all modes. Note that while the inactivity timeout shuts down a thread, it logically does not terminate the worker pool (or DA worker): workers are restarted on an as-needed basis. However, inactivity timeouts are very important because they require us to restart workers in some situations where we may expect a running one. So always keep them on your mind.r#r$}r%(hX. There is also a third termination criteria and it is not even on the chart: that is the inactivity timeout, which exists in all modes. Note that while the inactivity timeout shuts down a thread, it logically does not terminate the worker pool (or DA worker): workers are restarted on an as-needed basis. However, inactivity timeouts are very important because they require us to restart workers in some situations where we may expect a running one. So always keep them on your mind.hj ubeubeubh!h"h#Usubstitution_definitionr&h%}r'(h']h(]h)]h*]h-]r(hauh/Kh0hh1]r)cdocutils.nodes image r*)r+}r,(hXimage:: queueWorkerLogic.jpgh%}r-(UuriX development/queueWorkerLogic.jpgr.h*]h)]h']h(]U candidatesr/}r0U*j.sh-]Ualthuhhh1]h#Uimager1ubaubsUparse_messagesr2]r3Ucurrent_sourcer4NU decorationr5NUautofootnote_startr6KUnameidsr7}r8(hjThjZhjh h,h hoh hh j=h hhhhhYhjvhj,uh1]r9hahUU transformerr:NU footnote_refsr;}r<Urefnamesr=}r>Usymbol_footnotesr?]r@Uautofootnote_refsrA]rBUsymbol_footnote_refsrC]rDU citationsrE]rFh0hU current_linerGNUtransform_messagesrH]rIUreporterrJNUid_startrKKU autofootnotesrL]rMU citation_refsrN}rOUindirect_targetsrP]rQUsettingsrR(cdocutils.frontend Values rSorT}rU(Ufootnote_backlinksrVKUrecord_dependenciesrWNU rfc_base_urlrXUhttps://tools.ietf.org/html/rYU tracebackrZUpep_referencesr[NUstrip_commentsr\NU toc_backlinksr]Uentryr^U language_coder_Uenr`U datestampraNU report_levelrbKU _destinationrcNU halt_levelrdKU strip_classesreNh7NUerror_encoding_error_handlerrfUbackslashreplacergUdebugrhNUembed_stylesheetriUoutput_encoding_error_handlerrjUstrictrkU sectnum_xformrlKUdump_transformsrmNU docinfo_xformrnKUwarning_streamroNUpep_file_url_templaterpUpep-%04drqUexit_status_levelrrKUconfigrsNUstrict_visitorrtNUcloak_email_addressesruUtrim_footnote_reference_spacervUenvrwNUdump_pseudo_xmlrxNUexpose_internalsryNUsectsubtitle_xformrzU source_linkr{NUrfc_referencesr|NUoutput_encodingr}Uutf-8r~U source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh"Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjkUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(jTjPjj hhhhhhj=j9hohkjZhhYhSh,hj,j(jvjruUsubstitution_namesr}rhhsh#h0h%}r(h']h*]h)]Usourceh"h(]h-]uU footnotesr]rUrefidsr}rub.build/.doctrees/development/dev_oplugins.doctree0000664000175000017500000020633413035122643021123 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$http://www.gnu.org/copyleft/fdl.htmlqXgetting message dataqNX copyrightqNXwriting rsyslog output pluginsq NXtroubleshooting rsyslogq Xrainer gerhardsq Xbatching of messagesq NXadisconq X threadingqNXspecial topicsqNXgetting started and samplesqNX open issuesqNX#output plugin transaction interfaceqNX licensingqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU"http-www-gnu-org-copyleft-fdl-htmlqhUgetting-message-dataqhU copyrightqh Uwriting-rsyslog-output-pluginsq h Utroubleshooting-rsyslogq!h Urainer-gerhardsq"h Ubatching-of-messagesq#h Uadisconq$hU threadingq%hUspecial-topicsq&hUgetting-started-and-samplesq'hU open-issuesq(hU#output-plugin-transaction-interfaceq)hU licensingq*uUchildrenq+]q,cdocutils.nodes section q-)q.}q/(U rawsourceq0UUparentq1hUsourceq2X?/home/rger/proj/rsyslog-doc/source/development/dev_oplugins.rstq3Utagnameq4Usectionq5U attributesq6}q7(Udupnamesq8]Uclassesq9]Ubackrefsq:]Uidsq;]qh auUlineq?KUdocumentq@hh+]qA(cdocutils.nodes title qB)qC}qD(h0XWriting Rsyslog Output PluginsqEh1h.h2h3h4UtitleqFh6}qG(h8]h9]h:]h;]h=]uh?Kh@hh+]qHcdocutils.nodes Text qIXWriting Rsyslog Output PluginsqJqK}qL(h0hEh1hCubaubcdocutils.nodes paragraph qM)qN}qO(h0XHThis page is the begin of some developer documentation for writing output plugins. Doing so is quite easy (and that was a design goal), but there currently is only sparse documentation on the process available. I was tempted NOT to write this guide here because I know I will most probably not be able to write a complete guide.qPh1h.h2h3h4U paragraphqQh6}qR(h8]h9]h:]h;]h=]uh?Kh@hh+]qShIXHThis page is the begin of some developer documentation for writing output plugins. Doing so is quite easy (and that was a design goal), but there currently is only sparse documentation on the process available. I was tempted NOT to write this guide here because I know I will most probably not be able to write a complete guide.qTqU}qV(h0hPh1hNubaubhM)qW}qX(h0XnHowever, I finally concluded that it may be better to have some information and pointers than to have nothing.qYh1h.h2h3h4hQh6}qZ(h8]h9]h:]h;]h=]uh?K h@hh+]q[hIXnHowever, I finally concluded that it may be better to have some information and pointers than to have nothing.q\q]}q^(h0hYh1hWubaubh-)q_}q`(h0Uh1h.h2h3h4h5h6}qa(h8]h9]h:]h;]qbh'ah=]qchauh?Kh@hh+]qd(hB)qe}qf(h0XGetting Started and Samplesqgh1h_h2h3h4hFh6}qh(h8]h9]h:]h;]h=]uh?Kh@hh+]qihIXGetting Started and Samplesqjqk}ql(h0hgh1heubaubhM)qm}qn(h0XThe best to get started with rsyslog plugin development is by looking at existing plugins. All that start with "om" are **o**\ utput **m**\ odules. That means they are primarily thought of being message sinks. In theory, however, output plugins may aggergate other functionality, too. Nobody has taken this route so far so if you would like to do that, it is highly suggested to post your plan on the rsyslog mailing list, first (so that we can offer advise).h1h_h2h3h4hQh6}qo(h8]h9]h:]h;]h=]uh?Kh@hh+]qp(hIXxThe best to get started with rsyslog plugin development is by looking at existing plugins. All that start with "om" are qqqr}qs(h0XxThe best to get started with rsyslog plugin development is by looking at existing plugins. All that start with "om" are h1hmubcdocutils.nodes strong qt)qu}qv(h0X**o**h6}qw(h8]h9]h:]h;]h=]uh1hmh+]qxhIXoqy}qz(h0Uh1huubah4Ustrongq{ubhIXutput q|q}}q~(h0X\ utput h1hmubht)q}q(h0X**m**h6}q(h8]h9]h:]h;]h=]uh1hmh+]qhIXmq}q(h0Uh1hubah4h{ubhIX?odules. That means they are primarily thought of being message sinks. In theory, however, output plugins may aggergate other functionality, too. Nobody has taken this route so far so if you would like to do that, it is highly suggested to post your plan on the rsyslog mailing list, first (so that we can offer advise).qq}q(h0XA\ odules. That means they are primarily thought of being message sinks. In theory, however, output plugins may aggergate other functionality, too. Nobody has taken this route so far so if you would like to do that, it is highly suggested to post your plan on the rsyslog mailing list, first (so that we can offer advise).h1hmubeubhM)q}q(h0X The rsyslog distribution tarball contains the omstdout plugin which is extremely well targeted for getting started. Just note that this plugin itself is not meant for production use. But it is very simplistic and so a really good starting point to grasp the core ideas.qh1h_h2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh@hh+]qhIX The rsyslog distribution tarball contains the omstdout plugin which is extremely well targeted for getting started. Just note that this plugin itself is not meant for production use. But it is very simplistic and so a really good starting point to grasp the core ideas.qq}q(h0hh1hubaubhM)q}q(h0X@In any case, you should also read the comments in ./runtime/module-template.h. Output plugins are build based on a large set of code-generating macros. These macros handle most of the plumbing needed by the interface. As long as no special callback to rsyslog is needed (it typically is not), an output plugin does not really need to be aware that it is executed by rsyslog. As a plug-in programmer, you can (in most cases) "code as usual". However, all macros and entry points need to be provided and thus reading the code comments in the files mentioned is highly suggested.qh1h_h2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh@hh+]qhIX@In any case, you should also read the comments in ./runtime/module-template.h. Output plugins are build based on a large set of code-generating macros. These macros handle most of the plumbing needed by the interface. As long as no special callback to rsyslog is needed (it typically is not), an output plugin does not really need to be aware that it is executed by rsyslog. As a plug-in programmer, you can (in most cases) "code as usual". However, all macros and entry points need to be provided and thus reading the code comments in the files mentioned is highly suggested.qq}q(h0hh1hubaubhM)q}q(h0XFor testing, you need rsyslog's debugging support. Some useful information is given in "`troubleshooting rsyslog `_ from the doc set.h1h_h2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K'h@hh+]q(hIXXFor testing, you need rsyslog's debugging support. Some useful information is given in "qq}q(h0XXFor testing, you need rsyslog's debugging support. Some useful information is given in "h1hubcdocutils.nodes reference q)q}q(h0X.`troubleshooting rsyslog `_h6}q(UnameXtroubleshooting rsyslogUrefuriqXtroubleshoot.htmlqh;]h:]h8]h9]h=]uh1hh+]qhIXtroubleshooting rsyslogqq}q(h0Uh1hubah4U referencequbcdocutils.nodes target q)q}q(h0X U referencedqKh1hh4Utargetqh6}q(Urefurihh;]qh!ah:]h8]h9]h=]qh auh+]ubhIX from the doc set.qq}q(h0X from the doc set.h1hubeubeubh-)q}q(h0Uh1h.h2h3h4h5h6}q(h8]h9]h:]h;]qh&ah=]qhauh?K,h@hh+]q(hB)q}q(h0XSpecial Topicsqh1hh2h3h4hFh6}q(h8]h9]h:]h;]h=]uh?K,h@hh+]qhIXSpecial Topicsqq}q(h0hh1hubaubh-)q}q(h0Uh1hh2h3h4h5h6}q(h8]h9]h:]h;]qh%ah=]qhauh?K/h@hh+]q(hB)q}q(h0X Threadingqh1hh2h3h4hFh6}q(h8]h9]h:]h;]h=]uh?K/h@hh+]qhIX Threadingq΅q}q(h0hh1hubaubhM)q}q(h0X Rsyslog uses massive parallel processing and multithreading. However, a plugin's entry points are guaranteed to be never called concurrently **for the same action**. That means your plugin must be able to be called concurrently by two or more threads, but you can be sure that for the same instance no concurrent calls happen. This is guaranteed by the interface specification and the rsyslog core guards against multiple concurrent calls. An instance, in simple words, is one that shares a single instanceData structure.h1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K1h@hh+]q(hIXRsyslog uses massive parallel processing and multithreading. However, a plugin's entry points are guaranteed to be never called concurrently qՅq}q(h0XRsyslog uses massive parallel processing and multithreading. However, a plugin's entry points are guaranteed to be never called concurrently h1hubht)q}q(h0X**for the same action**h6}q(h8]h9]h:]h;]h=]uh1hh+]qhIXfor the same actionq܅q}q(h0Uh1hubah4h{ubhIXe. That means your plugin must be able to be called concurrently by two or more threads, but you can be sure that for the same instance no concurrent calls happen. This is guaranteed by the interface specification and the rsyslog core guards against multiple concurrent calls. An instance, in simple words, is one that shares a single instanceData structure.q߅q}q(h0Xe. That means your plugin must be able to be called concurrently by two or more threads, but you can be sure that for the same instance no concurrent calls happen. This is guaranteed by the interface specification and the rsyslog core guards against multiple concurrent calls. An instance, in simple words, is one that shares a single instanceData structure.h1hubeubhM)q}q(h0XSo as long as you do not mess around with global data, you do not need to think about multithreading (and can apply a purely sequential programming methodology).qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K:h@hh+]qhIXSo as long as you do not mess around with global data, you do not need to think about multithreading (and can apply a purely sequential programming methodology).q煁q}q(h0hh1hubaubhM)q}q(h0XPlease note that during the configuration parsing stage of execution, access to global variables for the configuration system is safe. In that stage, the core will only call sequentially into the plugin.qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K>h@hh+]qhIXPlease note that during the configuration parsing stage of execution, access to global variables for the configuration system is safe. In that stage, the core will only call sequentially into the plugin.qq}q(h0hh1hubaubeubh-)q}q(h0Uh1hh2h3h4h5h6}q(h8]h9]h:]h;]qhah=]qhauh?KCh@hh+]q(hB)q}q(h0XGetting Message Dataqh1hh2h3h4hFh6}q(h8]h9]h:]h;]h=]uh?KCh@hh+]qhIXGetting Message Dataqq}q(h0hh1hubaubhM)r}r(h0XThe doAction() entry point of your plugin is provided with messages to be processed. It will only be activated after filtering and all other conditions, so you do not need to apply any other conditional but can simply process the message.rh1hh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KEh@hh+]rhIXThe doAction() entry point of your plugin is provided with messages to be processed. It will only be activated after filtering and all other conditions, so you do not need to apply any other conditional but can simply process the message.rr}r(h0jh1jubaubhM)r}r (h0XNote that you do NOT receive the full internal representation of the message object. There are various (including historical) reasons for this and, among others, this is a design decision based on security.r h1hh2h3h4hQh6}r (h8]h9]h:]h;]h=]uh?KJh@hh+]r hIXNote that you do NOT receive the full internal representation of the message object. There are various (including historical) reasons for this and, among others, this is a design decision based on security.r r}r(h0j h1jubaubhM)r}r(h0XYour plugin will only receive what the end user has configured in a $template statement. However, starting with 4.1.6, there are two ways of receiving the template content. The default mode, and in most cases sufficient and optimal, is to receive a single string with the expanded template. As I said, this is usually optimal, think about writing things to files, emailing content or forwarding it.rh1hh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KNh@hh+]rhIXYour plugin will only receive what the end user has configured in a $template statement. However, starting with 4.1.6, there are two ways of receiving the template content. The default mode, and in most cases sufficient and optimal, is to receive a single string with the expanded template. As I said, this is usually optimal, think about writing things to files, emailing content or forwarding it.rr}r(h0jh1jubaubhM)r}r(h0XThe important philosophy is that a plugin should **never** reformat any of such strings - that would either remove the user's ability to fully control message formats or it would lead to duplicating code that is already present in the core. If you need some formatting that is not yet present in the core, suggest it to the rsyslog project, best done by sending a patch ;), and we will try hard to get it into the core (so far, we could accept all such suggestions - no promise, though).h1hh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KUh@hh+]r(hIX1The important philosophy is that a plugin should rr}r(h0X1The important philosophy is that a plugin should h1jubht)r}r (h0X **never**h6}r!(h8]h9]h:]h;]h=]uh1jh+]r"hIXneverr#r$}r%(h0Uh1jubah4h{ubhIX reformat any of such strings - that would either remove the user's ability to fully control message formats or it would lead to duplicating code that is already present in the core. If you need some formatting that is not yet present in the core, suggest it to the rsyslog project, best done by sending a patch ;), and we will try hard to get it into the core (so far, we could accept all such suggestions - no promise, though).r&r'}r((h0X reformat any of such strings - that would either remove the user's ability to fully control message formats or it would lead to duplicating code that is already present in the core. If you need some formatting that is not yet present in the core, suggest it to the rsyslog project, best done by sending a patch ;), and we will try hard to get it into the core (so far, we could accept all such suggestions - no promise, though).h1jubeubhM)r)}r*(h0XIf a single string seems not suitable for your application, the plugin can also request access to the template components. The typical use case seems to be databases, where you would like to access properties via specific fields. With that mode, you receive a char \*\* array, where each array element points to one field from the template (from left to right). Fields start at array index 0 and a NULL pointer means you have reached the end of the array (the typical Unix "poor man's linked list in an array" design). Note, however, that each of the individual components is a string. It is not a date stamp, number or whatever, but a string. This is because rsyslog processes strings (from a high-level design look at it) and so this is the natural data type. Feel free to convert to whatever you need, but keep in mind that malformed packets may have lead to field contents you'd never expected...h1hh2h3h4hQh6}r+(h8]h9]h:]h;]h=]uh?K]h@hh+]r,hIXIf a single string seems not suitable for your application, the plugin can also request access to the template components. The typical use case seems to be databases, where you would like to access properties via specific fields. With that mode, you receive a char ** array, where each array element points to one field from the template (from left to right). Fields start at array index 0 and a NULL pointer means you have reached the end of the array (the typical Unix "poor man's linked list in an array" design). Note, however, that each of the individual components is a string. It is not a date stamp, number or whatever, but a string. This is because rsyslog processes strings (from a high-level design look at it) and so this is the natural data type. Feel free to convert to whatever you need, but keep in mind that malformed packets may have lead to field contents you'd never expected...r-r.}r/(h0XIf a single string seems not suitable for your application, the plugin can also request access to the template components. The typical use case seems to be databases, where you would like to access properties via specific fields. With that mode, you receive a char \*\* array, where each array element points to one field from the template (from left to right). Fields start at array index 0 and a NULL pointer means you have reached the end of the array (the typical Unix "poor man's linked list in an array" design). Note, however, that each of the individual components is a string. It is not a date stamp, number or whatever, but a string. This is because rsyslog processes strings (from a high-level design look at it) and so this is the natural data type. Feel free to convert to whatever you need, but keep in mind that malformed packets may have lead to field contents you'd never expected...h1j)ubaubhM)r0}r1(h0X'If you like to use the array-based parameter passing method, think that it is only available in rsyslog 4.1.6 and above. If you can accept that your plugin will not be working with previous versions, you do not need to handle pre 4.1.6 cases. However, it would be "nice" if you shut down yourself in these cases - otherwise the older rsyslog core engine will pass you a string where you expect the array of pointers, what most probably results in a segfault. To check whether or not the core supports the functionality, you can use this code sequence:r2h1hh2h3h4hQh6}r3(h8]h9]h:]h;]h=]uh?Kkh@hh+]r4hIX'If you like to use the array-based parameter passing method, think that it is only available in rsyslog 4.1.6 and above. If you can accept that your plugin will not be working with previous versions, you do not need to handle pre 4.1.6 cases. However, it would be "nice" if you shut down yourself in these cases - otherwise the older rsyslog core engine will pass you a string where you expect the array of pointers, what most probably results in a segfault. To check whether or not the core supports the functionality, you can use this code sequence:r5r6}r7(h0j2h1j0ubaubcdocutils.nodes literal_block r8)r9}r:(h0XBEGINmodInit() rsRetVal localRet; rsRetVal (*pomsrGetSupportedTplOpts)(unsigned long *pOpts); unsigned long opts; int bArrayPassingSupported; /* does core support template passing as an array? */ CODESTARTmodInit *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */ CODEmodInit_QueryRegCFSLineHdlr /* check if the rsyslog core supports parameter passing code */ bArrayPassingSupported = 0; localRet = pHostQueryEtryPt((uchar*)"OMSRgetSupportedTplOpts", &pomsrGetSupportedTplOpts); if(localRet == RS_RET_OK) { /* found entry point, so let's see if core supports array passing */ CHKiRet((*pomsrGetSupportedTplOpts)(&opts)); if(opts & OMSR_TPL_AS_ARRAY) bArrayPassingSupported = 1; } else if(localRet != RS_RET_ENTRY_POINT_NOT_FOUND) { ABORT_FINALIZE(localRet); /* Something else went wrong, what is not acceptable */ } DBGPRINTF("omstdout: array-passing is %ssupported by rsyslog core.\n", bArrayPassingSupported ? "" : "not "); if(!bArrayPassingSupported) { DBGPRINTF("rsyslog core too old, shutting down this plug-in\n"); ABORT_FINALIZE(RS_RET_ERR); }h1hh2h3h4U literal_blockr;h6}r<(U xml:spacer=Upreserver>h;]h:]h8]h9]h=]uh?Kwh@hh+]r?hIXBEGINmodInit() rsRetVal localRet; rsRetVal (*pomsrGetSupportedTplOpts)(unsigned long *pOpts); unsigned long opts; int bArrayPassingSupported; /* does core support template passing as an array? */ CODESTARTmodInit *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */ CODEmodInit_QueryRegCFSLineHdlr /* check if the rsyslog core supports parameter passing code */ bArrayPassingSupported = 0; localRet = pHostQueryEtryPt((uchar*)"OMSRgetSupportedTplOpts", &pomsrGetSupportedTplOpts); if(localRet == RS_RET_OK) { /* found entry point, so let's see if core supports array passing */ CHKiRet((*pomsrGetSupportedTplOpts)(&opts)); if(opts & OMSR_TPL_AS_ARRAY) bArrayPassingSupported = 1; } else if(localRet != RS_RET_ENTRY_POINT_NOT_FOUND) { ABORT_FINALIZE(localRet); /* Something else went wrong, what is not acceptable */ } DBGPRINTF("omstdout: array-passing is %ssupported by rsyslog core.\n", bArrayPassingSupported ? "" : "not "); if(!bArrayPassingSupported) { DBGPRINTF("rsyslog core too old, shutting down this plug-in\n"); ABORT_FINALIZE(RS_RET_ERR); }r@rA}rB(h0Uh1j9ubaubhM)rC}rD(h0XThe code first checks if the core supports the OMSRgetSupportedTplOpts() API (which is also not present in all versions!) and, if so, queries the core if the OMSR\_TPL\_AS\_ARRAY mode is supported. If either does not exits, the core is too old for this functionality. The sample snippet above then shuts down, but a plugin may instead just do things different. In omstdout, you can see how a plugin may deal with the situation.h1hh2h3h4hQh6}rE(h8]h9]h:]h;]h=]uh?Kh@hh+]rFhIXThe code first checks if the core supports the OMSRgetSupportedTplOpts() API (which is also not present in all versions!) and, if so, queries the core if the OMSR_TPL_AS_ARRAY mode is supported. If either does not exits, the core is too old for this functionality. The sample snippet above then shuts down, but a plugin may instead just do things different. In omstdout, you can see how a plugin may deal with the situation.rGrH}rI(h0XThe code first checks if the core supports the OMSRgetSupportedTplOpts() API (which is also not present in all versions!) and, if so, queries the core if the OMSR\_TPL\_AS\_ARRAY mode is supported. If either does not exits, the core is too old for this functionality. The sample snippet above then shuts down, but a plugin may instead just do things different. In omstdout, you can see how a plugin may deal with the situation.h1jCubaubhM)rJ}rK(h0XH**In any case, it is recommended that at least a graceful shutdown is made and the array-passing capability not blindly be used.** In such cases, we can not guard the plugin from segfaulting and if the plugin (as currently always) is run within rsyslog's process space, that results in a segfault for rsyslog. So do not do this.h1hh2h3h4hQh6}rL(h8]h9]h:]h;]h=]uh?Kh@hh+]rM(ht)rN}rO(h0X**In any case, it is recommended that at least a graceful shutdown is made and the array-passing capability not blindly be used.**h6}rP(h8]h9]h:]h;]h=]uh1jJh+]rQhIX~In any case, it is recommended that at least a graceful shutdown is made and the array-passing capability not blindly be used.rRrS}rT(h0Uh1jNubah4h{ubhIX In such cases, we can not guard the plugin from segfaulting and if the plugin (as currently always) is run within rsyslog's process space, that results in a segfault for rsyslog. So do not do this.rUrV}rW(h0X In such cases, we can not guard the plugin from segfaulting and if the plugin (as currently always) is run within rsyslog's process space, that results in a segfault for rsyslog. So do not do this.h1jJubeubhM)rX}rY(h0X\Another possible mode is OMSR\_TPL\_AS\_JSON, where instead of the template a json-c memory object tree is passed to the module. The module can extract data via json-c API calls. It MUST NOT modify the provided structure. This mode is primarily aimed at plugins that need to process tree-like data, as found for example in MongoDB or ElasticSearch.h1hh2h3h4hQh6}rZ(h8]h9]h:]h;]h=]uh?Kh@hh+]r[hIXYAnother possible mode is OMSR_TPL_AS_JSON, where instead of the template a json-c memory object tree is passed to the module. The module can extract data via json-c API calls. It MUST NOT modify the provided structure. This mode is primarily aimed at plugins that need to process tree-like data, as found for example in MongoDB or ElasticSearch.r\r]}r^(h0X\Another possible mode is OMSR\_TPL\_AS\_JSON, where instead of the template a json-c memory object tree is passed to the module. The module can extract data via json-c API calls. It MUST NOT modify the provided structure. This mode is primarily aimed at plugins that need to process tree-like data, as found for example in MongoDB or ElasticSearch.h1jXubaubeubh-)r_}r`(h0Uh1hh2h3h4h5h6}ra(h8]h9]h:]h;]rbh#ah=]rch auh?Kh@hh+]rd(hB)re}rf(h0XBatching of Messagesrgh1j_h2h3h4hFh6}rh(h8]h9]h:]h;]h=]uh?Kh@hh+]rihIXBatching of Messagesrjrk}rl(h0jgh1jeubaubhM)rm}rn(h0XStarting with rsyslog 4.3.x, batching of output messages is supported. Previously, only a single-message interface was supported.roh1j_h2h3h4hQh6}rp(h8]h9]h:]h;]h=]uh?Kh@hh+]rqhIXStarting with rsyslog 4.3.x, batching of output messages is supported. Previously, only a single-message interface was supported.rrrs}rt(h0joh1jmubaubhM)ru}rv(h0X+With the **single message** plugin interface, each message is passed via a separate call to the plugin. Most importantly, the rsyslog engine assumes that each call to the plugin is a complete transaction and as such assumes that messages be properly committed after the plugin returns to the engine.h1j_h2h3h4hQh6}rw(h8]h9]h:]h;]h=]uh?Kh@hh+]rx(hIX With the ryrz}r{(h0X With the h1juubht)r|}r}(h0X**single message**h6}r~(h8]h9]h:]h;]h=]uh1juh+]rhIXsingle messagerr}r(h0Uh1j|ubah4h{ubhIX plugin interface, each message is passed via a separate call to the plugin. Most importantly, the rsyslog engine assumes that each call to the plugin is a complete transaction and as such assumes that messages be properly committed after the plugin returns to the engine.rr}r(h0X plugin interface, each message is passed via a separate call to the plugin. Most importantly, the rsyslog engine assumes that each call to the plugin is a complete transaction and as such assumes that messages be properly committed after the plugin returns to the engine.h1juubeubhM)r}r(h0XPWith the **batching** interface, rsyslog employs something along the line of "transactions". Obviously, the rsyslog core can not make non-transactional outputs to be fully transactional. But what it can is support that the output tells the core which messages have been committed by the output and which not yet. The core can than take care of those uncommitted messages when problems occur. For example, if a plugin has received 50 messages but not yet told the core that it committed them, and then returns an error state, the core assumes that all these 50 messages were **not** written to the output. The core then requeues all 50 messages and does the usual retry processing. Once the output plugin tells the core that it is ready again to accept messages, the rsyslog core will provide it with these 50 not yet committed messages again (actually, at this point, the rsyslog core no longer knows that it is re-submitting the messages). If, in contrary, the plugin had told rsyslog that 40 of these 50 messages were committed (before it failed), then only 10 would have been requeued and resubmitted.h1j_h2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIX With the rr}r(h0X With the h1jubht)r}r(h0X **batching**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXbatchingrr}r(h0Uh1jubah4h{ubhIX) interface, rsyslog employs something along the line of "transactions". Obviously, the rsyslog core can not make non-transactional outputs to be fully transactional. But what it can is support that the output tells the core which messages have been committed by the output and which not yet. The core can than take care of those uncommitted messages when problems occur. For example, if a plugin has received 50 messages but not yet told the core that it committed them, and then returns an error state, the core assumes that all these 50 messages were rr}r(h0X) interface, rsyslog employs something along the line of "transactions". Obviously, the rsyslog core can not make non-transactional outputs to be fully transactional. But what it can is support that the output tells the core which messages have been committed by the output and which not yet. The core can than take care of those uncommitted messages when problems occur. For example, if a plugin has received 50 messages but not yet told the core that it committed them, and then returns an error state, the core assumes that all these 50 messages were h1jubht)r}r(h0X**not**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXnotrr}r(h0Uh1jubah4h{ubhIX  written to the output. The core then requeues all 50 messages and does the usual retry processing. Once the output plugin tells the core that it is ready again to accept messages, the rsyslog core will provide it with these 50 not yet committed messages again (actually, at this point, the rsyslog core no longer knows that it is re-submitting the messages). If, in contrary, the plugin had told rsyslog that 40 of these 50 messages were committed (before it failed), then only 10 would have been requeued and resubmitted.rr}r(h0X  written to the output. The core then requeues all 50 messages and does the usual retry processing. Once the output plugin tells the core that it is ready again to accept messages, the rsyslog core will provide it with these 50 not yet committed messages again (actually, at this point, the rsyslog core no longer knows that it is re-submitting the messages). If, in contrary, the plugin had told rsyslog that 40 of these 50 messages were committed (before it failed), then only 10 would have been requeued and resubmitted.h1jubeubhM)r}r(h0XIn order to provide an efficient implementation, there are some (mild) constraints in that transactional model: first of all, rsyslog itself specifies the ultimate transaction boundaries. That is, it tells the plugin when a transaction begins and when it must finish. The plugin is free to commit messages in between, but it **must** commit all work done when the core tells it that the transaction ends. All messages passed in between a begin and end transaction notification are called a batch of messages. They are passed in one by one, just as without transaction support. Note that batch sizes are variable within the range of 1 to a user configured maximum limit. Most importantly, that means that plugins may receive batches of single messages, so they are required to commit each message individually. If the plugin tries to be "smarter" than the rsyslog engine and does not commit messages in those cases (for example), the plugin puts message stream integrity at risk: once rsyslog has notified the plugin of transaction end, it discards all messages as it considers them committed and save. If now something goes wrong, the rsyslog core does not try to recover lost messages (and keep in mind that "goes wrong" includes such uncontrollable things like connection loss to a database server). So it is highly recommended to fully abide to the plugin interface details, even though you may think you can do it better. The second reason for that is that the core engine will have configuration settings that enable the user to tune commit rate to their use-case specific needs. And, as a relief: why would rsyslog ever decide to use batches of one? There is a trivial case and that is when we have very low activity so that no queue of messages builds up, in which case it makes sense to commit work as it arrives. (As a side-note, there are some valid cases where a timeout-based commit feature makes sense. This is also under evaluation and, once decided, the core will offer an interface plus a way to preserve message stream integrity for properly-crafted plugins).h1j_h2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXEIn order to provide an efficient implementation, there are some (mild) constraints in that transactional model: first of all, rsyslog itself specifies the ultimate transaction boundaries. That is, it tells the plugin when a transaction begins and when it must finish. The plugin is free to commit messages in between, but it rr}r(h0XEIn order to provide an efficient implementation, there are some (mild) constraints in that transactional model: first of all, rsyslog itself specifies the ultimate transaction boundaries. That is, it tells the plugin when a transaction begins and when it must finish. The plugin is free to commit messages in between, but it h1jubht)r}r(h0X**must**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXmustrr}r(h0Uh1jubah4h{ubhIX commit all work done when the core tells it that the transaction ends. All messages passed in between a begin and end transaction notification are called a batch of messages. They are passed in one by one, just as without transaction support. Note that batch sizes are variable within the range of 1 to a user configured maximum limit. Most importantly, that means that plugins may receive batches of single messages, so they are required to commit each message individually. If the plugin tries to be "smarter" than the rsyslog engine and does not commit messages in those cases (for example), the plugin puts message stream integrity at risk: once rsyslog has notified the plugin of transaction end, it discards all messages as it considers them committed and save. If now something goes wrong, the rsyslog core does not try to recover lost messages (and keep in mind that "goes wrong" includes such uncontrollable things like connection loss to a database server). So it is highly recommended to fully abide to the plugin interface details, even though you may think you can do it better. The second reason for that is that the core engine will have configuration settings that enable the user to tune commit rate to their use-case specific needs. And, as a relief: why would rsyslog ever decide to use batches of one? There is a trivial case and that is when we have very low activity so that no queue of messages builds up, in which case it makes sense to commit work as it arrives. (As a side-note, there are some valid cases where a timeout-based commit feature makes sense. This is also under evaluation and, once decided, the core will offer an interface plus a way to preserve message stream integrity for properly-crafted plugins).rr}r(h0X commit all work done when the core tells it that the transaction ends. All messages passed in between a begin and end transaction notification are called a batch of messages. They are passed in one by one, just as without transaction support. Note that batch sizes are variable within the range of 1 to a user configured maximum limit. Most importantly, that means that plugins may receive batches of single messages, so they are required to commit each message individually. If the plugin tries to be "smarter" than the rsyslog engine and does not commit messages in those cases (for example), the plugin puts message stream integrity at risk: once rsyslog has notified the plugin of transaction end, it discards all messages as it considers them committed and save. If now something goes wrong, the rsyslog core does not try to recover lost messages (and keep in mind that "goes wrong" includes such uncontrollable things like connection loss to a database server). So it is highly recommended to fully abide to the plugin interface details, even though you may think you can do it better. The second reason for that is that the core engine will have configuration settings that enable the user to tune commit rate to their use-case specific needs. And, as a relief: why would rsyslog ever decide to use batches of one? There is a trivial case and that is when we have very low activity so that no queue of messages builds up, in which case it makes sense to commit work as it arrives. (As a side-note, there are some valid cases where a timeout-based commit feature makes sense. This is also under evaluation and, once decided, the core will offer an interface plus a way to preserve message stream integrity for properly-crafted plugins).h1jubeubhM)r}r(h0X^The second restriction is that if a plugin makes commits in between (what is perfectly legal) those commits must be in-order. So if a commit is made for message ten out of 50, this means that messages one to nine are also committed. It would be possible to remove this restriction, but we have decided to deliberately introduce it to simplify things.rh1j_h2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIX^The second restriction is that if a plugin makes commits in between (what is perfectly legal) those commits must be in-order. So if a commit is made for message ten out of 50, this means that messages one to nine are also committed. It would be possible to remove this restriction, but we have decided to deliberately introduce it to simplify things.rr}r(h0jh1jubaubeubh-)r}r(h0Uh1hh2h3h4h5h6}r(h8]h9]h:]h;]rh)ah=]rhauh?Kh@hh+]r(hB)r}r(h0X#Output Plugin Transaction Interfacerh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIX#Output Plugin Transaction Interfacerr}r(h0jh1jubaubhM)r}r(h0XSIn order to keep compatible with existing output plugins (and because it introduces no complexity), the transactional plugin interface is build on the traditional non-transactional one. Well... actually the traditional interface was transactional since its introduction, in the sense that each message was processed in its own transaction.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXSIn order to keep compatible with existing output plugins (and because it introduces no complexity), the transactional plugin interface is build on the traditional non-transactional one. Well... actually the traditional interface was transactional since its introduction, in the sense that each message was processed in its own transaction.rr}r(h0jh1jubaubhM)r}r(h0XSo the current ``doAction() entry point can be considered to have this structure (from the transactional interface point of view):``h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXSo the current rr}r(h0XSo the current h1jubcdocutils.nodes literal r)r}r(h0Xu``doAction() entry point can be considered to have this structure (from the transactional interface point of view):``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXqdoAction() entry point can be considered to have this structure (from the transactional interface point of view):rr}r(h0Uh1jubah4Uliteralrubeubj8)r}r(h0XWdoAction() { beginTransaction() ProcessMessage() endTransaction() }h1jh2h3h4j;h6}r(j=j>h;]h:]h8]h9]h=]uh?Kh@hh+]rhIXWdoAction() { beginTransaction() ProcessMessage() endTransaction() }rr}r(h0Uh1jubaubhM)r}r(h0XFor the **transactional interface**, we now move these implicit ``beginTransaction()`` and ``endTransaction(()`` call out of the message processing body, resulting is such a structure:h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXFor the rr}r(h0XFor the h1jubht)r}r(h0X**transactional interface**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXtransactional interfacerr}r(h0Uh1jubah4h{ubhIX, we now move these implicit rr}r(h0X, we now move these implicit h1jubj)r}r(h0X``beginTransaction()``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXbeginTransaction()rr}r(h0Uh1jubah4jubhIX and rr}r(h0X and h1jubj)r}r(h0X``endTransaction(()``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXendTransaction(()rr}r(h0Uh1jubah4jubhIXH call out of the message processing body, resulting is such a structure:r r }r (h0XH call out of the message processing body, resulting is such a structure:h1jubeubj8)r }r (h0XbeginTransaction() { /* prepare for transaction */ } doAction() { ProcessMessage() /* maybe do partial commits */ } endTransaction() { /* commit (rest of) batch */ }h1jh2h3h4j;h6}r(j=j>h;]h:]h8]h9]h=]uh?Mh@hh+]rhIXbeginTransaction() { /* prepare for transaction */ } doAction() { ProcessMessage() /* maybe do partial commits */ } endTransaction() { /* commit (rest of) batch */ }rr}r(h0Uh1j ubaubhM)r}r(h0X`And this calling structure actually is the transactional interface! It is as simple as this. For the new interface, the core calls a ``beginTransaction()`` entry point inside the plugin at the start of the batch. Similarly, the core call ``endTransaction()`` at the end of the batch. The plugin must implement these entry points according to its needs.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Mh@hh+]r(hIXAnd this calling structure actually is the transactional interface! It is as simple as this. For the new interface, the core calls a rr}r(h0XAnd this calling structure actually is the transactional interface! It is as simple as this. For the new interface, the core calls a h1jubj)r}r(h0X``beginTransaction()``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXbeginTransaction()rr}r (h0Uh1jubah4jubhIXS entry point inside the plugin at the start of the batch. Similarly, the core call r!r"}r#(h0XS entry point inside the plugin at the start of the batch. Similarly, the core call h1jubj)r$}r%(h0X``endTransaction()``h6}r&(h8]h9]h:]h;]h=]uh1jh+]r'hIXendTransaction()r(r)}r*(h0Uh1j$ubah4jubhIX^ at the end of the batch. The plugin must implement these entry points according to its needs.r+r,}r-(h0X^ at the end of the batch. The plugin must implement these entry points according to its needs.h1jubeubhM)r.}r/(h0XBut how does the core know when to use the old or the new calling interface? This is rather easy: when loading a plugin, the core queries the plugin for the ``beginTransaction()`` and ``endTransaction()`` entry points. If the plugin supports these, the new interface is used. If the plugin does not support them, the old interface is used and rsyslog implies that a commit is done after each message. Note that there is no special "downlevel" handling necessary to support this. In the case of the non-transactional interface, rsyslog considers each completed call to ``doAction`` as partial commit up to the current message. So implementation inside the core is very straightforward.h1jh2h3h4hQh6}r0(h8]h9]h:]h;]h=]uh?Mh@hh+]r1(hIXBut how does the core know when to use the old or the new calling interface? This is rather easy: when loading a plugin, the core queries the plugin for the r2r3}r4(h0XBut how does the core know when to use the old or the new calling interface? This is rather easy: when loading a plugin, the core queries the plugin for the h1j.ubj)r5}r6(h0X``beginTransaction()``h6}r7(h8]h9]h:]h;]h=]uh1j.h+]r8hIXbeginTransaction()r9r:}r;(h0Uh1j5ubah4jubhIX and r<r=}r>(h0X and h1j.ubj)r?}r@(h0X``endTransaction()``h6}rA(h8]h9]h:]h;]h=]uh1j.h+]rBhIXendTransaction()rCrD}rE(h0Uh1j?ubah4jubhIXl entry points. If the plugin supports these, the new interface is used. If the plugin does not support them, the old interface is used and rsyslog implies that a commit is done after each message. Note that there is no special "downlevel" handling necessary to support this. In the case of the non-transactional interface, rsyslog considers each completed call to rFrG}rH(h0Xl entry points. If the plugin supports these, the new interface is used. If the plugin does not support them, the old interface is used and rsyslog implies that a commit is done after each message. Note that there is no special "downlevel" handling necessary to support this. In the case of the non-transactional interface, rsyslog considers each completed call to h1j.ubj)rI}rJ(h0X ``doAction``h6}rK(h8]h9]h:]h;]h=]uh1j.h+]rLhIXdoActionrMrN}rO(h0Uh1jIubah4jubhIXh as partial commit up to the current message. So implementation inside the core is very straightforward.rPrQ}rR(h0Xh as partial commit up to the current message. So implementation inside the core is very straightforward.h1j.ubeubhM)rS}rT(h0X Actually, **we recommend that the transactional entry points only be defined by those plugins that actually need them**. All others should not define them in which case the default commit behaviour inside rsyslog will apply (thus removing complexity from the plugin).h1jh2h3h4hQh6}rU(h8]h9]h:]h;]h=]uh?M%h@hh+]rV(hIX Actually, rWrX}rY(h0X Actually, h1jSubht)rZ}r[(h0Xm**we recommend that the transactional entry points only be defined by those plugins that actually need them**h6}r\(h8]h9]h:]h;]h=]uh1jSh+]r]hIXiwe recommend that the transactional entry points only be defined by those plugins that actually need themr^r_}r`(h0Uh1jZubah4h{ubhIX. All others should not define them in which case the default commit behaviour inside rsyslog will apply (thus removing complexity from the plugin).rarb}rc(h0X. All others should not define them in which case the default commit behaviour inside rsyslog will apply (thus removing complexity from the plugin).h1jSubeubhM)rd}re(h0XIn order to support partial commits, special return codes must be defined for ``doAction``. All those return codes mean that processing completed successfully. But they convey additional information about the commit status as follows:h1jh2h3h4hQh6}rf(h8]h9]h:]h;]h=]uh?M*h@hh+]rg(hIXNIn order to support partial commits, special return codes must be defined for rhri}rj(h0XNIn order to support partial commits, special return codes must be defined for h1jdubj)rk}rl(h0X ``doAction``h6}rm(h8]h9]h:]h;]h=]uh1jdh+]rnhIXdoActionrorp}rq(h0Uh1jkubah4jubhIX. All those return codes mean that processing completed successfully. But they convey additional information about the commit status as follows:rrrs}rt(h0X. All those return codes mean that processing completed successfully. But they convey additional information about the commit status as follows:h1jdubeubcdocutils.nodes table ru)rv}rw(h0Uh1jh2h3h4Utablerxh6}ry(h8]h9]h:]h;]h=]uh?Nh@hh+]rzcdocutils.nodes tgroup r{)r|}r}(h0Uh6}r~(h;]h:]h8]h9]h=]UcolsKuh1jvh+]r(cdocutils.nodes colspec r)r}r(h0Uh6}r(h;]h:]h8]h9]h=]UcolwidthK"uh1j|h+]h4Ucolspecrubj)r}r(h0Uh6}r(h;]h:]h8]h9]h=]UcolwidthMcuh1j|h+]h4jubcdocutils.nodes tbody r)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1j|h+]r(cdocutils.nodes row r)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]r(cdocutils.nodes entry r)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0X *RS\_RET\_OK*h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M0h+]rcdocutils.nodes emphasis r)r}r(h0X *RS\_RET\_OK*h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX RS_RET_OKrr}r(h0Uh1jubah4Uemphasisrubaubah4Uentryrubj)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0X[The record and all previous inside the batch has been commited. *Note:* this definition is what makes integrating plugins without the transaction being/end calls so easy - this is the traditional "success" return state and if every call returns it, there is no need for actually calling ``endTransaction()``, because there is no transaction open).h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M0h+]r(hIX@The record and all previous inside the batch has been commited. rr}r(h0X@The record and all previous inside the batch has been commited. h1jubj)r}r(h0X*Note:*h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXNote:rr}r(h0Uh1jubah4jubhIX this definition is what makes integrating plugins without the transaction being/end calls so easy - this is the traditional "success" return state and if every call returns it, there is no need for actually calling rr}r(h0X this definition is what makes integrating plugins without the transaction being/end calls so easy - this is the traditional "success" return state and if every call returns it, there is no need for actually calling h1jubj)r}r(h0X``endTransaction()``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXendTransaction()rr}r(h0Uh1jubah4jubhIX(, because there is no transaction open).rr}r(h0X(, because there is no transaction open).h1jubeubah4jubeh4Urowrubj)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]r(j)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0X*RS\_RET\_DEFER\_COMMIT*h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M2h+]rj)r}r(h0X*RS\_RET\_DEFER\_COMMIT*h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXRS_RET_DEFER_COMMITrr}r(h0Uh1jubah4jubaubah4jubj)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0XsThe record has been processed, but is not yet commited. This is the expected state for transactional-aware plugins.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M2h+]rhIXsThe record has been processed, but is not yet commited. This is the expected state for transactional-aware plugins.rr}r(h0jh1jubaubah4jubeh4jubj)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]r(j)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0X*RS\_RET\_PREVIOUS\_COMMITTED*h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M4h+]rj)r}r(h0X*RS\_RET\_PREVIOUS\_COMMITTED*h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXRS_RET_PREVIOUS_COMMITTEDrr}r(h0Uh1jubah4jubaubah4jubj)r}r(h0Uh6}r(h8]h9]h:]h;]h=]uh1jh+]rhM)r}r(h0X_The **previous** record inside the batch has been committed, but the current one not yet. This state is introduced to support sources that fill up buffers and commit once a buffer is completely filled. That may occur halfway in the next record, so it may be important to be able to tell the engine the everything up to the previouos record is commitedrh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M4h+]r(hIXThe rr}r(h0XThe h1jubht)r}r(h0X **previous**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXpreviousrr}r (h0Uh1jubah4h{ubhIXO record inside the batch has been committed, but the current one not yet. This state is introduced to support sources that fill up buffers and commit once a buffer is completely filled. That may occur halfway in the next record, so it may be important to be able to tell the engine the everything up to the previouos record is commitedr r }r (h0XO record inside the batch has been committed, but the current one not yet. This state is introduced to support sources that fill up buffers and commit once a buffer is completely filled. That may occur halfway in the next record, so it may be important to be able to tell the engine the everything up to the previouos record is commitedh1jubeubah4jubeh4jubeh4Utbodyr ubeh4UtgrouprubaubhM)r}r(h0X(Note that the typical **calling cycle** is ``beginTransaction()``, followed by *n* times ``doAction()`` followed by ``endTransaction()``. However, if either ``beginTransaction()`` or ``doAction()`` return back an error state (including RS\_RET\_SUSPENDED), then the transaction is considered aborted. In result, the remaining calls in this cycle (e.g. ``endTransaction()``) are never made and a new cycle (starting with ``beginTransaction()`` is begun when processing resumes. So an output plugin must expect and handle those partial cycles gracefully.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M7h@hh+]r(hIXNote that the typical rr}r(h0XNote that the typical h1jubht)r}r(h0X**calling cycle**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX calling cyclerr}r(h0Uh1jubah4h{ubhIX is rr}r(h0X is h1jubj)r }r!(h0X``beginTransaction()``h6}r"(h8]h9]h:]h;]h=]uh1jh+]r#hIXbeginTransaction()r$r%}r&(h0Uh1j ubah4jubhIX, followed by r'r(}r)(h0X, followed by h1jubj)r*}r+(h0X*n*h6}r,(h8]h9]h:]h;]h=]uh1jh+]r-hIXnr.}r/(h0Uh1j*ubah4jubhIX times r0r1}r2(h0X times h1jubj)r3}r4(h0X``doAction()``h6}r5(h8]h9]h:]h;]h=]uh1jh+]r6hIX doAction()r7r8}r9(h0Uh1j3ubah4jubhIX followed by r:r;}r<(h0X followed by h1jubj)r=}r>(h0X``endTransaction()``h6}r?(h8]h9]h:]h;]h=]uh1jh+]r@hIXendTransaction()rArB}rC(h0Uh1j=ubah4jubhIX. However, if either rDrE}rF(h0X. However, if either h1jubj)rG}rH(h0X``beginTransaction()``h6}rI(h8]h9]h:]h;]h=]uh1jh+]rJhIXbeginTransaction()rKrL}rM(h0Uh1jGubah4jubhIX or rNrO}rP(h0X or h1jubj)rQ}rR(h0X``doAction()``h6}rS(h8]h9]h:]h;]h=]uh1jh+]rThIX doAction()rUrV}rW(h0Uh1jQubah4jubhIX return back an error state (including RS_RET_SUSPENDED), then the transaction is considered aborted. In result, the remaining calls in this cycle (e.g. rXrY}rZ(h0X return back an error state (including RS\_RET\_SUSPENDED), then the transaction is considered aborted. In result, the remaining calls in this cycle (e.g. h1jubj)r[}r\(h0X``endTransaction()``h6}r](h8]h9]h:]h;]h=]uh1jh+]r^hIXendTransaction()r_r`}ra(h0Uh1j[ubah4jubhIX0) are never made and a new cycle (starting with rbrc}rd(h0X0) are never made and a new cycle (starting with h1jubj)re}rf(h0X``beginTransaction()``h6}rg(h8]h9]h:]h;]h=]uh1jh+]rhhIXbeginTransaction()rirj}rk(h0Uh1jeubah4jubhIXn is begun when processing resumes. So an output plugin must expect and handle those partial cycles gracefully.rlrm}rn(h0Xn is begun when processing resumes. So an output plugin must expect and handle those partial cycles gracefully.h1jubeubhM)ro}rp(h0XU**The question remains how can a plugin know if the core supports batching?** First of all, even if the engine would not know it, the plugin would return with RS\_RET\_DEFER\_COMMIT, what then would be treated as an error by the engine. This would effectively disable the output, but cause no further harm (but may be harm enough in itself).h1jh2h3h4hQh6}rq(h8]h9]h:]h;]h=]uh?M@h@hh+]rr(ht)rs}rt(h0XM**The question remains how can a plugin know if the core supports batching?**h6}ru(h8]h9]h:]h;]h=]uh1joh+]rvhIXIThe question remains how can a plugin know if the core supports batching?rwrx}ry(h0Uh1jsubah4h{ubhIX First of all, even if the engine would not know it, the plugin would return with RS_RET_DEFER_COMMIT, what then would be treated as an error by the engine. This would effectively disable the output, but cause no further harm (but may be harm enough in itself).rzr{}r|(h0X First of all, even if the engine would not know it, the plugin would return with RS\_RET\_DEFER\_COMMIT, what then would be treated as an error by the engine. This would effectively disable the output, but cause no further harm (but may be harm enough in itself).h1joubeubhM)r}}r~(h0XThe real solution is to enable the plugin to query the rsyslog core if this feature is supported or not. At the time of the introduction of batching, no such query-interface exists. So we introduce it with that release. What the means is if a rsyslog core can not provide this query interface, it is a core that was build before batching support was available. So the absence of a query interface indicates that the transactional interface is not available. One might now be tempted to think there is no need to do the actual check, but is is recommended to ask the rsyslog engine explicitly if the transactional interface is present and will be honored. This enables us to create versions in the future which have, for whatever reason we do not yet know, no support for this interface.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?MFh@hh+]rhIXThe real solution is to enable the plugin to query the rsyslog core if this feature is supported or not. At the time of the introduction of batching, no such query-interface exists. So we introduce it with that release. What the means is if a rsyslog core can not provide this query interface, it is a core that was build before batching support was available. So the absence of a query interface indicates that the transactional interface is not available. One might now be tempted to think there is no need to do the actual check, but is is recommended to ask the rsyslog engine explicitly if the transactional interface is present and will be honored. This enables us to create versions in the future which have, for whatever reason we do not yet know, no support for this interface.rr}r(h0jh1j}ubaubhM)r}r(h0XlThe logic to do these checks is contained in the ``INITChkCoreFeature`` macro, which can be used as follows:h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?MSh@hh+]r(hIX1The logic to do these checks is contained in the rr}r(h0X1The logic to do these checks is contained in the h1jubj)r}r(h0X``INITChkCoreFeature``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXINITChkCoreFeaturerr}r(h0Uh1jubah4jubhIX% macro, which can be used as follows:rr}r(h0X% macro, which can be used as follows:h1jubeubj8)r}r(h0XAINITChkCoreFeature(bCoreSupportsBatching, CORE_FEATURE_BATCHING);h1jh2h3h4j;h6}r(j=j>h;]h:]h8]h9]h=]uh?MXh@hh+]rhIXAINITChkCoreFeature(bCoreSupportsBatching, CORE_FEATURE_BATCHING);rr}r(h0Uh1jubaubhM)r}r(h0XWHere, bCoreSupportsBatching is a plugin-defined integer which after execution is 1 if batches (and thus the transactional interface) is supported and 0 otherwise. CORE\_FEATURE\_BATCHING is the feature we are interested in. Future versions of rsyslog may contain additional feature-test-macros (you can see all of them in ./runtime/rsyslog.h).h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?MZh@hh+]rhIXUHere, bCoreSupportsBatching is a plugin-defined integer which after execution is 1 if batches (and thus the transactional interface) is supported and 0 otherwise. CORE_FEATURE_BATCHING is the feature we are interested in. Future versions of rsyslog may contain additional feature-test-macros (you can see all of them in ./runtime/rsyslog.h).rr}r(h0XWHere, bCoreSupportsBatching is a plugin-defined integer which after execution is 1 if batches (and thus the transactional interface) is supported and 0 otherwise. CORE\_FEATURE\_BATCHING is the feature we are interested in. Future versions of rsyslog may contain additional feature-test-macros (you can see all of them in ./runtime/rsyslog.h).h1jubaubhM)r}r(h0X|Note that the ompsql output plugin supports transactional mode in a hybrid way and thus can be considered good example code.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?M`h@hh+]rhIX|Note that the ompsql output plugin supports transactional mode in a hybrid way and thus can be considered good example code.rr}r(h0jh1jubaubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh(ah=]rhauh?Mdh@hh+]r(hB)r}r(h0X Open Issuesrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Mdh@hh+]rhIX Open Issuesrr}r(h0jh1jubaubcdocutils.nodes bullet_list r)r}r(h0Uh1jh2h3h4U bullet_listrh6}r(UbulletrX-h;]h:]h8]h9]h=]uh?Mfh@hh+]r(cdocutils.nodes list_item r)r}r(h0XProcessing errors handlingrh1jh2h3h4U list_itemrh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0jh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Mfh+]rhIXProcessing errors handlingrr}r(h0jh1jubaubaubj)r}r(h0X>reliable re-queue during error handling and queue termination h1jh2h3h4jh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X=reliable re-queue during error handling and queue terminationrh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Mgh+]rhIX=reliable re-queue during error handling and queue terminationrr}r(h0jh1jubaubaubeubh-)r}r(h0Uh1jh2h3h4h5h6}r(h8]h9]h:]h;]rh*ah=]rhauh?Mjh@hh+]r(hB)r}r(h0X Licensingrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Mjh@hh+]rhIX Licensingrr}r(h0jh1jubaubhM)r}r(h0X(From the rsyslog point of view, plugins constitute separate projects. As such, we think plugins are not required to be compatible with GPLv3. However, this is no legal advise. If you intend to release something under a non-GPLV3 compatible license it is probably best to consult with your lawyer.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Mlh@hh+]rhIX(From the rsyslog point of view, plugins constitute separate projects. As such, we think plugins are not required to be compatible with GPLv3. However, this is no legal advise. If you intend to release something under a non-GPLV3 compatible license it is probably best to consult with your lawyer.rr}r(h0jh1jubaubhM)r}r(h0XMost importantly, and this is definite, the rsyslog team does not expect or require you to contribute your plugin to the rsyslog project (but of course we are happy if you do).rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Mrh@hh+]rhIXMost importantly, and this is definite, the rsyslog team does not expect or require you to contribute your plugin to the rsyslog project (but of course we are happy if you do).rr}r(h0jh1jubaubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rhah=]rhauh?Mwh@hh+]r(hB)r}r(h0X Copyrightrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Mwh@hh+]rhIX Copyrightrr}r(h0jh1jubaubhM)r}r(h0XsCopyright (c) 2009 `Rainer Gerhards `_ and `Adiscon `_.h1jh2h3h4hQh6}r (h8]h9]h:]h;]h=]uh?Myh@hh+]r (hIXCopyright (c) 2009 r r }r (h0XCopyright (c) 2009 h1jubh)r}r(h0X3`Rainer Gerhards `_h6}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrh;]h:]h8]h9]h=]uh1jh+]rhIXRainer Gerhardsrr}r(h0Uh1jubah4hubh)r}r(h0X! hKh1jh4hh6}r(Urefurijh;]rh"ah:]h8]h9]h=]rh auh+]ubhIX and rr}r(h0X and h1jubh)r}r(h0X'`Adiscon `_h6}r (UnameXAdisconhXhttp://www.adiscon.com/en/r!h;]h:]h8]h9]h=]uh1jh+]r"hIXAdisconr#r$}r%(h0Uh1jubah4hubh)r&}r'(h0X hKh1jh4hh6}r((Urefurij!h;]r)h$ah:]h8]h9]h=]r*h auh+]ubhIX.r+}r,(h0X.h1jubeubhM)r-}r.(h0XPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.h1jh2h3h4hQh6}r/(h8]h9]h:]h;]h=]uh?M|h@hh+]r0(hIX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at r1r2}r3(h0X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at h1j-ubh)r4}r5(h0XN`http://www.gnu.org/copyleft/fdl.html `_h6}r6(UnamehhX$http://www.gnu.org/copyleft/fdl.htmlr7h;]h:]h8]h9]h=]uh1j-h+]r8hIX$http://www.gnu.org/copyleft/fdl.htmlr9r:}r;(h0Uh1j4ubah4hubh)r<}r=(h0X' hKh1j-h4hh6}r>(Urefurij7h;]r?hah:]h8]h9]h=]r@hauh+]ubhIX.rA}rB(h0X.h1j-ubeubeubeubah0UU transformerrCNU footnote_refsrD}rEUrefnamesrF}rGUsymbol_footnotesrH]rIUautofootnote_refsrJ]rKUsymbol_footnote_refsrL]rMU citationsrN]rOh@hU current_linerPNUtransform_messagesrQ]rRUreporterrSNUid_startrTKU autofootnotesrU]rVU citation_refsrW}rXUindirect_targetsrY]rZUsettingsr[(cdocutils.frontend Values r\or]}r^(Ufootnote_backlinksr_KUrecord_dependenciesr`NU rfc_base_urlraUhttps://tools.ietf.org/html/rbU tracebackrcUpep_referencesrdNUstrip_commentsreNU toc_backlinksrfjU language_codergUenrhU datestampriNU report_levelrjKU _destinationrkNU halt_levelrlKU strip_classesrmNhFNUerror_encoding_error_handlerrnUbackslashreplaceroUdebugrpNUembed_stylesheetrqUoutput_encoding_error_handlerrrUstrictrsU sectnum_xformrtKUdump_transformsruNU docinfo_xformrvKUwarning_streamrwNUpep_file_url_templaterxUpep-%04dryUexit_status_levelrzKUconfigr{NUstrict_visitorr|NUcloak_email_addressesr}Utrim_footnote_reference_spacer~UenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh3Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjsUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hj<h#j_hjh(jh!hh h.h)jh$j&h%hh'h_h*jh&hh"jhhuUsubstitution_namesr}rh4h@h6}r(h8]h;]h:]Usourceh3h9]h=]uU footnotesr]rUrefidsr}rub.build/.doctrees/development/generic_design.doctree0000664000175000017500000007102713035122643021371 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xgeneric design of a syslogdqNXrainer gerhardsquUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hUgeneric-design-of-a-syslogdqhUrainer-gerhardsquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXA/home/rger/proj/rsyslog-doc/source/development/generic_design.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hXGeneric design of a syslogdq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1XGeneric design of a syslogdq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hX_Written 2007-04-10 by `Rainer Gerhards `_hhhhhU paragraphq8h}q9(h ]h!]h"]h#]h%]uh'Kh(hh]q:(h1XWritten 2007-04-10 by q;q<}q=(hXWritten 2007-04-10 by hh6ubcdocutils.nodes reference q>)q?}q@(hXI`Rainer Gerhards `_h}qA(UnameXRainer GerhardsUrefuriqBX4http://www.adiscon.com/en/people/rainer-gerhards.phpqCh#]h"]h ]h!]h%]uhh6h]qDh1XRainer GerhardsqEqF}qG(hUhh?ubahU referenceqHubcdocutils.nodes target qI)qJ}qK(hX7 U referencedqLKhh6hUtargetqMh}qN(UrefurihCh#]qOhah"]h ]h!]h%]qPhauh]ubeubh5)qQ}qR(hXThe text below describes a generic approach on how a syslogd can be implemented. I created this description for some other project, where it was not used. Instead of throwing it away, I thought it would be a good addition to the rsyslog documentation. While rsyslog differs in details from the description below, it is sufficiently close to it. Further development of rsyslog will probably match it even closer to the description.qShhhhhh8h}qT(h ]h!]h"]h#]h%]uh'Kh(hh]qUh1XThe text below describes a generic approach on how a syslogd can be implemented. I created this description for some other project, where it was not used. Instead of throwing it away, I thought it would be a good addition to the rsyslog documentation. While rsyslog differs in details from the description below, it is sufficiently close to it. Further development of rsyslog will probably match it even closer to the description.qVqW}qX(hhShhQubaubh5)qY}qZ(hXIf you intend to read the rsyslog source code, I recommend reading this document here first. You will not find the same names and not all of the concepts inside rsyslog. However, I think your understanding will benefit from knowing the generic architecture.q[hhhhhh8h}q\(h ]h!]h"]h#]h%]uh'Kh(hh]q]h1XIf you intend to read the rsyslog source code, I recommend reading this document here first. You will not find the same names and not all of the concepts inside rsyslog. However, I think your understanding will benefit from knowing the generic architecture.q^q_}q`(hh[hhYubaubcdocutils.nodes literal_block qa)qb}qc(hX+-----------------+ | "remote" PLOrig | +-----------------+ | I +--------+-----+-----+ +-----+-------+------+-----+ P | PLOrig | GWI | ... | | GWO | Store | Disc | ... | C +--------+-----+-----+ +-----+-------+------+-----+ | | ^ v v | +--------------+ +------------+ +--------------+ | PLGenerator | | RelayEng | | CollectorEng | +--------------+ +------------+ +--------------+ | ^ ^ | | | v v | +-------------+ +------------+ +--------------+ | PLG Ext | | RelEng Ext | | CollcEng Ext | +-------------+ +------------+ +--------------+ | ^ ^ | | | v v | +--------------------------------------------------------------+ | Message Router | +--------------------------------------------------------------+ | ^ v | +--------------------------------------------------------------+ | Message CoDec (e.g. RFC 3164, RFCYYYY) | +--------------------------------------------------------------+ | ^ v | +---------------------+-----------------------+----------------+ | transport UDP | transport TLS | ... | +---------------------+-----------------------+----------------+ Generic Syslog Application ArchitecturehhhhhU literal_blockqdh}qe(U xml:spaceqfUpreserveqgh#]h"]h ]h!]h%]uh'Kh(hh]qhh1X+-----------------+ | "remote" PLOrig | +-----------------+ | I +--------+-----+-----+ +-----+-------+------+-----+ P | PLOrig | GWI | ... | | GWO | Store | Disc | ... | C +--------+-----+-----+ +-----+-------+------+-----+ | | ^ v v | +--------------+ +------------+ +--------------+ | PLGenerator | | RelayEng | | CollectorEng | +--------------+ +------------+ +--------------+ | ^ ^ | | | v v | +-------------+ +------------+ +--------------+ | PLG Ext | | RelEng Ext | | CollcEng Ext | +-------------+ +------------+ +--------------+ | ^ ^ | | | v v | +--------------------------------------------------------------+ | Message Router | +--------------------------------------------------------------+ | ^ v | +--------------------------------------------------------------+ | Message CoDec (e.g. RFC 3164, RFCYYYY) | +--------------------------------------------------------------+ | ^ v | +---------------------+-----------------------+----------------+ | transport UDP | transport TLS | ... | +---------------------+-----------------------+----------------+ Generic Syslog Application Architectureqiqj}qk(hUhhbubaubcdocutils.nodes bullet_list ql)qm}qn(hUhhhhhU bullet_listqoh}qp(UbulletqqX-h#]h"]h ]h!]h%]uh'Kr?}r@(hj;hj9ubaubaubhs)rA}rB(hXwA "Store" is any way to persistently store the extracted syslog information, e.g. to the file system or to a data base.hhmhhhhvh}rC(h ]h!]h"]h#]h%]uh'Nh(hh]rDh5)rE}rF(hXwA "Store" is any way to persistently store the extracted syslog information, e.g. to the file system or to a data base.rGhjAhhhh8h}rH(h ]h!]h"]h#]h%]uh'Kh]rIh1XwA "Store" is any way to persistently store the extracted syslog information, e.g. to the file system or to a data base.rJrK}rL(hjGhjEubaubaubhs)rM}rN(hX"Disc" means the discarding of messages. Operators often find it useful to discard noise messages and so most syslog applications contain a way to do that.hhmhhhhvh}rO(h ]h!]h"]h#]h%]uh'Nh(hh]rPh5)rQ}rR(hX"Disc" means the discarding of messages. Operators often find it useful to discard noise messages and so most syslog applications contain a way to do that.rShjMhhhh8h}rT(h ]h!]h"]h#]h%]uh'Kh]rUh1X"Disc" means the discarding of messages. Operators often find it useful to discard noise messages and so most syslog applications contain a way to do that.rVrW}rX(hjShjQubaubaubhs)rY}rZ(hXThe ellipsis after "Disc" indicates that there are potentially a variety of different other ways to consume syslog information.hhmhhhhvh}r[(h ]h!]h"]h#]h%]uh'Nh(hh]r\h5)r]}r^(hXThe ellipsis after "Disc" indicates that there are potentially a variety of different other ways to consume syslog information.r_hjYhhhh8h}r`(h ]h!]h"]h#]h%]uh'Kh]rah1XThe ellipsis after "Disc" indicates that there are potentially a variety of different other ways to consume syslog information.rbrc}rd(hj_hj]ubaubaubhs)re}rf(hXcThere may be multiple instances of each of the described components in a single syslog application.hhmhhhhvh}rg(h ]h!]h"]h#]h%]uh'Nh(hh]rhh5)ri}rj(hXcThere may be multiple instances of each of the described components in a single syslog application.rkhjehhhh8h}rl(h ]h!]h"]h#]h%]uh'Kh]rmh1XcThere may be multiple instances of each of the described components in a single syslog application.rnro}rp(hjkhjiubaubaubhs)rq}rr(hXRA syslog application is made up of all or some of the above mentioned components. hhmhhhhvh}rs(h ]h!]h"]h#]h%]uh'Nh(hh]rth5)ru}rv(hXQA syslog application is made up of all or some of the above mentioned components.rwhjqhhhh8h}rx(h ]h!]h"]h#]h%]uh'Kh]ryh1XQA syslog application is made up of all or some of the above mentioned components.rzr{}r|(hjwhjuubaubaubeubeubahUU transformerr}NU footnote_refsr~}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh(hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh.NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhJhhuUsubstitution_namesr}rhh(h}r(h ]h#]h"]Usourcehh!]h%]uU footnotesr]rUrefidsr}rub.build/.doctrees/development/index.doctree0000664000175000017500000000557213035122643017535 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX developmentqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU developmentqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX8/home/rger/proj/rsyslog-doc/source/development/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Developmentq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Developmentq0q1}q2(hh+hh)ubaubcdocutils.nodes compound q3)q4}q5(hUhhhhhUcompoundq6h}q7(h]h]q8Utoctree-wrapperq9ah ]h!]h#]uh%Nh&hh]q:csphinx.addnodes toctree q;)q<}q=(hUhh4hhhUtoctreeq>h}q?(Unumberedq@KU includehiddenqAhXdevelopment/indexqBUcaptionqCNUglobqDh!]h ]U titlesonlyqEh]h]h#]UentriesqF]qG(NXdevelopment/config_data_modelqHqINXdevelopment/dev_codestyleqJqKNXdevelopment/dev_opluginsqLqMNXdevelopment/dev_queueqNqONXdevelopment/generic_designqPqQeUhiddenqRU includefilesqS]qT(hHhJhLhNhPeUmaxdepthqUJuh%Kh]ubaubeubahUU transformerqVNU footnote_refsqW}qXUrefnamesqY}qZUsymbol_footnotesq[]q\Uautofootnote_refsq]]q^Usymbol_footnote_refsq_]q`U citationsqa]qbh&hU current_lineqcNUtransform_messagesqd]qeUreporterqfNUid_startqgKU autofootnotesqh]qiU citation_refsqj}qkUindirect_targetsql]qmUsettingsqn(cdocutils.frontend Values qooqp}qq(Ufootnote_backlinksqrKUrecord_dependenciesqsNU rfc_base_urlqtUhttps://tools.ietf.org/html/quU tracebackqvUpep_referencesqwNUstrip_commentsqxNU toc_backlinksqyUentryqzU language_codeq{Uenq|U datestampq}NU report_levelq~KU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/development/dev_codestyle.doctree0000664000175000017500000001207613035122643021254 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXrsylog code styleqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUrsylog-code-styleqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX@/home/rger/proj/rsyslog-doc/source/development/dev_codestyle.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXrsylog code styleq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/Xrsylog code styleq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXa**Note**: code style is still under construction. This guide lists some basic style requirements.hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(cdocutils.nodes strong q9)q:}q;(hX**Note**h}q<(h]h]h ]h!]h#]uhh4h]q=h/XNoteq>q?}q@(hUhh:ubahUstrongqAubh/XY: code style is still under construction. This guide lists some basic style requirements.qBqC}qD(hXY: code style is still under construction. This guide lists some basic style requirements.hh4ubeubh3)qE}qF(hXK**Code that does not match the code style guide will not pass CI testing.**qGhhhhhh6h}qH(h]h]h ]h!]h#]uh%Kh&hh]qIh9)qJ}qK(hhGh}qL(h]h]h ]h!]h#]uhhEh]qMh/XGCode that does not match the code style guide will not pass CI testing.qNqO}qP(hUhhJubahhAubaubh3)qQ}qR(hX$The following is required right now:qShhhhhh6h}qT(h]h]h ]h!]h#]uh%K h&hh]qUh/X$The following is required right now:qVqW}qX(hhShhQubaubcdocutils.nodes block_quote qY)qZ}q[(hUhhhNhU block_quoteq\h}q](h]h]h ]h!]h#]uh%Nh&hh]q^cdocutils.nodes bullet_list q_)q`}qa(hUh}qb(UbulletqcX*h!]h ]h]h]h#]uhhZh]qd(cdocutils.nodes list_item qe)qf}qg(hXwe use ANSCI C99qhh}qi(h]h]h ]h!]h#]uhh`h]qjh3)qk}ql(hhhhhfhhhh6h}qm(h]h]h ]h!]h#]uh%K h]qnh/Xwe use ANSCI C99qoqp}qq(hhhhhkubaubahU list_itemqrubhe)qs}qt(hX'indention is done with tabs, not spacesquh}qv(h]h]h ]h!]h#]uhh`h]qwh3)qx}qy(hhuhhshhhh6h}qz(h]h]h ]h!]h#]uh%K h]q{h/X'indention is done with tabs, not spacesq|q}}q~(hhuhhxubaubahhrubhe)q}q(hX-trailing whitespace in lines is not permittedqh}q(h]h]h ]h!]h#]uhh`h]qh3)q}q(hhhhhhhh6h}q(h]h]h ]h!]h#]uh%K h]qh/X-trailing whitespace in lines is not permittedqq}q(hhhhubaubahhrubhe)q}q(hXlines longer than 140 characters are not permitted; also, it is advised to keep lines shorter than 120 characters unless there is a good reason. The 120 char rule is not enforced, but everything over 140 chars is rejected and must be reformatted.h}q(h]h]h ]h!]h#]uhh`h]qh3)q}q(hXlines longer than 140 characters are not permitted; also, it is advised to keep lines shorter than 120 characters unless there is a good reason. The 120 char rule is not enforced, but everything over 140 chars is rejected and must be reformatted.qhhhhhh6h}q(h]h]h ]h!]h#]uh%Kh]qh/Xlines longer than 140 characters are not permitted; also, it is advised to keep lines shorter than 120 characters unless there is a good reason. The 120 char rule is not enforced, but everything over 140 chars is rejected and must be reformatted.qq}q(hhhhubaubahhrubehU bullet_listqubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqljUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqӈUtrim_footnote_reference_spaceqԉUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformq؉U source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsr}rub.build/.doctrees/proposals/0000775000175000017500000000000013035122643014546 5ustar rgerrgerbuild/.doctrees/proposals/version_naming.doctree0000664000175000017500000005554013035122643021144 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xsupport contractsqXversion namingqNuUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hUsupport-contractsqhUversion-namingquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX?/home/rger/proj/rsyslog-doc/source/proposals/version_naming.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hXVersion Namingq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1XVersion Namingq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hXCThis is the proposal on how versions should be named in the future:q8hhhhhU paragraphq9h}q:(h ]h!]h"]h#]h%]uh'Kh(hh]q;h1XCThis is the proposal on how versions should be named in the future:q(hh8hh6ubaubh5)q?}q@(hXRsyslog version naming has undergone a number of changes in the past. Our sincere hopes is that the scheme outlined here will serve us well for the future. In general, a three-number versioning scheme with a potential development state indication is used. It follows this pattern:qAhhhhhh9h}qB(h ]h!]h"]h#]h%]uh'Kh(hh]qCh1XRsyslog version naming has undergone a number of changes in the past. Our sincere hopes is that the scheme outlined here will serve us well for the future. In general, a three-number versioning scheme with a potential development state indication is used. It follows this pattern:qDqE}qF(hhAhh?ubaubh5)qG}qH(hX!major.minor.patchlevel[-devstate]qIhhhhhh9h}qJ(h ]h!]h"]h#]h%]uh'K h(hh]qKh1X!major.minor.patchlevel[-devstate]qLqM}qN(hhIhhGubaubh5)qO}qP(hXJwhere devstate has some forther structure: -qQhhhhhh9h}qR(h ]h!]h"]h#]h%]uh'K h(hh]qSh1XJwhere devstate has some forther structure: -qTqU}qV(hhQhhOubaubh5)qW}qX(hX`All stable builds come without the devstate part. All unstable development version come with it.qYhhhhhh9h}qZ(h ]h!]h"]h#]h%]uh'Kh(hh]q[h1X`All stable builds come without the devstate part. All unstable development version come with it.q\q]}q^(hhYhhWubaubh5)q_}q`(hX3The major version is incremented whenever something really important happens. A single new feature, even if important, does not justify an increase in the major version. There is no hard rule when the major version needs an increment. It mostly is a soft factor, when the developers and/or the community think there has been sufficient change to justify that. Major version increments are expected to happen quite infrequently, maybe around once a year. A major version increment has important implications from the support side: without support contracts, the current major version's last stable release and the last stable release of the version immediately below it are supported (Adiscon, the rsyslog sponsor, offers `support contracts `_ covering all other versions).hhhhhh9h}qa(h ]h!]h"]h#]h%]uh'Kh(hh]qb(h1XThe major version is incremented whenever something really important happens. A single new feature, even if important, does not justify an increase in the major version. There is no hard rule when the major version needs an increment. It mostly is a soft factor, when the developers and/or the community think there has been sufficient change to justify that. Major version increments are expected to happen quite infrequently, maybe around once a year. A major version increment has important implications from the support side: without support contracts, the current major version's last stable release and the last stable release of the version immediately below it are supported (Adiscon, the rsyslog sponsor, offers qcqd}qe(hXThe major version is incremented whenever something really important happens. A single new feature, even if important, does not justify an increase in the major version. There is no hard rule when the major version needs an increment. It mostly is a soft factor, when the developers and/or the community think there has been sufficient change to justify that. Major version increments are expected to happen quite infrequently, maybe around once a year. A major version increment has important implications from the support side: without support contracts, the current major version's last stable release and the last stable release of the version immediately below it are supported (Adiscon, the rsyslog sponsor, offers hh_ubcdocutils.nodes reference qf)qg}qh(hXD`support contracts `_h}qi(UnameXsupport contractsUrefuriqjX-http://www.rsyslog.com/professional-services/qkh#]h"]h ]h!]h%]uhh_h]qlh1Xsupport contractsqmqn}qo(hUhhgubahU referenceqpubcdocutils.nodes target qq)qr}qs(hX0 U referencedqtKhh_hUtargetquh}qv(Urefurihkh#]qwhah"]h ]h!]h%]qxhauh]ubh1X covering all other versions).qyqz}q{(hX covering all other versions).hh_ubeubh5)q|}q}(hXThe minor version is incremented whenever a non-trivial new feature is planned to be added. Triviality of a feature is simply determined by time estimated to implement a feature. If that's more than a few days, it is considered a non-trivial feature. Whenever a new minor version is begun, the desired feature is identified and will be the primary focus of that major.minor version. Trivial features may justify a new minor version if they either do not look trivial from the user's point of view or change something quite considerable (so we need to alert users). A minor version increment may also be done for some other good reasons that the developers have.q~hhhhhh9h}q(h ]h!]h"]h#]h%]uh'K h(hh]qh1XThe minor version is incremented whenever a non-trivial new feature is planned to be added. Triviality of a feature is simply determined by time estimated to implement a feature. If that's more than a few days, it is considered a non-trivial feature. Whenever a new minor version is begun, the desired feature is identified and will be the primary focus of that major.minor version. Trivial features may justify a new minor version if they either do not look trivial from the user's point of view or change something quite considerable (so we need to alert users). A minor version increment may also be done for some other good reasons that the developers have.qq}q(hh~hh|ubaubh5)q}q(hXzThe patchlevel is incremented whenever there is a bugfix or very minor feature added to a (stable or development) release.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K+h(hh]qh1XzThe patchlevel is incremented whenever there is a bugfix or very minor feature added to a (stable or development) release.qq}q(hhhhubaubh5)q}q(hX The devstate is important during development of a feature. It helps the developers to release versions with new features to the general public and in the hope that this will result in some testing. To understand how it works, we need to look at the release cycle: As already said, at the start of a new minor version, a new non-trivial feature to be implemented in that version is selected. Development on this feature begins. At the current pace of development, getting initial support for such a non-trivial feature typically takes between two and four weeks. During this time, new feature requests come in. Also, we may find out that it may be just the right time to implement some not yet targeted feature requests. A reason for this is that the minor release's feature focus is easier to implement if the other feature is implemented first. This is a quite common thing to happen. So development on the primary focus may hold for a short period while we implement something else. Even unrelated, but very trivial feature requests (maybe an hour's worth of time to implement), may be done in between. Once we have implemented these things, we would like to release as quickly as possible (even more if someone has asked for the feature). So we do not like to wait for the original focus feature to be ready (what could take maybe three more weeks). As a result, we release the new features. But that version will also include partial code of the focus feature. Typically this doesn't hurt as long as noone tries to use it (what of course would miserably fail). But still, part of the new code is already in it. When we release such a "minor-feature enhanced" but "focus-feature not yet completed" version, we need a way to flag it. In current thinking, that is using a "-mf" devstate in the version number ("mf" stands for "minor feature"). Version numbers for -mf releases start at 0 for the first release and are monotonically incremented. Once the focus feature has been fully implemented, a new version now actually supporting that feature will be released. Now, the release reason is changed to the well-know "-rc" where "rc" stands for release candidate. For the first release candidate, the version starts at 0 again and is incremented monotonically for each subsequent release. Please note that a -rc0 may only have bare functionality but later -rc's have a richer one. If new minor features are implemented and released once we have reached rc stage, still a new rc version is issued. The difference between "mf" and "rc" is simply the presence of the desired feature. No support is provided for -mf versions once the first -rc version has been released. And only the most current -rc version is supported.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K.h(hh]qh1X The devstate is important during development of a feature. It helps the developers to release versions with new features to the general public and in the hope that this will result in some testing. To understand how it works, we need to look at the release cycle: As already said, at the start of a new minor version, a new non-trivial feature to be implemented in that version is selected. Development on this feature begins. At the current pace of development, getting initial support for such a non-trivial feature typically takes between two and four weeks. During this time, new feature requests come in. Also, we may find out that it may be just the right time to implement some not yet targeted feature requests. A reason for this is that the minor release's feature focus is easier to implement if the other feature is implemented first. This is a quite common thing to happen. So development on the primary focus may hold for a short period while we implement something else. Even unrelated, but very trivial feature requests (maybe an hour's worth of time to implement), may be done in between. Once we have implemented these things, we would like to release as quickly as possible (even more if someone has asked for the feature). So we do not like to wait for the original focus feature to be ready (what could take maybe three more weeks). As a result, we release the new features. But that version will also include partial code of the focus feature. Typically this doesn't hurt as long as noone tries to use it (what of course would miserably fail). But still, part of the new code is already in it. When we release such a "minor-feature enhanced" but "focus-feature not yet completed" version, we need a way to flag it. In current thinking, that is using a "-mf" devstate in the version number ("mf" stands for "minor feature"). Version numbers for -mf releases start at 0 for the first release and are monotonically incremented. Once the focus feature has been fully implemented, a new version now actually supporting that feature will be released. Now, the release reason is changed to the well-know "-rc" where "rc" stands for release candidate. For the first release candidate, the version starts at 0 again and is incremented monotonically for each subsequent release. Please note that a -rc0 may only have bare functionality but later -rc's have a richer one. If new minor features are implemented and released once we have reached rc stage, still a new rc version is issued. The difference between "mf" and "rc" is simply the presence of the desired feature. No support is provided for -mf versions once the first -rc version has been released. And only the most current -rc version is supported.qq}q(hhhhubaubh5)q}q(hXThe -rc is removed and the version declared stable when we think it has undergone sufficient testing and look sufficiently well. Then, it'll turn into a stable release. Stable minor releases never receive non-trivial new features. There may be more than one -rc releases without a stable release present at the same time. In fact, most often we will work on the next minor development version while the previous minor version is still a -rc because it is not yet considered sufficiently stable.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'KVh(hh]qh1XThe -rc is removed and the version declared stable when we think it has undergone sufficient testing and look sufficiently well. Then, it'll turn into a stable release. Stable minor releases never receive non-trivial new features. There may be more than one -rc releases without a stable release present at the same time. In fact, most often we will work on the next minor development version while the previous minor version is still a -rc because it is not yet considered sufficiently stable.qq}q(hhhhubaubh5)q}q(hXNote: the absence of the -devstate part indicates that a release is stable. Following the same logic, any release with a -devstate part is unstable.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K_h(hh]qh1XNote: the absence of the -devstate part indicates that a release is stable. Following the same logic, any release with a -devstate part is unstable.qq}q(hhhhubaubh5)q}q(hXA quick sample:qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kch(hh]qh1XA quick sample:qq}q(hhhhubaubh5)q}q(hX74.0.0 is the stable release. We begin to implement relp, moving to major.minor to 4.1. While we develop it, someone requests a trivial feature, which we implement. We need to release, so we will have 4.1.0-mf0. Another new feature is requested, move to 4.1.0-mf2. A first version of RELP is implemented: 4.1.0-rc0. A new trivial feature is implemented: 4.1.0-rc1. Relp is being enhanced: 4.1.0-rc2. We now feel RELP is good enough for the time being and begin to implement TLS on plain /Tcp syslog: logical increment to 4.2. Now another new feature in that tree: 4.2.0-mf0. Note that we now have 4.0.0 (stable) and 4.1.0-rc2 and 4.1.0-mf0 (both devel). We find a big bug in RELP coding. Two new releases: 4.1.0-rc3, 4.2.0-mf1 (the bug fix acts like a non-focus feature change). We release TLS: 4.2.0-rc0. Another RELP bug fix 4.1.0-rc4, 4.2.0-rc1. After a while, RELP is matured: 4.1.0 (stable). Now support for 4.0.x stable ends. It, however, is still provided for 3.x.x (in the actual case 2.x.x, because v3 was under the old naming scheme and now stable v3 was ever released).qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Keh(hh]qh1X74.0.0 is the stable release. We begin to implement relp, moving to major.minor to 4.1. While we develop it, someone requests a trivial feature, which we implement. We need to release, so we will have 4.1.0-mf0. Another new feature is requested, move to 4.1.0-mf2. A first version of RELP is implemented: 4.1.0-rc0. A new trivial feature is implemented: 4.1.0-rc1. Relp is being enhanced: 4.1.0-rc2. We now feel RELP is good enough for the time being and begin to implement TLS on plain /Tcp syslog: logical increment to 4.2. Now another new feature in that tree: 4.2.0-mf0. Note that we now have 4.0.0 (stable) and 4.1.0-rc2 and 4.1.0-mf0 (both devel). We find a big bug in RELP coding. Two new releases: 4.1.0-rc3, 4.2.0-mf1 (the bug fix acts like a non-focus feature change). We release TLS: 4.2.0-rc0. Another RELP bug fix 4.1.0-rc4, 4.2.0-rc1. After a while, RELP is matured: 4.1.0 (stable). Now support for 4.0.x stable ends. It, however, is still provided for 3.x.x (in the actual case 2.x.x, because v3 was under the old naming scheme and now stable v3 was ever released).qq}q(hhhhubaubh5)q}q(hXThis is how it is done so far:qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kvh(hh]qh1XThis is how it is done so far:qq}q(hhhhubaubh5)q}q(hXThis document briefly outlines the strategy for naming versions. It applies to versions 1.0.0 and above. Versions below that are all unstable and have a different naming schema.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kxh(hh]qh1XThis document briefly outlines the strategy for naming versions. It applies to versions 1.0.0 and above. Versions below that are all unstable and have a different naming schema.qq}q(hhhhubaubh5)q}q(hX**Please note that version naming is currently being changed. There is a `blog post about future rsyslog versions `_.**qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'K|h(hh]qcdocutils.nodes strong q)q}q(hhh}q(h ]h!]h"]h#]h%]uhhh]qh1XPlease note that version naming is currently being changed. There is a `blog post about future rsyslog versions `_.q΅q}q(hUhhubahUstrongqubaubh5)q}q(hXThe major version is incremented whenever a considerate, major features have been added. This is expected to happen quite infrequently.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]qh1XThe major version is incremented whenever a considerate, major features have been added. This is expected to happen quite infrequently.qׅq}q(hhhhubaubh5)q}q(hXThe minor version number is incremented whenever there is "sufficient need" (at the discretion of the developers). There is a notable difference between stable and unstable branches. The **stable branch** always has a minor version number in the range from 0 to 9. It is expected that the stable branch will receive bug and security fixes only. So the range of minor version numbers should be quite sufficient.hhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]q(h1XThe minor version number is incremented whenever there is "sufficient need" (at the discretion of the developers). There is a notable difference between stable and unstable branches. The qޅq}q(hXThe minor version number is incremented whenever there is "sufficient need" (at the discretion of the developers). There is a notable difference between stable and unstable branches. The hhubh)q}q(hX**stable branch**h}q(h ]h!]h"]h#]h%]uhhh]qh1X stable branchq允q}q(hUhhubahhubh1X always has a minor version number in the range from 0 to 9. It is expected that the stable branch will receive bug and security fixes only. So the range of minor version numbers should be quite sufficient.q腁q}q(hX always has a minor version number in the range from 0 to 9. It is expected that the stable branch will receive bug and security fixes only. So the range of minor version numbers should be quite sufficient.hhubeubh5)q}q(hX!For the **unstable branch**, minor version numbers always start at 10 and are incremented as needed (again, at the discretion of the developers). Here, new minor versions include both fixes as well as new features (hopefully most of the time). They are expected to be released quite often.hhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]q(h1XFor the qq}q(hXFor the hhubh)q}q(hX**unstable branch**h}q(h ]h!]h"]h#]h%]uhhh]qh1Xunstable branchqq}q(hUhhubahhubh1X, minor version numbers always start at 10 and are incremented as needed (again, at the discretion of the developers). Here, new minor versions include both fixes as well as new features (hopefully most of the time). They are expected to be released quite often.qq}q(hX, minor version numbers always start at 10 and are incremented as needed (again, at the discretion of the developers). Here, new minor versions include both fixes as well as new features (hopefully most of the time). They are expected to be released quite often.hhubeubh5)q}q(hXThe patch level (third number) is incremented whenever a really minor thing must be added to an existing version. This is expected to happen quite infrequently.qhhhhhh9h}q(h ]h!]h"]h#]h%]uh'Kh(hh]rh1XThe patch level (third number) is incremented whenever a really minor thing must be added to an existing version. This is expected to happen quite infrequently.rr}r(hhhhubaubh5)r}r(hXIn general, the unstable branch carries all new development. Once it concludes with a sufficiently-enhanced, quite stable version, a new major stable version is assigned.rhhhhhh9h}r(h ]h!]h"]h#]h%]uh'Kh(hh]rh1XIn general, the unstable branch carries all new development. Once it concludes with a sufficiently-enhanced, quite stable version, a new major stable version is assigned.r r }r (hjhjubaubeubahUU transformerr NU footnote_refsr }rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh(hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr }r!Uindirect_targetsr"]r#Usettingsr$(cdocutils.frontend Values r%or&}r'(Ufootnote_backlinksr(KUrecord_dependenciesr)NU rfc_base_urlr*Uhttps://tools.ietf.org/html/r+U tracebackr,Upep_referencesr-NUstrip_commentsr.NU toc_backlinksr/Uentryr0U language_coder1Uenr2U datestampr3NU report_levelr4KU _destinationr5NU halt_levelr6KU strip_classesr7Nh.NUerror_encoding_error_handlerr8Ubackslashreplacer9Udebugr:NUembed_stylesheetr;Uoutput_encoding_error_handlerr<Ustrictr=U sectnum_xformr>KUdump_transformsr?NU docinfo_xformr@KUwarning_streamrANUpep_file_url_templaterBUpep-%04drCUexit_status_levelrDKUconfigrENUstrict_visitorrFNUcloak_email_addressesrGUtrim_footnote_reference_spacerHUenvrINUdump_pseudo_xmlrJNUexpose_internalsrKNUsectsubtitle_xformrLU source_linkrMNUrfc_referencesrNNUoutput_encodingrOUutf-8rPU source_urlrQNUinput_encodingrRU utf-8-sigrSU_disable_configrTNU id_prefixrUUU tab_widthrVKUerror_encodingrWUUTF-8rXU_sourcerYhUgettext_compactrZU generatorr[NUdump_internalsr\NU smart_quotesr]U pep_base_urlr^U https://www.python.org/dev/peps/r_Usyntax_highlightr`UlongraUinput_encoding_error_handlerrbj=Uauto_id_prefixrcUidrdUdoctitle_xformreUstrip_elements_with_classesrfNU _config_filesrg]rhUfile_insertion_enabledriU raw_enabledrjKU dump_settingsrkNubUsymbol_footnote_startrlKUidsrm}rn(hhrhhuUsubstitution_namesro}rphh(h}rq(h ]h#]h"]Usourcehh!]h%]uU footnotesrr]rsUrefidsrt}ruub.build/.doctrees/proposals/index.doctree0000664000175000017500000000537013035122643017231 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX proposalsqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU proposalsqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX6/home/rger/proj/rsyslog-doc/source/proposals/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Proposalsq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Proposalsq0q1}q2(hh+hh)ubaubcdocutils.nodes compound q3)q4}q5(hUhhhhhUcompoundq6h}q7(h]h]q8Utoctree-wrapperq9ah ]h!]h#]uh%Nh&hh]q:csphinx.addnodes toctree q;)q<}q=(hUhh4hhhUtoctreeq>h}q?(Unumberedq@KU includehiddenqAhXproposals/indexqBUcaptionqCNUglobqDh!]h ]U titlesonlyqEh]h]h#]UentriesqF]qG(NXproposals/version_namingqHqINXproposals/lookup_tablesqJqKeUhiddenqLU includefilesqM]qN(hHhJeUmaxdepthqOKuh%Kh]ubaubeubahUU transformerqPNU footnote_refsqQ}qRUrefnamesqS}qTUsymbol_footnotesqU]qVUautofootnote_refsqW]qXUsymbol_footnote_refsqY]qZU citationsq[]q\h&hU current_lineq]NUtransform_messagesq^]q_Ureporterq`NUid_startqaKU autofootnotesqb]qcU citation_refsqd}qeUindirect_targetsqf]qgUsettingsqh(cdocutils.frontend Values qioqj}qk(Ufootnote_backlinksqlKUrecord_dependenciesqmNU rfc_base_urlqnUhttps://tools.ietf.org/html/qoU tracebackqpUpep_referencesqqNUstrip_commentsqrNU toc_backlinksqsUentryqtU language_codequUenqvU datestampqwNU report_levelqxKU _destinationqyNU halt_levelqzKU strip_classesq{Nh,NUerror_encoding_error_handlerq|Ubackslashreplaceq}Udebugq~NUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/proposals/lookup_tables.doctree0000664000175000017500000011204713035122643020765 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X usage exampleqNXlookup() functionqNXload_lookup_table statementqNX parametersq NXrainer gerhardsq Ximplementation detailsq NXadisconq Xlookup table file formatq NXheaderqNXlookup_table() objectqNXrsyslogqX lookup tablesqNXtableqNXexampleqNXrainerscript statementsqNuUsubstitution_defsq}qUparse_messagesq]q(cdocutils.nodes system_message q)q}q(U rawsourceqUUparentqcdocutils.nodes section q)q}q (hUU referencedq!Khh)q"}q#(hUhh)q$}q%(hUhh)q&}q'(hUhhUsourceq(X>/home/rger/proj/rsyslog-doc/source/proposals/lookup_tables.rstq)Utagnameq*Usectionq+U attributesq,}q-(Udupnamesq.]Uclassesq/]Ubackrefsq0]Uidsq1]q2U lookup-tablesq3aUnamesq4]q5hauUlineq6KUdocumentq7hUchildrenq8]q9(cdocutils.nodes title q:)q;}q<(hX Lookup Tablesq=hh&h(h)h*Utitleq>h,}q?(h.]h/]h0]h1]h4]uh6Kh7hh8]q@cdocutils.nodes Text qAX Lookup TablesqBqC}qD(hh=hh;ubaubcdocutils.nodes paragraph qE)qF}qG(hXG**NOTE: this is proposed functionality, which is NOT YET IMPLEMENTED!**qHhh&h(h)h*U paragraphqIh,}qJ(h.]h/]h0]h1]h4]uh6Kh7hh8]qKcdocutils.nodes strong qL)qM}qN(hhHh,}qO(h.]h/]h0]h1]h4]uhhFh8]qPhAXCNOTE: this is proposed functionality, which is NOT YET IMPLEMENTED!qQqR}qS(hUhhMubah*UstrongqTubaubhE)qU}qV(hX**Lookup tables are a powerful construct to obtain "class" information based on message content (e.g. to build log file names for different server types, departments or remote offices).**qWhh&h(h)h*hIh,}qX(h.]h/]h0]h1]h4]uh6Kh7hh8]qYhL)qZ}q[(hhWh,}q\(h.]h/]h0]h1]h4]uhhUh8]q]hAXLookup tables are a powerful construct to obtain "class" information based on message content (e.g. to build log file names for different server types, departments or remote offices).q^q_}q`(hUhhZubah*hTubaubhE)qa}qb(hXThe base idea is to use a message variable as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in. A main point with lookup tables is that the lookup is very fast. So while lookup tables can be emulated with if-elseif constructs, they are generally much faster. Also, it is possible to reload lookup tables during rsyslog runtime without the need for a full restart.qchh&h(h)h*hIh,}qd(h.]h/]h0]h1]h4]uh6K h7hh8]qehAXThe base idea is to use a message variable as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in. A main point with lookup tables is that the lookup is very fast. So while lookup tables can be emulated with if-elseif constructs, they are generally much faster. Also, it is possible to reload lookup tables during rsyslog runtime without the need for a full restart.qfqg}qh(hhchhaubaubhE)qi}qj(hXThe lookup tables itself exists in a separate configuration file (one per table). This file is loaded on rsyslog startup and when a reload is requested.qkhh&h(h)h*hIh,}ql(h.]h/]h0]h1]h4]uh6Kh7hh8]qmhAXThe lookup tables itself exists in a separate configuration file (one per table). This file is loaded on rsyslog startup and when a reload is requested.qnqo}qp(hhkhhiubaubhE)qq}qr(hX+There are different types of lookup tables:qshh&h(h)h*hIh,}qt(h.]h/]h0]h1]h4]uh6Kh7hh8]quhAX+There are different types of lookup tables:qvqw}qx(hhshhqubaubcdocutils.nodes bullet_list qy)qz}q{(hUhh&h(h)h*U bullet_listq|h,}q}(Ubulletq~X-h1]h0]h.]h/]h4]uh6Kh7hh8]q(cdocutils.nodes list_item q)q}q(hX]**string** - the value to be looked up is an arbitrary string. Only exact some strings match.hhzh(h)h*U list_itemqh,}q(h.]h/]h0]h1]h4]uh6Nh7hh8]qhE)q}q(hX]**string** - the value to be looked up is an arbitrary string. Only exact some strings match.hhh(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6Kh8]q(hL)q}q(hX **string**h,}q(h.]h/]h0]h1]h4]uhhh8]qhAXstringqq}q(hUhhubah*hTubhAXS - the value to be looked up is an arbitrary string. Only exact some strings match.qq}q(hXS - the value to be looked up is an arbitrary string. Only exact some strings match.hhubeubaubh)q}q(hXI**array** - the value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example 5,6,7,8,9 would be a valid set of index values, while 1,2,4,5 would not be (due to missing 2). A match happens if the requested number is present.hhzh(h)h*hh,}q(h.]h/]h0]h1]h4]uh6Nh7hh8]qhE)q}q(hXI**array** - the value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example 5,6,7,8,9 would be a valid set of index values, while 1,2,4,5 would not be (due to missing 2). A match happens if the requested number is present.hhh(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6Kh8]q(hL)q}q(hX **array**h,}q(h.]h/]h0]h1]h4]uhhh8]qhAXarrayqq}q(hUhhubah*hTubhAX@ - the value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example 5,6,7,8,9 would be a valid set of index values, while 1,2,4,5 would not be (due to missing 2). A match happens if the requested number is present.qq}q(hX@ - the value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example 5,6,7,8,9 would be a valid set of index values, while 1,2,4,5 would not be (due to missing 2). A match happens if the requested number is present.hhubeubaubh)q}q(hX,**sparseArray** - the value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information. A match happens on the first value that is less than or equal to the requested value. hhzh(h)h*hh,}q(h.]h/]h0]h1]h4]uh6Nh7hh8]qhE)q}q(hX+**sparseArray** - the value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information. A match happens on the first value that is less than or equal to the requested value.hhh(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K h8]q(hL)q}q(hX**sparseArray**h,}q(h.]h/]h0]h1]h4]uhhh8]qhAX sparseArrayqq}q(hUhhubah*hTubhAX - the value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information. A match happens on the first value that is less than or equal to the requested value.qq}q(hX - the value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information. A match happens on the first value that is less than or equal to the requested value.hhubeubaubeubhE)q}q(hXDNote that index integer numbers are represented by unsigned 32 bits.qhh&h(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K&h7hh8]qhAXDNote that index integer numbers are represented by unsigned 32 bits.qq}q(hhhhubaubhE)q}q(hXLookup tables can be access via the lookup() built-in function. The core idea is to set a local variable to the lookup result and later on use that local variable in templates.qhh&h(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K(h7hh8]qhAXLookup tables can be access via the lookup() built-in function. The core idea is to set a local variable to the lookup result and later on use that local variable in templates.qŅq}q(hhhhubaubhE)q}q(hX!More details on usage now follow.qhh&h(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K,h7hh8]qhAX!More details on usage now follow.qͅq}q(hhhhubaubh)q}q(hUhh&h(h)h*h+h,}q(h.]h/]h0]h1]qUlookup-table-file-formatqah4]qh auh6K/h7hh8]q(h:)q}q(hXLookup Table File Formatqhhh(h)h*h>h,}q(h.]h/]h0]h1]h4]uh6K/h7hh8]qhAXLookup Table File Formatq܅q}q(hhhhubaubhE)q}q(hXcLookup table files contain a single JSON object. This object contains of a header and a table part.qhhh(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K1h7hh8]qhAXcLookup table files contain a single JSON object. This object contains of a header and a table part.q䅁q}q(hhhhubaubh)q}q(hUhhh(h)h*h+h,}q(h.]h/]h0]h1]qUheaderqah4]qhauh6K5h7hh8]q(h:)q}q(hXHeaderqhhh(h)h*h>h,}q(h.]h/]h0]h1]h4]uh6K5h7hh8]qhAXHeaderqq}q(hhhhubaubhE)q}q(hXThe header is the top-level json. It has parameters "version", "nomatch", and "type". The version parameter must be given and must always be one for this version of rsyslog. The nomatch parameter is optional. If specified, it contains the value to be used if lookup() is provided an index value for which no entry exists. The default for "nomatch" is the empty string. Type specifies the type of lookup to be done.qhhh(h)h*hIh,}q(h.]h/]h0]h1]h4]uh6K7h7hh8]qhAXThe header is the top-level json. It has parameters "version", "nomatch", and "type". The version parameter must be given and must always be one for this version of rsyslog. The nomatch parameter is optional. If specified, it contains the value to be used if lookup() is provided an index value for which no entry exists. The default for "nomatch" is the empty string. Type specifies the type of lookup to be done.qq}q(hhhhubaubeubh)q}q(hUhhh(h)h*h+h,}r(h.]h/]h0]h1]rUtablerah4]rhauh6K?h7hh8]r(h:)r}r(hXTablerhhh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6K?h7hh8]r hAXTabler r }r (hjhjubaubhE)r }r(hXThis must be an array of elements, even if only a single value exists (for obvious reasons, we do not expect this to occur often). Each array element must contain two fields "index" and "value".rhhh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6KAh7hh8]rhAXThis must be an array of elements, even if only a single value exists (for obvious reasons, we do not expect this to occur often). Each array element must contain two fields "index" and "value".rr}r(hjhj ubaubeubh)r}r(hUhhh(h)h*h+h,}r(h.]h/]h0]h1]rUexamplerah4]rhauh6KFh7hh8]r(h:)r}r(hXExamplerhjh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6KFh7hh8]r hAXExampler!r"}r#(hjhjubaubhE)r$}r%(hX>This is a sample of how an ip-to-office mapping may look like:r&hjh(h)h*hIh,}r'(h.]h/]h0]h1]h4]uh6KHh7hh8]r(hAX>This is a sample of how an ip-to-office mapping may look like:r)r*}r+(hj&hj$ubaubcdocutils.nodes literal_block r,)r-}r.(hXQ{ "version":1, "nomatch":"unk", "type":"string", "table":[ {"index":"10.0.1.1", "value":"A" }, {"index":"10.0.1.2", "value":"A" }, {"index":"10.0.1.3", "value":"A" }, {"index":"10.0.2.1", "value":"B" }, {"index":"10.0.2.2", "value":"B" }, {"index":"10.0.2.3", "value":"B" } ] }hjh(h)h*U literal_blockr/h,}r0(U xml:spacer1Upreserver2h1]h0]h.]h/]h4]uh6KLh7hh8]r3hAXQ{ "version":1, "nomatch":"unk", "type":"string", "table":[ {"index":"10.0.1.1", "value":"A" }, {"index":"10.0.1.2", "value":"A" }, {"index":"10.0.1.3", "value":"A" }, {"index":"10.0.2.1", "value":"B" }, {"index":"10.0.2.2", "value":"B" }, {"index":"10.0.2.3", "value":"B" } ] }r4r5}r6(hUhj-ubaubhE)r7}r8(hXpNote: if a different IP comes in, the value "unk" is returend thanks to the nomatch parameter in the first line.r9hjh(h)h*hIh,}r:(h.]h/]h0]h1]h4]uh6KVh7hh8]r;hAXpNote: if a different IP comes in, the value "unk" is returend thanks to the nomatch parameter in the first line.r<r=}r>(hj9hj7ubaubeubeubh$h)r?}r@(hUhh&h(h)h*h+h,}rA(h.]h/]h0]h1]rBUimplementation-detailsrCah4]rDh auh6Kh7hh8]rE(h:)rF}rG(hXImplementation DetailsrHhj?h(h)h*h>h,}rI(h.]h/]h0]h1]h4]uh6Kh7hh8]rJhAXImplementation DetailsrKrL}rM(hjHhjFubaubhE)rN}rO(hXThe lookup table functionality is implemented via highly efficient algorithms. The string lookup has O(log n) time complexity. The array lookup is O(1). In case of sparseArray, we have O(log n).rPhj?h(h)h*hIh,}rQ(h.]h/]h0]h1]h4]uh6Kh7hh8]rRhAXThe lookup table functionality is implemented via highly efficient algorithms. The string lookup has O(log n) time complexity. The array lookup is O(1). In case of sparseArray, we have O(log n).rSrT}rU(hjPhjNubaubhE)rV}rW(hXTo preserve space and, more important, increase cache hit performance, equal data values are only stored once, no matter how often a lookup index points to them.rXhj?h(h)h*hIh,}rY(h.]h/]h0]h1]h4]uh6Kh7hh8]rZhAXTo preserve space and, more important, increase cache hit performance, equal data values are only stored once, no matter how often a lookup index points to them.r[r\}r](hjXhjVubaubhE)r^}r_(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2013-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hj?h(h)h*hIh,}r`(h.]h/]h0]h1]h4]uh6Kh7hh8]ra(hAX"This documentation is part of the rbrc}rd(hX"This documentation is part of the hj^ubcdocutils.nodes reference re)rf}rg(hX$`rsyslog `_h,}rh(UnamehUrefuririXhttp://www.rsyslog.com/rjh1]h0]h.]h/]h4]uhj^h8]rkhAXrsyslogrlrm}rn(hUhjfubah*U referenceroubcdocutils.nodes target rp)rq}rr(hX h!Khj^h*Utargetrsh,}rt(Urefurijjh1]ruUrsyslogrvah0]h.]h/]h4]rwhauh8]ubhAX$ project. Copyright © 2013-2014 by rxry}rz(hX$ project. Copyright © 2013-2014 by hj^ubje)r{}r|(hX3`Rainer Gerhards `_h,}r}(UnameXRainer GerhardsjiXhttp://www.gerhards.net/rainerr~h1]h0]h.]h/]h4]uhj^h8]rhAXRainer Gerhardsrr}r(hUhj{ubah*joubjp)r}r(hX! h!Khj^h*jsh,}r(Urefurij~h1]rUrainer-gerhardsrah0]h.]h/]h4]rh auh8]ubhAX and rr}r(hX and hj^ubje)r}r(hX$`Adiscon `_h,}r(UnameXAdisconjiXhttp://www.adiscon.com/rh1]h0]h.]h/]h4]uhj^h8]rhAXAdisconrr}r(hUhjubah*joubjp)r}r(hX h!Khj^h*jsh,}r(Urefurijh1]rUadisconrah0]h.]h/]h4]rh auh8]ubhAX1. Released under the GNU GPL version 3 or higher.rr}r(hX1. Released under the GNU GPL version 3 or higher.hj^ubeubeubeubh(h)h*h+h,}r(h.]h/]h0]h1]rUrainerscript-statementsrah4]rhauh6KZh7hh8]r(h:)r}r(hXRainerScript Statementsrhh$h(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6KZh7hh8]rhAXRainerScript Statementsrr}r(hjhjubaubh)r}r(hUhh$h(h)h*h+h,}r(h.]h/]h0]h1]rUlookup-table-objectrah4]rhauh6K]h7hh8]r(h:)r}r(hXlookup\_table() Objectrhjh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6K]h7hh8]rhAXlookup_table() Objectrr}r(hXlookup\_table() ObjectrhjubaubhE)r}r(hXSThis statement defines and intially loads a lookup table. Its format is as follows:rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6K_h7hh8]rhAXSThis statement defines and intially loads a lookup table. Its format is as follows:rr}r(hjhjubaubj,)r}r(hXClookup_table(name="name" file="/path/to/file" reloadOnHUP="on|off")hjh(h)h*j/h,}r(j1j2h1]h0]h.]h/]h4]uh6Kdh7hh8]rhAXClookup_table(name="name" file="/path/to/file" reloadOnHUP="on|off")rr}r(hUhjubaubh)r}r(hUh!Khjh(h)h*h+h,}r(h.]rX parametersrah/]h0]h1]rU parametersrah4]uh6Kgh7hh8]r(h:)r}r(hX Parametersrhjh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6Kgh7hh8]rhAX Parametersrr}r(hjhjubaubhy)r}r(hUhjh(h)h*h|h,}r(h~X-h1]h0]h.]h/]h4]uh6Kih7hh8]r(h)r}r(hX**name** (mandatory) Defines the name of lookup table for further reference inside the configuration. Names must be unique. Note that it is possible, though not advisible, to have different names for the same file.hjh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX**name** (mandatory)hjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kih8]r(hL)r}r(hX**name**h,}r(h.]h/]h0]h1]h4]uhjh8]rhAXnamerr}r(hUhjubah*hTubhAX (mandatory)rr}r(hX (mandatory)hjubeubhE)r}r(hXDefines the name of lookup table for further reference inside the configuration. Names must be unique. Note that it is possible, though not advisible, to have different names for the same file.rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kkh8]rhAXDefines the name of lookup table for further reference inside the configuration. Names must be unique. Note that it is possible, though not advisible, to have different names for the same file.rr}r(hjhjubaubeubh)r}r(hX**file** (mandatory) Specifies the full path for the lookup table file. This file must be readable for the user rsyslog is run under (important when dropping privileges). It must point to a valid lookup table file as described above.hjh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX**file** (mandatory)hjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Knh8]r(hL)r}r(hX**file**h,}r(h.]h/]h0]h1]h4]uhjh8]rhAXfilerr}r(hUhjubah*hTubhAX (mandatory)rr}r(hX (mandatory)hjubeubhE)r }r (hXSpecifies the full path for the lookup table file. This file must be readable for the user rsyslog is run under (important when dropping privileges). It must point to a valid lookup table file as described above.r hjh(h)h*hIh,}r (h.]h/]h0]h1]h4]uh6Kph8]r hAXSpecifies the full path for the lookup table file. This file must be readable for the user rsyslog is run under (important when dropping privileges). It must point to a valid lookup table file as described above.rr}r(hj hj ubaubeubh)r}r(hX**reloadOnHUP** (optional, default "on") Specifies if the table shall automatically be reloaded as part of HUP processing. For static tables, the default is "off" and specifying "on" triggers an error message. Note that the default of "on" may be somewhat suboptimal performance-wise, but probably is what the user intuitively expects. Turn it off if you know that you do not need the automatic reload capability. hjh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX(**reloadOnHUP** (optional, default "on")hjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kth8]r(hL)r}r(hX**reloadOnHUP**h,}r(h.]h/]h0]h1]h4]uhjh8]rhAX reloadOnHUPrr}r(hUhjubah*hTubhAX (optional, default "on")r r!}r"(hX (optional, default "on")hjubeubhE)r#}r$(hXtSpecifies if the table shall automatically be reloaded as part of HUP processing. For static tables, the default is "off" and specifying "on" triggers an error message. Note that the default of "on" may be somewhat suboptimal performance-wise, but probably is what the user intuitively expects. Turn it off if you know that you do not need the automatic reload capability.r%hjh(h)h*hIh,}r&(h.]h/]h0]h1]h4]uh6Kvh8]r'hAXtSpecifies if the table shall automatically be reloaded as part of HUP processing. For static tables, the default is "off" and specifying "on" triggers an error message. Note that the default of "on" may be somewhat suboptimal performance-wise, but probably is what the user intuitively expects. Turn it off if you know that you do not need the automatic reload capability.r(r)}r*(hj%hj#ubaubeubeubeubeubh"h)r+}r,(hUhh$h(h)h*h+h,}r-(h.]h/]h0]h1]r.Uload-lookup-table-statementr/ah4]r0hauh6Kh7hh8]r1(h:)r2}r3(hXload\_lookup\_table Statementr4hj+h(h)h*h>h,}r5(h.]h/]h0]h1]h4]uh6Kh7hh8]r6hAXload_lookup_table Statementr7r8}r9(hXload\_lookup\_table Statementr:hj2ubaubhE)r;}r<(hX**Note: in the final implementation, this MAY be implemented as an action. This is a low-level decesion that must be made during the detail development process. Parameters and semantics will remain the same of this happens.**r=hj+h(h)h*hIh,}r>(h.]h/]h0]h1]h4]uh6Kh7hh8]r?hL)r@}rA(hj=h,}rB(h.]h/]h0]h1]h4]uhj;h8]rChAXNote: in the final implementation, this MAY be implemented as an action. This is a low-level decesion that must be made during the detail development process. Parameters and semantics will remain the same of this happens.rDrE}rF(hUhj@ubah*hTubaubhE)rG}rH(hXCThis statement is used to reload a lookup table. It will fail if the table is static. While this statement is executed, lookups to this table are temporarily blocked. So for large tables, there may be a slight performance hit during the load phase. It is assume that always a triggering condition is used to load the table.rIhj+h(h)h*hIh,}rJ(h.]h/]h0]h1]h4]uh6Kh7hh8]rKhAXCThis statement is used to reload a lookup table. It will fail if the table is static. While this statement is executed, lookups to this table are temporarily blocked. So for large tables, there may be a slight performance hit during the load phase. It is assume that always a triggering condition is used to load the table.rLrM}rN(hjIhjGubaubj,)rO}rP(hXEload_lookup_table(name="name" errOnFail="on|off" valueOnFail="value")hj+h(h)h*j/h,}rQ(j1j2h1]h0]h.]h/]h4]uh6Kh7hh8]rRhAXEload_lookup_table(name="name" errOnFail="on|off" valueOnFail="value")rSrT}rU(hUhjOubaubh)rV}rW(hUh!Khj+h(h)h*h+h,}rX(h.]rYX parametersrZah/]h0]h1]r[Uid2r\ah4]uh6Kh7hh8]r](h:)r^}r_(hX Parametersr`hjVh(h)h*h>h,}ra(h.]h/]h0]h1]h4]uh6Kh7hh8]rbhAX Parametersrcrd}re(hj`hj^ubaubhy)rf}rg(hUhjVh(h)h*h|h,}rh(h~X-h1]h0]h.]h/]h4]uh6Kh7hh8]ri(h)rj}rk(hX/**name** (string) The lookup table to be used.hjfh(h)h*hh,}rl(h.]h/]h0]h1]h4]uh6Nh7hh8]rm(hE)rn}ro(hX**name** (string)hjjh(h)h*hIh,}rp(h.]h/]h0]h1]h4]uh6Kh8]rq(hL)rr}rs(hX**name**h,}rt(h.]h/]h0]h1]h4]uhjnh8]ruhAXnamervrw}rx(hUhjrubah*hTubhAX (string)ryrz}r{(hX (string)hjnubeubhE)r|}r}(hXThe lookup table to be used.r~hjjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]rhAXThe lookup table to be used.rr}r(hj~hj|ubaubeubh)r}r(hX**errOnFail** (boolean, default "on") Specifies whether or not an error message is to be emitted if there are any problems reloading the lookup table.hjfh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX%**errOnFail** (boolean, default "on")hjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]r(hL)r}r(hX **errOnFail**h,}r(h.]h/]h0]h1]h4]uhjh8]rhAX errOnFailrr}r(hUhjubah*hTubhAX (boolean, default "on")rr}r(hX (boolean, default "on")hjubeubhE)r}r(hXpSpecifies whether or not an error message is to be emitted if there are any problems reloading the lookup table.rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]rhAXpSpecifies whether or not an error message is to be emitted if there are any problems reloading the lookup table.rr}r(hjhjubaubeubh)r}r(hX**valueOnFail** (optional, string) This parameter affects processing if the lookup table cannot be loaded for some reason: If the parameter is not present, the previous table will be kept in use. If the parameter is given, the previous table will no longer be used, and instead an empty table be with nomath=valueOnFail be generated. In short, that means when the parameter is set and the reload fails, all matches will always return what is specified in valueOnFail. hjfh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX"**valueOnFail** (optional, string)rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]r(hL)r}r(hX**valueOnFail**h,}r(h.]h/]h0]h1]h4]uhjh8]rhAX valueOnFailrr}r(hUhjubah*hTubhAX (optional, string)rr}r(hX (optional, string)hjubeubhE)r}r(hXThis parameter affects processing if the lookup table cannot be loaded for some reason: If the parameter is not present, the previous table will be kept in use. If the parameter is given, the previous table will no longer be used, and instead an empty table be with nomath=valueOnFail be generated. In short, that means when the parameter is set and the reload fails, all matches will always return what is specified in valueOnFail.rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]rhAXThis parameter affects processing if the lookup table cannot be loaded for some reason: If the parameter is not present, the previous table will be kept in use. If the parameter is given, the previous table will no longer be used, and instead an empty table be with nomath=valueOnFail be generated. In short, that means when the parameter is set and the reload fails, all matches will always return what is specified in valueOnFail.rr}r(hjhjubaubeubeubeubeubh)r}r(hUhh$h(h)h*h+h,}r(h.]h/]h0]h1]rU usage-examplerah4]rhauh6Kh7hh8]r(h:)r}r(hX Usage examplerhjh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6Kh7hh8]rhAX Usage examplerr}r(hjhjubaubhE)r}r(hXFor clarity, we show only those parts of rsyslog.conf that affect lookup tables. We use the remote office example that an example lookup table file is given above for.rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh7hh8]rhAXFor clarity, we show only those parts of rsyslog.conf that affect lookup tables. We use the remote office example that an example lookup table file is given above for.rr}r(hjhjubaubj,)r}r(hXlookup_table(name="ip2office" file="/path/to/ipoffice.lu" reloadOnHUP="off") template(name="depfile" type="string" string="/var/log/%$usr.dep%/messages") set $usr.dep = lookup("ip2office", $fromhost-ip); action(type="omfile" dynfile="depfile") # support for reload "commands" if $fromhost-ip == "10.0.1.123" and $msg contains "reload office lookup table" then load_lookup_table(name="ip2office" errOnFail="on")hjh(h)h*j/h,}r(j1j2h1]h0]h.]h/]h4]uh6Kh7hh8]rhAXlookup_table(name="ip2office" file="/path/to/ipoffice.lu" reloadOnHUP="off") template(name="depfile" type="string" string="/var/log/%$usr.dep%/messages") set $usr.dep = lookup("ip2office", $fromhost-ip); action(type="omfile" dynfile="depfile") # support for reload "commands" if $fromhost-ip == "10.0.1.123" and $msg contains "reload office lookup table" then load_lookup_table(name="ip2office" errOnFail="on")rr}r(hUhjubaubhE)r}r(hXNote: for performance reasons, it makes sense to put the reload command into a dedicated ruleset, bound to a specific listener - which than should also be sufficiently secured, e.g. via TLS mutual auth.rhjh(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh7hh8]rhAXNote: for performance reasons, it makes sense to put the reload command into a dedicated ruleset, bound to a specific listener - which than should also be sufficiently secured, e.g. via TLS mutual auth.rr}r(hjhjubaubeubeubh(h)h*h+h,}r(h.]h/]h0]h1]rUlookup-functionrah4]rhauh6K~h7hh8]r(h:)r}r(hXlookup() Functionrhh"h(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6K~h7hh8]rhAXlookup() Functionrr}r(hjhjubaubhE)r}r(hX>This function is used to actually do the table lookup. Format:rhh"h(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh7hh8]rhAX>This function is used to actually do the table lookup. Format:rr}r(hjhjubaubj,)r}r(hXlookup("name", indexvalue)hh"h(h)h*j/h,}r(j1j2h1]h0]h.]h/]h4]uh6Kh7hh8]rhAXlookup("name", indexvalue)rr}r(hUhjubaubheubh(h)h*h+h,}r(h.]rjah/]h0]h1]rUid1rah4]uh6Kh7hh8]r(h:)r}r(hX Parametersrhhh(h)h*h>h,}r(h.]h/]h0]h1]h4]uh6Kh7hh8]rhAX Parametersrr}r(hjhjubaubhy)r}r (hUhhh(h)h*h|h,}r (h~X-h1]h0]h.]h/]h4]uh6Kh7hh8]r (h)r }r (hX**return value** The function returns the string that is associated with the given indexvalue. If the indexvalue is not present inside the lookup table, the "nomatch" string is returned (or an empty string if it is not defined).hjh(h)h*hh,}r(h.]h/]h0]h1]h4]uh6Nh7hh8]r(hE)r}r(hX**return value**rhj h(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]rhL)r}r(hjh,}r(h.]h/]h0]h1]h4]uhjh8]rhAX return valuerr}r(hUhjubah*hTubaubhE)r}r(hXThe function returns the string that is associated with the given indexvalue. If the indexvalue is not present inside the lookup table, the "nomatch" string is returned (or an empty string if it is not defined).rhj h(h)h*hIh,}r(h.]h/]h0]h1]h4]uh6Kh8]r hAXThe function returns the string that is associated with the given indexvalue. If the indexvalue is not present inside the lookup table, the "nomatch" string is returned (or an empty string if it is not defined).r!r"}r#(hjhjubaubeubh)r$}r%(hX3**name** (constant string) The lookup table to be used. Note that this must be specificed as a constant. In theory, variable table names could be made possible, but their runtime behaviour is not as good as for static names, and we do not (yet) see good use cases where dynamic table names could be useful.hjh(h)h*hh,}r&(h.]h/]h0]h1]h4]uh6Nh7hh8]r'(hE)r(}r)(hX**name** (constant string)hj$h(h)h*hIh,}r*(h.]h/]h0]h1]h4]uh6Kh8]r+(hL)r,}r-(hX**name**h,}r.(h.]h/]h0]h1]h4]uhj(h8]r/hAXnamer0r1}r2(hUhj,ubah*hTubhAX (constant string)r3r4}r5(hX (constant string)hj(ubeubhE)r6}r7(hXThe lookup table to be used. Note that this must be specificed as a constant. In theory, variable table names could be made possible, but their runtime behaviour is not as good as for static names, and we do not (yet) see good use cases where dynamic table names could be useful.r8hj$h(h)h*hIh,}r9(h.]h/]h0]h1]h4]uh6Kh8]r:hAXThe lookup table to be used. Note that this must be specificed as a constant. In theory, variable table names could be made possible, but their runtime behaviour is not as good as for static names, and we do not (yet) see good use cases where dynamic table names could be useful.r;r<}r=(hj8hj6ubaubeubh)r>}r?(hX{**indexvalue** (expression) The value to be looked up. While this is an arbitrary RainerScript expression, it's final value is always converted to a string in order to conduct the lookup. For example, "lookup(table, 3+4)" would be exactly the same as "lookup(table, "7")". In most cases, indexvalue will probably be a single variable, but it could also be the result of all RainerScript-supported expression types (like string concatenation or substring extraction). Valid samples are "lookup(name, $fromhost-ip & $hostname)" or "lookup(name, substr($fromhost-ip, 0, 5))" as well as of course the usual "lookup(table, $fromhost-ip)". hjh(h)h*hh,}r@(h.]h/]h0]h1]h4]uh6Nh7hh8]rA(hE)rB}rC(hX**indexvalue** (expression)hj>h(h)h*hIh,}rD(h.]h/]h0]h1]h4]uh6Kh8]rE(hL)rF}rG(hX**indexvalue**h,}rH(h.]h/]h0]h1]h4]uhjBh8]rIhAX indexvaluerJrK}rL(hUhjFubah*hTubhAX (expression)rMrN}rO(hX (expression)hjBubeubhE)rP}rQ(hX]The value to be looked up. While this is an arbitrary RainerScript expression, it's final value is always converted to a string in order to conduct the lookup. For example, "lookup(table, 3+4)" would be exactly the same as "lookup(table, "7")". In most cases, indexvalue will probably be a single variable, but it could also be the result of all RainerScript-supported expression types (like string concatenation or substring extraction). Valid samples are "lookup(name, $fromhost-ip & $hostname)" or "lookup(name, substr($fromhost-ip, 0, 5))" as well as of course the usual "lookup(table, $fromhost-ip)".rRhj>h(h)h*hIh,}rS(h.]h/]h0]h1]h4]uh6Kh8]rThAX]The value to be looked up. While this is an arbitrary RainerScript expression, it's final value is always converted to a string in order to conduct the lookup. For example, "lookup(table, 3+4)" would be exactly the same as "lookup(table, "7")". In most cases, indexvalue will probably be a single variable, but it could also be the result of all RainerScript-supported expression types (like string concatenation or substring extraction). Valid samples are "lookup(name, $fromhost-ip & $hostname)" or "lookup(name, substr($fromhost-ip, 0, 5))" as well as of course the usual "lookup(table, $fromhost-ip)".rUrV}rW(hjRhjPubaubeubeubeubh(h)h*Usystem_messagerXh,}rY(h.]UlevelKh1]h0]rZjaUsourceh)h/]h4]UlineKUtypeUINFOr[uh6Kh7hh8]r\hE)r]}r^(hX-Duplicate implicit target name: "parameters".h,}r_(h.]h/]h0]h1]h4]uhhh8]r`hAX-Duplicate implicit target name: "parameters".rarb}rc(hUhj]ubah*hIubaubh)rd}re(hUhjVh(h)h*jXh,}rf(h.]UlevelKh1]h0]rgj\aUsourceh)h/]h4]UlineKUtypej[uh6Kh7hh8]rhhE)ri}rj(hX-Duplicate implicit target name: "parameters".h,}rk(h.]h/]h0]h1]h4]uhjdh8]rlhAX-Duplicate implicit target name: "parameters".rmrn}ro(hUhjiubah*hIubaubeUcurrent_sourcerpNU decorationrqNUautofootnote_startrrKUnameidsrs}rt(hjhjhj/h Nh jh jCh jh hhhhjhjvhh3hjhjhjuh8]ruh&ahUU transformerrvNU footnote_refsrw}rxUrefnamesry}rzUsymbol_footnotesr{]r|Uautofootnote_refsr}]r~Usymbol_footnote_refsr]rU citationsr]rh7hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh>NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh)Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(jjhhjvjqjjjCj?j/j+j\jVjjjjjhhhh3h&jh$jh"jhjjjjuUsubstitution_namesr}rh*h7h,}r(h.]h1]h0]Usourceh)h/]h4]uU footnotesr]rUrefidsr}rub.build/.doctrees/index.doctree0000664000175000017500000004221613035122643015207 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xwelcome to rsyslogqNX5regular expression checker/generator tool for rsyslogqX5X referenceqNX rainer's blogq Xmanualq NXrsyslog websiteq X1Xrainer's twitter feedq X3Xsponsors and communityq NXrsyslog sponsor's pageqX4XrsyslogqX6X2X related linksqNXprofessional rsyslog supportquUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUwelcome-to-rsyslogqhU5regular-expression-checker-generator-tool-for-rsyslogqX5Uid7qhU referenceqh U rainer-s-blogqh Umanualq h Ursyslog-websiteq!X1Uid3q"h Urainer-s-twitter-feedq#X3Uid5q$h Usponsors-and-communityq%hUrsyslog-sponsor-s-pageq&X4Uid6q'hUrsyslogq(X6Uid8q)X2Uid4q*hU related-linksq+hUprofessional-rsyslog-supportq,uUchildrenq-]q.cdocutils.nodes section q/)q0}q1(U rawsourceq2UUparentq3hUsourceq4X,/home/rger/proj/rsyslog-doc/source/index.rstq5Utagnameq6Usectionq7U attributesq8}q9(Udupnamesq:]Uclassesq;]Ubackrefsq<]Uidsq=]q>haUnamesq?]q@hauUlineqAKUdocumentqBhh-]qC(cdocutils.nodes title qD)qE}qF(h2XWelcome to RsyslogqGh3h0h4h5h6UtitleqHh8}qI(h:]h;]h<]h=]h?]uhAKhBhh-]qJcdocutils.nodes Text qKXWelcome to RsyslogqLqM}qN(h2hGh3hEubaubcdocutils.nodes paragraph qO)qP}qQ(h2X#`Rsyslog `_ is a **r**\ ocket-fast **sys**\ tem for **log** processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of **swiss army knife of logging**, being able toh3h0h4h5h6U paragraphqRh8}qS(h:]h;]h<]h=]h?]uhAKhBhh-]qT(cdocutils.nodes reference qU)qV}qW(h2X$`Rsyslog `_h8}qX(UnameXRsyslogUrefuriqYXhttp://www.rsyslog.com/qZh=]h<]h:]h;]h?]uh3hPh-]q[hKXRsyslogq\q]}q^(h2Uh3hVubah6U referenceq_ubcdocutils.nodes target q`)qa}qb(h2X U referencedqcKh3hPh6Utargetqdh8}qe(UrefurihZh=]qfh(ah<]h:]h;]h?]qghauh-]ubhKX is a qhqi}qj(h2X is a h3hPubcdocutils.nodes strong qk)ql}qm(h2X**r**h8}qn(h:]h;]h<]h=]h?]uh3hPh-]qohKXrqp}qq(h2Uh3hlubah6UstrongqrubhKX ocket-fast qsqt}qu(h2X \ ocket-fast h3hPubhk)qv}qw(h2X**sys**h8}qx(h:]h;]h<]h=]h?]uh3hPh-]qyhKXsysqzq{}q|(h2Uh3hvubah6hrubhKXtem for q}q~}q(h2X \ tem for h3hPubhk)q}q(h2X**log**h8}q(h:]h;]h<]h=]h?]uh3hPh-]qhKXlogqq}q(h2Uh3hubah6hrubhKX processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of qq}q(h2X processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of h3hPubhk)q}q(h2X**swiss army knife of logging**h8}q(h:]h;]h<]h=]h?]uh3hPh-]qhKXswiss army knife of loggingqq}q(h2Uh3hubah6hrubhKX, being able toqq}q(h2X, being able toh3hPubeubcdocutils.nodes bullet_list q)q}q(h2Uh3h0h4h5h6U bullet_listqh8}q(UbulletqX-h=]h<]h:]h;]h?]uhAK hBhh-]q(cdocutils.nodes list_item q)q}q(h2X-accept inputs from a wide variety of sources,qh3hh4h5h6U list_itemqh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2hh3hh4h5h6hRh8}q(h:]h;]h<]h=]h?]uhAK h-]qhKX-accept inputs from a wide variety of sources,qq}q(h2hh3hubaubaubh)q}q(h2Xtransform them,qh3hh4h5h6hh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2hh3hh4h5h6hRh8}q(h:]h;]h<]h=]h?]uhAK h-]qhKXtransform them,qq}q(h2hh3hubaubaubh)q}q(h2X0and output the results to diverse destinations. h3hh4h5h6hh8}q(h:]h;]h<]h=]h?]uhANhBhh-]qhO)q}q(h2X/and output the results to diverse destinations.qh3hh4h5h6hRh8}q(h:]h;]h<]h=]h?]uhAK h-]qhKX/and output the results to diverse destinations.qq}q(h2hh3hubaubaubeubhO)q}q(h2XRsyslog has a strong enterprise focus but also scales down to small systems. It supports, among others, :doc:`MySQL `, :doc:`PostgreSQL `, :doc:`failover log destinations `, ElasticSearch, syslog/tcp transport, fine grain output format control, high precision timestamps, queued operations and the ability to filter on any message part.h3h0h4h5h6hRh8}q(h:]h;]h<]h=]h?]uhAK hBhh-]q(hKXhRsyslog has a strong enterprise focus but also scales down to small systems. It supports, among others, qŅq}q(h2XhRsyslog has a strong enterprise focus but also scales down to small systems. It supports, among others, h3hubcsphinx.addnodes pending_xref q)q}q(h2X!:doc:`MySQL `qh3hh4h5h6U pending_xrefqh8}q(UreftypeXdocqUrefwarnqψU reftargetqXtutorials/databaseU refdomainUh=]h<]U refexplicith:]h;]h?]UrefdocqXindexquhAK h-]qcdocutils.nodes literal q)q}q(h2hh8}q(h:]h;]q(Uxrefqheh<]h=]h?]uh3hh-]qhKXMySQLqۅq}q(h2Uh3hubah6UliteralqubaubhKX, q߅q}q(h2X, h3hubh)q}q(h2X&:doc:`PostgreSQL `qh3hh4h5h6hh8}q(UreftypeXdocqhψhXtutorials/databaseU refdomainUh=]h<]U refexplicith:]h;]h?]hhuhAK h-]qh)q}q(h2hh8}q(h:]h;]q(hheh<]h=]h?]uh3hh-]qhKX PostgreSQLq텁q}q(h2Uh3hubah6hubaubhKX, qq}q(h2X, h3hubh)q}q(h2XC:doc:`failover log destinations `qh3hh4h5h6hh8}q(UreftypeXdocqhψhX tutorials/failover_syslog_serverU refdomainUh=]h<]U refexplicith:]h;]h?]hhuhAK h-]qh)q}q(h2hh8}q(h:]h;]q(hheh<]h=]h?]uh3hh-]qhKXfailover log destinationsqq}r(h2Uh3hubah6hubaubhKX, ElasticSearch, syslog/tcp transport, fine grain output format control, high precision timestamps, queued operations and the ability to filter on any message part.rr}r(h2X, ElasticSearch, syslog/tcp transport, fine grain output format control, high precision timestamps, queued operations and the ability to filter on any message part.h3hubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh ah?]rh auhAKhBhh-]r (hD)r }r (h2XManualr h3jh4h5h6hHh8}r (h:]h;]h<]h=]h?]uhAKhBhh-]rhKXManualrr}r(h2j h3j ubaubcdocutils.nodes compound r)r}r(h2Uh3jh4h5h6Ucompoundrh8}r(h:]h;]rUtoctree-wrapperrah<]h=]h?]uhANhBhh-]rcsphinx.addnodes toctree r)r}r(h2Uh3jh4h5h6Utoctreerh8}r(UnumberedrKU includehiddenr h3hUcaptionr!NUglobr"h=]h<]U titlesonlyr#h:]h;]h?]Uentriesr$]r%(NXconfiguration/indexr&r'NXinstallation/indexr(r)NXtroubleshooting/indexr*r+NXconcepts/indexr,r-NXexamples/indexr.r/NXtutorials/indexr0r1NXdevelopment/indexr2r3NXhistorical/indexr4r5eUhiddenr6U includefilesr7]r8(j&j(j*j,j.j0j2j4eUmaxdepthr9KuhAKh-]ubaubeubh/)r:}r;(h2Uh3h0h4h5h6h7h8}r<(h:]h;]h<]h=]r=hah?]r>hauhAK%hBhh-]r?(hD)r@}rA(h2X ReferencerBh3j:h4h5h6hHh8}rC(h:]h;]h<]h=]h?]uhAK%hBhh-]rDhKX ReferencerErF}rG(h2jBh3j@ubaubj)rH}rI(h2Uh3j:h4h5h6jh8}rJ(h:]h;]rKjah<]h=]h?]uhANhBhh-]rLj)rM}rN(h2Uh3jHh4h5h6jh8}rO(jKj h3hj!Nj"h=]h<]j#h:]h;]h?]j$]rP(NXhistoryrQrRNX licensingrSrTNXhow2helprUrVNX communityrWrXNXfeaturesrYrZNXproposals/indexr[r\NXwhitepapers/indexr]r^NX free_supportr_r`NXcompatibility/indexrarbej6j7]rc(jQjSjUjWjYj[j]j_jaej9KuhAK&h-]ubaubeubh/)rd}re(h2Uh3h0h4h5h6h7h8}rf(h:]h;]h<]h=]rgh%ah?]rhh auhAK4hBhh-]ri(hD)rj}rk(h2XSponsors and Communityrlh3jdh4h5h6hHh8}rm(h:]h;]h<]h=]h?]uhAK4hBhh-]rnhKXSponsors and Communityrorp}rq(h2jlh3jjubaubhO)rr}rs(h2XPlease visit the rsyslog Sponsor's Page\ [4]_ to honor the project sponsors or become one yourself! We are very grateful for any help towards the project goals.h3jdh4h5h6hRh8}rt(h:]h;]h<]h=]h?]uhAK6hBhh-]ru(hKX'Please visit the rsyslog Sponsor's Pagervrw}rx(h2X)Please visit the rsyslog Sponsor's Page\ h3jrubcdocutils.nodes footnote_reference ry)rz}r{(h2X[4]_Uresolvedr|Kh3jrh6Ufootnote_referencer}h8}r~(h=]rUid1rah<]h:]h;]h?]Urefidrh'uh-]rhKX4r}r(h2Uh3jzubaubhKXs to honor the project sponsors or become one yourself! We are very grateful for any help towards the project goals.rr}r(h2Xs to honor the project sponsors or become one yourself! We are very grateful for any help towards the project goals.h3jrubeubhO)r}r(h2X]Visit the Rsyslog Status Page\ [2]_ to obtain current version information and project status.h3jdh4h5h6hRh8}r(h:]h;]h<]h=]h?]uhAK:hBhh-]r(hKXVisit the Rsyslog Status Pagerr}r(h2XVisit the Rsyslog Status Page\ h3jubjy)r}r(h2X[2]_j|Kh3jh6j}h8}r(h=]rUid2rah<]h:]h;]h?]jh*uh-]rhKX2r}r(h2Uh3jubaubhKX: to obtain current version information and project status.rr}r(h2X: to obtain current version information and project status.h3jubeubhO)r}r(h2XIf you like rsyslog, you might want to lend us a helping hand. It doesn't require a lot of time - even a single mouse click helps. Learn :doc:`how to help the rsyslog project `.h3jdh4h5h6hRh8}r(h:]h;]h<]h=]h?]uhAK=hBhh-]r(hKXIf you like rsyslog, you might want to lend us a helping hand. It doesn't require a lot of time - even a single mouse click helps. Learn rr}r(h2XIf you like rsyslog, you might want to lend us a helping hand. It doesn't require a lot of time - even a single mouse click helps. Learn h3jubh)r}r(h2X1:doc:`how to help the rsyslog project `rh3jh4h5h6hh8}r(UreftypeXdocrhψhXhow2helpU refdomainUh=]h<]U refexplicith:]h;]h?]hhuhAK=h-]rh)r}r(h2jh8}r(h:]h;]r(hjeh<]h=]h?]uh3jh-]rhKXhow to help the rsyslog projectrr}r(h2Uh3jubah6hubaubhKX.r}r(h2X.h3jubeubeubh/)r}r(h2Uh3h0h4h5h6h7h8}r(h:]h;]h<]h=]rh+ah?]rhauhAKChBhh-]r(hD)r}r(h2X Related Linksrh3jh4h5h6hHh8}r(h:]h;]h<]h=]h?]uhAKChBhh-]rhKX Related Linksrr}r(h2jh3jubaubcdocutils.nodes footnote r)r}r(h2X,`rsyslog Website `_rh3jh4h5h6Ufootnoterh8}r(h:]h;]h<]h=]rh"ah?]rX1auhAKEhBhh-]r(cdocutils.nodes label r)r}r(h2X1h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKX1r}r(h2Uh3jubah6UlabelrubhO)r}r(h2jh3jh4h5h6hRh8}r(h:]h;]h<]h=]h?]uhAKEh-]r(hU)r}r(h2jh8}r(UnameXrsyslog WebsitehYXhttp://www.rsyslog.com/rh=]h<]h:]h;]h?]uh3jh-]rhKXrsyslog Websiterr}r(h2Uh3jubah6h_ubh`)r}r(h2X hcKh3jh6hdh8}r(Urefurijh=]rh!ah<]h:]h;]h?]rh auh-]ubeubeubj)r}r(h2X;`rsyslog Sponsor's Page `_rj|Kh3jh4h5h6jh8}r(h:]h;]h<]rjah=]rh*ah?]rX2auhAKFhBhh-]r(j)r}r(h2X2h8}r(h:]h;]h<]h=]h?]uh3jh-]rhKX2r}r(h2Uh3jubah6jubhO)r}r(h2jh3jh4h5h6hRh8}r(h:]h;]h<]h=]h?]uhAKFh-]r(hU)r}r(h2jh8}r(UnameXrsyslog Sponsor's PagehYXhttp://www.rsyslog.com/sponsorsrh=]h<]h:]h;]h?]uh3jh-]rhKXrsyslog Sponsor's Pagerr}r(h2Uh3jubah6h_ubh`)r}r(h2X" hcKh3jh6hdh8}r(Urefurijh=]rh&ah<]h:]h;]h?]rhauh-]ubeubeubj)r}r(h2XN`Professional rsyslog Support `_rh3jh4h5h6jh8}r(h:]h;]h<]h=]rh$ah?]rX3auhAKGhBhh-]r(j)r}r(h2X3h8}r (h:]h;]h<]h=]h?]uh3jh-]r hKX3r }r (h2Uh3jubah6jubhO)r }r(h2jh3jh4h5h6hRh8}r(h:]h;]h<]h=]h?]uhAKGh-]r(hU)r}r(h2jh8}r(UnameXProfessional rsyslog SupporthYX,http://www.rsyslog.com/professional-servicesrh=]h<]h:]h;]h?]uh3j h-]rhKXProfessional rsyslog Supportrr}r(h2Uh3jubah6h_ubh`)r}r(h2X/ hcKh3j h6hdh8}r(Urefurijh=]rh,ah<]h:]h;]h?]rhauh-]ubeubeubj)r}r(h2X\`Regular expression checker/generator tool for rsyslog `_r j|Kh3jh4h5h6jh8}r!(h:]h;]h<]r"jah=]r#h'ah?]r$X4auhAKHhBhh-]r%(j)r&}r'(h2X4h8}r((h:]h;]h<]h=]h?]uh3jh-]r)hKX4r*}r+(h2Uh3j&ubah6jubhO)r,}r-(h2j h3jh4h5h6hRh8}r.(h:]h;]h<]h=]h?]uhAKHh-]r/(hU)r0}r1(h2j h8}r2(UnameX5Regular expression checker/generator tool for rsysloghYX!http://www.rsyslog.com/tool-regexr3h=]h<]h:]h;]h?]uh3j,h-]r4hKX5Regular expression checker/generator tool for rsyslogr5r6}r7(h2Uh3j0ubah6h_ubh`)r8}r9(h2X$ hcKh3j,h6hdh8}r:(Urefurij3h=]r;hah<]h:]h;]h?]r<hauh-]ubeubeubj)r=}r>(h2X7`Rainer's twitter feed `_r?h3jh4h5h6jh8}r@(h:]h;]h<]h=]rAhah?]rBX5auhAKIhBhh-]rC(j)rD}rE(h2X5h8}rF(h:]h;]h<]h=]h?]uh3j=h-]rGhKX5rH}rI(h2Uh3jDubah6jubhO)rJ}rK(h2j?h3j=h4h5h6hRh8}rL(h:]h;]h<]h=]h?]uhAKIh-]rM(hU)rN}rO(h2j?h8}rP(UnameXRainer's twitter feedhYXhttp://twitter.com/rgerhardsrQh=]h<]h:]h;]h?]uh3jJh-]rRhKXRainer's twitter feedrSrT}rU(h2Uh3jNubah6h_ubh`)rV}rW(h2X hcKh3jJh6hdh8}rX(UrefurijQh=]rYh#ah<]h:]h;]h?]rZh auh-]ubeubeubj)r[}r\(h2X-`Rainer's Blog `_ h3jh4h5h6jh8}r](h:]h;]h<]h=]r^h)ah?]r_X6auhAKJhBhh-]r`(j)ra}rb(h2X6h8}rc(h:]h;]h<]h=]h?]uh3j[h-]rdhKX6re}rf(h2Uh3jaubah6jubhO)rg}rh(h2X,`Rainer's Blog `_rih3j[h4h5h6hRh8}rj(h:]h;]h<]h=]h?]uhAKJh-]rk(hU)rl}rm(h2jih8}rn(UnameX Rainer's BloghYXhttp://blog.gerhards.net/roh=]h<]h:]h;]h?]uh3jgh-]rphKX Rainer's Blogrqrr}rs(h2Uh3jlubah6h_ubh`)rt}ru(h2X hcKh3jgh6hdh8}rv(Urefurijoh=]rwhah<]h:]h;]h?]rxh auh-]ubeubeubeubeubah2UU transformerryNU footnote_refsrz}r{(X2]r|jaX4]r}jzauUrefnamesr~}r(X2]rjaX4]rjzauUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhBhU current_linerNUtransform_messagesr]rUreporterrNUid_startrK U autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhHNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh5Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(h&jh+jhj8hj:h#jVh'jjjhh0h$jh jh"jjjzh!jh,jh(hah%jdh)j[hj=h*jhjtuUsubstitution_namesr}rh6hBh8}r(h:]h=]h<]Usourceh5h;]h?]uU footnotesr]r(jjjjj=j[eUrefidsr}rub.build/.doctrees/history.doctree0000664000175000017500000007764313035122643015615 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XwikiqXhttp://www.phplogcon.orgqX syslog blogqXsysklogd standard packageq X#why the world needs another syslogdq Xrainer gerhardsq Xrfc 3195q X sample.confq Xrsyslog forumsqX blog postqXrsyslog - historyqNXihequUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUwikiqhUhttp-www-phplogcon-orgqhU syslog-blogqh Usysklogd-standard-packageqh U#why-the-world-needs-another-syslogdqh Urainer-gerhardsq h Urfc-3195q!h U sample-confq"hUrsyslog-forumsq#hU blog-postq$hUrsyslog-historyq%hUiheq&uUchildrenq']q(cdocutils.nodes section q))q*}q+(U rawsourceq,UUparentq-hUsourceq.X./home/rger/proj/rsyslog-doc/source/history.rstq/Utagnameq0Usectionq1U attributesq2}q3(Udupnamesq4]Uclassesq5]Ubackrefsq6]Uidsq7]q8h%aUnamesq9]q:hauUlineq;KUdocumentq)q?}q@(h,XRSyslog - HistoryqAh-h*h.h/h0UtitleqBh2}qC(h4]h5]h6]h7]h9]uh;Kh`_. If you are interested to learn why Rainer initiated the project, you may want to read his blog posting on "`why the world needs another syslogd `_\ ".h-h*h.h/h0hMh2}qU(h4]h5]h6]h7]h9]uh;Kh`_h2}q](UnameXRainer GerhardsUrefuriq^Xhttp://www.gerhards.net/rainerq_h7]h6]h4]h5]h9]uh-hSh']q`hEXRainer Gerhardsqaqb}qc(h,Uh-h[ubah0U referenceqdubcdocutils.nodes target qe)qf}qg(h,X! U referencedqhKh-hSh0Utargetqih2}qj(Urefurih_h7]qkh ah6]h4]h5]h9]qlh auh']ubhEXm. If you are interested to learn why Rainer initiated the project, you may want to read his blog posting on "qmqn}qo(h,Xm. If you are interested to learn why Rainer initiated the project, you may want to read his blog posting on "h-hSubhZ)qp}qq(h,Xw`why the world needs another syslogd `_h2}qr(UnameX#why the world needs another syslogdh^XNhttp://rgerhards.blogspot.com/2007/08/why-does-world-need-another-syslogd.htmlqsh7]h6]h4]h5]h9]uh-hSh']qthEX#why the world needs another syslogdquqv}qw(h,Uh-hpubah0hdubhe)qx}qy(h,XQ hhKh-hSh0hih2}qz(Urefurihsh7]q{hah6]h4]h5]h9]q|h auh']ubhEX".q}q~}q(h,X\ ".h-hSubeubhI)q}q(h,XRsyslog was forked in **2004** from the `sysklogd standard package `_. The goal of the rsyslog project is to provide a feature-richer and reliable syslog daemon while retaining drop-in replacement capabilities to stock syslogd. By "reliable", we mean support for reliable transmission modes like TCP or `RFC 3195 `_ (syslog-reliable). We do NOT imply that the sysklogd package is unreliable.h-h*h.h/h0hMh2}q(h4]h5]h6]h7]h9]uh;K h`_h2}q(UnameXsysklogd standard packageh^X*http://www.infodrom.org/projects/sysklogd/qh7]h6]h4]h5]h9]uh-hh']qhEXsysklogd standard packageqq}q(h,Uh-hubah0hdubhe)q}q(h,X- hhKh-hh0hih2}q(Urefurihh7]qhah6]h4]h5]h9]qh auh']ubhEX. The goal of the rsyslog project is to provide a feature-richer and reliable syslog daemon while retaining drop-in replacement capabilities to stock syslogd. By "reliable", we mean support for reliable transmission modes like TCP or qq}q(h,X. The goal of the rsyslog project is to provide a feature-richer and reliable syslog daemon while retaining drop-in replacement capabilities to stock syslogd. By "reliable", we mean support for reliable transmission modes like TCP or h-hubhZ)q}q(h,XG`RFC 3195 `_h2}q(UnameXRFC 3195h^X9http://www.monitorware.com/Common/en/glossary/rfc3195.phpqh7]h6]h4]h5]h9]uh-hh']qhEXRFC 3195qq}q(h,Uh-hubah0hdubhe)q}q(h,X< hhKh-hh0hih2}q(Urefurihh7]qh!ah6]h4]h5]h9]qh auh']ubhEXL (syslog-reliable). We do NOT imply that the sysklogd package is unreliable.qq}q(h,XL (syslog-reliable). We do NOT imply that the sysklogd package is unreliable.h-hubeubhI)q}q(h,XThe name "rsyslog" stems back to the planned support for syslog-reliable. Ironically, the initial release of rsyslog did NEITHER support syslog-reliable NOR tcp based syslog. Instead, it contained enhanced configurability and other enhancements (like database support). The reason for this is that full support for RFC 3195 would require even more changes and especially fundamental architectural changes. Also, questions asked on the loganalysis list and at other places indicated that RFC3195 is NOT a prime priority for users, but rather better control over the output format. So there we were, with a rsyslogd that covers a lot of enhancements, but not a single one of these that made its name ;) Since version 0.9.2, receiving syslog messages via plain tcp is finally supported, a bit later sending via TCP, too. Starting with 1.11.0, RFC 3195 is finally supported at the receiving side (a.k.a. "listener"). Support for sending via RFC 3195 is still due. Anyhow, rsyslog has come much closer to what it name promises.qh-h*h.h/h0hMh2}q(h4]h5]h6]h7]h9]uh;Kh`_. We highly recommend having a look at it. It might not work for you if you expect thousands of messages per second (because your database won't be able to provide adequate performance), but in many cases it is a very handy analysis and troubleshooting tool. In the mean time, of course, lots of people have found many applications for writing to databases, so the prime focus is no longer on phpLogcon.h-h*h.h/h0hMh2}q(h4]h5]h6]h7]h9]uh;K'h`_h2}q(Unamehh^Xhttp://www.phplogcon.orgqh7]h6]h4]h5]h9]uh-hh']qhEXhttp://www.phplogcon.orgqDžq}q(h,Uh-hubah0hdubhe)q}q(h,X hhKh-hh0hih2}q(Urefurihh7]qhah6]h4]h5]h9]qhauh']ubhEX. We highly recommend having a look at it. It might not work for you if you expect thousands of messages per second (because your database won't be able to provide adequate performance), but in many cases it is a very handy analysis and troubleshooting tool. In the mean time, of course, lots of people have found many applications for writing to databases, so the prime focus is no longer on phpLogcon.qυq}q(h,X. We highly recommend having a look at it. It might not work for you if you expect thousands of messages per second (because your database won't be able to provide adequate performance), but in many cases it is a very handy analysis and troubleshooting tool. In the mean time, of course, lots of people have found many applications for writing to databases, so the prime focus is no longer on phpLogcon.h-hubeubhI)q}q(h,XRsyslogd supports an enhanced syslog.conf file format, and also works with the standard syslog.conf. In theory, it should be possible to simply replace the syslogd binary with the one that comes with rsyslog. Of course, in order to use any of the new features, you must re-write your syslog.conf. To learn how to do this, please review our commented `sample.conf `_ file. It outlines the enhancements over stock syslogd. Discussion has often arisen of whether having an "old syslogd" logfile format is good or evil. So far, this has not been solved (but Rainer likes the idea of a new format), so we need to live with it for the time being. It is planned to be reconsidered in the 3.x release time frame.h-h*h.h/h0hMh2}q(h4]h5]h6]h7]h9]uh;K1h`_h2}q(Unameh h^Xsample.conf.phpqh7]h6]h4]h5]h9]uh-hh']qhEX sample.confqޅq}q(h,Uh-hubah0hdubhe)q}q(h,X hhKh-hh0hih2}q(Urefurihh7]qh"ah6]h4]h5]h9]qh auh']ubhEXS file. It outlines the enhancements over stock syslogd. Discussion has often arisen of whether having an "old syslogd" logfile format is good or evil. So far, this has not been solved (but Rainer likes the idea of a new format), so we need to live with it for the time being. It is planned to be reconsidered in the 3.x release time frame.q慁q}q(h,XS file. It outlines the enhancements over stock syslogd. Discussion has often arisen of whether having an "old syslogd" logfile format is good or evil. So far, this has not been solved (but Rainer likes the idea of a new format), so we need to live with it for the time being. It is planned to be reconsidered in the 3.x release time frame.h-hubeubhI)q}q(h,XIf you are interested in the `IHE `_ environment, you might be interested to hear that rsyslog supports message with sizes of 32k and more. This feature has been tested, but by default is turned off (as it has some memory footprint that we didn't want to put on users not actually requiring it). Search the file syslogd.c and search for "IHE" - you will find easy and precise instructions on what you need to change (it's just one line of code!). Please note that RFC 3195/COOKED supports 1K message sizes only. It'll probably support longer messages in the future, but it is our believe that using larger messages with current RFC 3195 is a violation of the standard.h-h*h.h/h0hMh2}q(h4]h5]h6]h7]h9]uh;K=h`_h2}q(UnameXIHEh^X http://en.wikipedia.org/wiki/IHEqh7]h6]h4]h5]h9]uh-hh']qhEXIHEqq}q(h,Uh-hubah0hdubhe)q}q(h,X# hhKh-hh0hih2}q(Urefurihh7]qh&ah6]h4]h5]h9]qhauh']ubhEXx environment, you might be interested to hear that rsyslog supports message with sizes of 32k and more. This feature has been tested, but by default is turned off (as it has some memory footprint that we didn't want to put on users not actually requiring it). Search the file syslogd.c and search for "IHE" - you will find easy and precise instructions on what you need to change (it's just one line of code!). Please note that RFC 3195/COOKED supports 1K message sizes only. It'll probably support longer messages in the future, but it is our believe that using larger messages with current RFC 3195 is a violation of the standard.qq}q(h,Xx environment, you might be interested to hear that rsyslog supports message with sizes of 32k and more. This feature has been tested, but by default is turned off (as it has some memory footprint that we didn't want to put on users not actually requiring it). Search the file syslogd.c and search for "IHE" - you will find easy and precise instructions on what you need to change (it's just one line of code!). Please note that RFC 3195/COOKED supports 1K message sizes only. It'll probably support longer messages in the future, but it is our believe that using larger messages with current RFC 3195 is a violation of the standard.h-hubeubhI)r}r(h,XIn **February 2007**, 1.13.1 was released and served for quite a while as a stable reference. Unfortunately, it was not later released as stable, so the stable build became quite outdated.h-h*h.h/h0hMh2}r(h4]h5]h6]h7]h9]uh;KIhr?}r@(h,Uh-j:ubah0hubhEX (and beginning of August), Rainer remodeled the output part of rsyslog. It got a clean object model and is now prepared for a plug-in architecture. During that time, some base ideas for the overall new object model appeared.rArB}rC(h,X (and beginning of August), Rainer remodeled the output part of rsyslog. It got a clean object model and is now prepared for a plug-in architecture. During that time, some base ideas for the overall new object model appeared.h-j3ubeubhI)rD}rE(h,XRIn **August 2007** community involvement grew more and more. Also, more packages appeared. We were quite happy about that. To facilitate user contributions, we set up a `wiki `_ on August 10th, 2007. Also in August 2007, rsyslog 1.18.2 appeared, which is deemed to be quite close to the final 2.0.0 release. With its appearance, the pace of changes was deliberately reduced, in order to allow it to mature (see Rainers's `blog post `_ on this topic, written a bit early, but covering the essence).h-h*h.h/h0hMh2}rF(h4]h5]h6]h7]h9]uh;K[h`_h2}rW(Unamehh^Xhttp://wiki.rsyslog.com/rXh7]h6]h4]h5]h9]uh-jDh']rYhEXwikirZr[}r\(h,Uh-jUubah0hdubhe)r]}r^(h,X hhKh-jDh0hih2}r_(UrefurijXh7]r`hah6]h4]h5]h9]rahauh']ubhEX on August 10th, 2007. Also in August 2007, rsyslog 1.18.2 appeared, which is deemed to be quite close to the final 2.0.0 release. With its appearance, the pace of changes was deliberately reduced, in order to allow it to mature (see Rainers's rbrc}rd(h,X on August 10th, 2007. Also in August 2007, rsyslog 1.18.2 appeared, which is deemed to be quite close to the final 2.0.0 release. With its appearance, the pace of changes was deliberately reduced, in order to allow it to mature (see Rainers's h-jDubhZ)re}rf(h,XT`blog post `_h2}rg(UnameX blog posth^XEhttp://rgerhards.blogspot.com/2007/07/pace-of-changes-in-rsyslog.htmlrhh7]h6]h4]h5]h9]uh-jDh']rihEX blog postrjrk}rl(h,Uh-jeubah0hdubhe)rm}rn(h,XH hhKh-jDh0hih2}ro(Urefurijhh7]rph$ah6]h4]h5]h9]rqhauh']ubhEX? on this topic, written a bit early, but covering the essence).rrrs}rt(h,X? on this topic, written a bit early, but covering the essence).h-jDubeubhI)ru}rv(h,X4In **November 2007**, rsyslog became the default syslogd in Fedora 8. Obviously, that was something we \*really\* liked. Community involvement also is still growing. There is one sad thing to note: ever since summer, there is an extremely hard to find segfault bug. It happens on very rare occasions only and never in lab. We are hunting this bug for month now, but still could not get hold of it. Unfortunately, this also affects the new features schedule. It makes limited sense to implement new features if problems with existing ones are not really understood.h-h*h.h/h0hMh2}rw(h4]h5]h6]h7]h9]uh;Keh`_ to get some more insight into the development and futures of rsyslog and syslog in general. Don't be shy to post to either the blog or the `rsyslog forums `_.h-h*h.h/h0hMh2}r(h4]h5]h6]h7]h9]uh;Kh`_h2}r(UnameX syslog blogh^Xhttp://rgerhards.blogspot.com/rh7]h6]h4]h5]h9]uh-jh']rhEX syslog blogrr}r(h,Uh-jubah0hdubhe)r}r(h,X! hhKh-jh0hih2}r(Urefurijh7]rhah6]h4]h5]h9]rhauh']ubhEX to get some more insight into the development and futures of rsyslog and syslog in general. Don't be shy to post to either the blog or the rr}r(h,X to get some more insight into the development and futures of rsyslog and syslog in general. Don't be shy to post to either the blog or the h-jubhZ)r}r(h,X9`rsyslog forums `_h2}r(UnameXrsyslog forumsh^X%http://www.rsyslog.com/PNphpBB2.phtmlrh7]h6]h4]h5]h9]uh-jh']rhEXrsyslog forumsrr}r(h,Uh-jubah0hdubhe)r}r(h,X( hhKh-jh0hih2}r(Urefurijh7]rh#ah6]h4]h5]h9]rhauh']ubhEX.r}r(h,X.h-jubeubeubah,UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhUstrip_elements_with_classesr?NU _config_filesr@]Ufile_insertion_enabledrAU raw_enabledrBKU dump_settingsrCNubUsymbol_footnote_startrDKUidsrE}rF(hhhj]hhhhxh"hh%h*h#jhjh!hh&hh$jmh hfuUsubstitution_namesrG}rHh0hh}q?(Unumberedq@KU includehiddenqAhXexamples/indexqBUcaptionqCNUglobqDh!]h ]U titlesonlyqEh]h]h#]UentriesqF]qGNXexamples/high_performanceqHqIaUhiddenqJU includefilesqK]qLhHaUmaxdepthqMKuh%Kh]ubaubeubahUU transformerqNNU footnote_refsqO}qPUrefnamesqQ}qRUsymbol_footnotesqS]qTUautofootnote_refsqU]qVUsymbol_footnote_refsqW]qXU citationsqY]qZh&hU current_lineq[NUtransform_messagesq\]q]Ureporterq^NUid_startq_KU autofootnotesq`]qaU citation_refsqb}qcUindirect_targetsqd]qeUsettingsqf(cdocutils.frontend Values qgoqh}qi(Ufootnote_backlinksqjKUrecord_dependenciesqkNU rfc_base_urlqlUhttps://tools.ietf.org/html/qmU tracebackqnUpep_referencesqoNUstrip_commentsqpNU toc_backlinksqqUentryqrU language_codeqsUenqtU datestampquNU report_levelqvKU _destinationqwNU halt_levelqxKU strip_classesqyNh,NUerror_encoding_error_handlerqzUbackslashreplaceq{Udebugq|NUembed_stylesheetq}Uoutput_encoding_error_handlerq~UstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/examples/high_performance.doctree0000664000175000017500000003054013035122643021213 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xsample configurationqNX copyrightqNXuse caseqNXrainer gerhardsq Xnotes on the suggested configq NX"suggested user performance testingq NXsee alsoq NX;receiving massive amounts of messages with high performanceq NuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUsample-configurationqhU copyrightqhUuse-caseqh Urainer-gerhardsqh Unotes-on-the-suggested-configqh U"suggested-user-performance-testingqh Usee-alsoqh U;receiving-massive-amounts-of-messages-with-high-performancequUchildrenq]q cdocutils.nodes section q!)q"}q#(U rawsourceq$UUparentq%hUsourceq&X@/home/rger/proj/rsyslog-doc/source/examples/high_performance.rstq'Utagnameq(Usectionq)U attributesq*}q+(Udupnamesq,]Uclassesq-]Ubackrefsq.]Uidsq/]q0haUnamesq1]q2h auUlineq3KUdocumentq4hh]q5(cdocutils.nodes title q6)q7}q8(h$X;Receiving massive amounts of messages with high performanceq9h%h"h&h'h(Utitleq:h*}q;(h,]h-]h.]h/]h1]uh3Kh4hh]qq?}q@(h$h9h%h7ubaubh!)qA}qB(h$Uh%h"h&h'h(h)h*}qC(h,]h-]h.]h/]qDhah1]qEhauh3Kh4hh]qF(h6)qG}qH(h$XUse CaseqIh%hAh&h'h(h:h*}qJ(h,]h-]h.]h/]h1]uh3Kh4hh]qKh=XUse CaseqLqM}qN(h$hIh%hGubaubcdocutils.nodes paragraph qO)qP}qQ(h$XYou are receiving syslog messages via UDP and or TCP at a very high data rate. You want to tune the system so that it can process as many messages as possible. All messages shall be written to a single output file.qRh%hAh&h'h(U paragraphqSh*}qT(h,]h-]h.]h/]h1]uh3Kh4hh]qUh=XYou are receiving syslog messages via UDP and or TCP at a very high data rate. You want to tune the system so that it can process as many messages as possible. All messages shall be written to a single output file.qVqW}qX(h$hRh%hPubaubeubh!)qY}qZ(h$Uh%h"h&h'h(h)h*}q[(h,]h-]h.]h/]q\hah1]q]hauh3K h4hh]q^(h6)q_}q`(h$XSample Configurationqah%hYh&h'h(h:h*}qb(h,]h-]h.]h/]h1]uh3K h4hh]qch=XSample Configurationqdqe}qf(h$hah%h_ubaubcdocutils.nodes literal_block qg)qh}qi(h$X,# load required modules module(load="imudp" threads="2" timeRequery="8" batchSize="128") module(load="imptcp" threads="3") # listeners # repeat blocks if more listeners are needed # alternatively, use array syntax: # port=["514","515",...] input(type="imudp" port="514" ruleset="writeRemoteData") input(type="imptcp" port="10514" ruleset="writeRemoteData") # now define our ruleset, which also includes # threading and queue parameters. ruleset(name="writeRemoteData" queue.type="fixedArray" queue.size="250000" queue.dequeueBatchSize="4096" queue.workerThreads="4" queue.workerThreadMinimumMessages="60000" ) { action(type="omfile" file="/var/log/remote.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on") }h%hYh&h'h(U literal_blockqjh*}qk(U xml:spaceqlUpreserveqmh/]h.]h,]h-]h1]uh3Kh4hh]qnh=X,# load required modules module(load="imudp" threads="2" timeRequery="8" batchSize="128") module(load="imptcp" threads="3") # listeners # repeat blocks if more listeners are needed # alternatively, use array syntax: # port=["514","515",...] input(type="imudp" port="514" ruleset="writeRemoteData") input(type="imptcp" port="10514" ruleset="writeRemoteData") # now define our ruleset, which also includes # threading and queue parameters. ruleset(name="writeRemoteData" queue.type="fixedArray" queue.size="250000" queue.dequeueBatchSize="4096" queue.workerThreads="4" queue.workerThreadMinimumMessages="60000" ) { action(type="omfile" file="/var/log/remote.log" ioBufferSize="64k" flushOnTXEnd="off" asyncWriting="on") }qoqp}qq(h$Uh%hhubaubeubh!)qr}qs(h$Uh%h"h&h'h(h)h*}qt(h,]h-]h.]h/]quhah1]qvh auh3K-h4hh]qw(h6)qx}qy(h$XNotes on the suggested configqzh%hrh&h'h(h:h*}q{(h,]h-]h.]h/]h1]uh3K-h4hh]q|h=XNotes on the suggested configq}q~}q(h$hzh%hxubaubhO)q}q(h$XIt is highly suggested to use a recent enough Linux kernel that supports the **recvmmsg()** system call. This system call improves UDP reception speed and decreases overall system CPU utilization.h%hrh&h'h(hSh*}q(h,]h-]h.]h/]h1]uh3K.h4hh]q(h=XMIt is highly suggested to use a recent enough Linux kernel that supports the qq}q(h$XMIt is highly suggested to use a recent enough Linux kernel that supports the h%hubcdocutils.nodes strong q)q}q(h$X**recvmmsg()**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X recvmmsg()qq}q(h$Uh%hubah(Ustrongqubh=Xi system call. This system call improves UDP reception speed and decreases overall system CPU utilization.qq}q(h$Xi system call. This system call improves UDP reception speed and decreases overall system CPU utilization.h%hubeubhO)q}q(h$XWe use the **imptcp** module for tcp input, as it uses more optimal results. Note, however, that it is only available on Linux and does currently *not* support TLS. If **imptcp** cannot be used, use **imtcp** instead (this will be a bit slower).h%hrh&h'h(hSh*}q(h,]h-]h.]h/]h1]uh3K2h4hh]q(h=X We use the qq}q(h$X We use the h%hubh)q}q(h$X **imptcp**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Ximptcpqq}q(h$Uh%hubah(hubh=X} module for tcp input, as it uses more optimal results. Note, however, that it is only available on Linux and does currently qq}q(h$X} module for tcp input, as it uses more optimal results. Note, however, that it is only available on Linux and does currently h%hubcdocutils.nodes emphasis q)q}q(h$X*not*h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Xnotqq}q(h$Uh%hubah(Uemphasisqubh=X support TLS. If qq}q(h$X support TLS. If h%hubh)q}q(h$X **imptcp**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Ximptcpqq}q(h$Uh%hubah(hubh=X cannot be used, use qq}q(h$X cannot be used, use h%hubh)q}q(h$X **imtcp**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Ximtcpqq}q(h$Uh%hubah(hubh=X% instead (this will be a bit slower).qq}q(h$X% instead (this will be a bit slower).h%hubeubhO)q}q(h$XWhen writing to the output file, we use buffered mode. This means that full buffers are written, but during processing file lines are not written until the buffer is full (and thus may be delayed) and also incomplete lines are written (at buffer boundary). When the file is closed (rsyslogd stop or HUP), the buffer is completely flushed. As this is a high-traffic use case, we assume that buffered mode does not cause any concerns.qh%hrh&h'h(hSh*}q(h,]h-]h.]h/]h1]uh3K7h4hh]qh=XWhen writing to the output file, we use buffered mode. This means that full buffers are written, but during processing file lines are not written until the buffer is full (and thus may be delayed) and also incomplete lines are written (at buffer boundary). When the file is closed (rsyslogd stop or HUP), the buffer is completely flushed. As this is a high-traffic use case, we assume that buffered mode does not cause any concerns.qɅq}q(h$hh%hubaubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qh auh3K@h4hh]q(h6)q}q(h$X"Suggested User Performance Testingqh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3K@h4hh]qh=X"Suggested User Performance Testingqׅq}q(h$hh%hubaubhO)q}q(h$XEach environment is a bit different. Depending on circumstances, the **imudp** module parameters may not be optimal. In order to obtain best performance, it is suggested to measure performance level with two to four threads and somewhat lower and higher batchSize. Note that these parameters affect each other. The values given in the config above should usually work well in *high-traffic* environments. They are sub-optimal for low to medium traffic environments.h%hh&h'h(hSh*}q(h,]h-]h.]h/]h1]uh3KAh4hh]q(h=XEEach environment is a bit different. Depending on circumstances, the qޅq}q(h$XEEach environment is a bit different. Depending on circumstances, the h%hubh)q}q(h$X **imudp**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Ximudpq允q}q(h$Uh%hubah(hubh=X* module parameters may not be optimal. In order to obtain best performance, it is suggested to measure performance level with two to four threads and somewhat lower and higher batchSize. Note that these parameters affect each other. The values given in the config above should usually work well in q腁q}q(h$X* module parameters may not be optimal. In order to obtain best performance, it is suggested to measure performance level with two to four threads and somewhat lower and higher batchSize. Note that these parameters affect each other. The values given in the config above should usually work well in h%hubh)q}q(h$X*high-traffic*h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X high-trafficqq}q(h$Uh%hubah(hubh=XK environments. They are sub-optimal for low to medium traffic environments.qq}q(h$XK environments. They are sub-optimal for low to medium traffic environments.h%hubeubeubh!)q}q(h$Uh%h"h&h'h(h)h*}q(h,]h-]h.]h/]qhah1]qh auh3KJh4hh]q(h6)q}q(h$XSee Alsoqh%hh&h'h(h:h*}q(h,]h-]h.]h/]h1]uh3KJh4hh]qh=XSee Alsorr}r(h$hh%hubaubhO)r}r(h$Ximptcp, imtcp, imudp, ruleset()rh%hh&h'h(hSh*}r(h,]h-]h.]h/]h1]uh3KKh4hh]rh=Ximptcp, imtcp, imudp, ruleset()rr }r (h$jh%jubaubeubh!)r }r (h$Uh%h"h&h'h(h)h*}r (h,]h-]h.]h/]rhah1]rhauh3KNh4hh]r(h6)r}r(h$X Copyrightrh%j h&h'h(h:h*}r(h,]h-]h.]h/]h1]uh3KNh4hh]rh=X Copyrightrr}r(h$jh%jubaubhO)r}r(h$XICopyright (c) 2014 by `Rainer Gerhards `_rh%j h&h'h(hSh*}r(h,]h-]h.]h/]h1]uh3KOh4hh]r(h=XCopyright (c) 2014 by rr}r (h$XCopyright (c) 2014 by h%jubcdocutils.nodes reference r!)r"}r#(h$X3`Rainer Gerhards `_h*}r$(UnameXRainer GerhardsUrefurir%Xhttp://www.gerhards.net/rainerr&h/]h.]h,]h-]h1]uh%jh]r'h=XRainer Gerhardsr(r)}r*(h$Uh%j"ubah(U referencer+ubcdocutils.nodes target r,)r-}r.(h$X! U referencedr/Kh%jh(Utargetr0h*}r1(Urefurij&h/]r2hah.]h,]h-]h1]r3h auh]ubeubeubeubah$UU transformerr4NU footnote_refsr5}r6Urefnamesr7}r8Usymbol_footnotesr9]r:Uautofootnote_refsr;]r<Usymbol_footnote_refsr=]r>U citationsr?]r@h4hU current_linerANUtransform_messagesrB]rCUreporterrDNUid_startrEKU autofootnotesrF]rGU citation_refsrH}rIUindirect_targetsrJ]rKUsettingsrL(cdocutils.frontend Values rMorN}rO(Ufootnote_backlinksrPKUrecord_dependenciesrQNU rfc_base_urlrRUhttps://tools.ietf.org/html/rSU tracebackrTUpep_referencesrUNUstrip_commentsrVNU toc_backlinksrWUentryrXU language_coderYUenrZU datestampr[NU report_levelr\KU _destinationr]NU halt_levelr^KU strip_classesr_Nh:NUerror_encoding_error_handlerr`UbackslashreplaceraUdebugrbNUembed_stylesheetrcUoutput_encoding_error_handlerrdUstrictreU sectnum_xformrfKUdump_transformsrgNU docinfo_xformrhKUwarning_streamriNUpep_file_url_templaterjUpep-%04drkUexit_status_levelrlKUconfigrmNUstrict_visitorrnNUcloak_email_addressesroUtrim_footnote_reference_spacerpUenvrqNUdump_pseudo_xmlrrNUexpose_internalsrsNUsectsubtitle_xformrtU source_linkruNUrfc_referencesrvNUoutput_encodingrwUutf-8rxU source_urlryNUinput_encodingrzU utf-8-sigr{U_disable_configr|NU id_prefixr}UU tab_widthr~KUerror_encodingrUUTF-8rU_sourcerh'Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjeUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hj hhhhhhYhhrhhAhh"hj-uUsubstitution_namesr}rh(h4h*}r(h,]h/]h.]Usourceh'h-]h1]uU footnotesr]rUrefidsr}rub.build/.doctrees/installation/0000775000175000017500000000000013035122643015225 5ustar rgerrgerbuild/.doctrees/installation/packages.doctree0000664000175000017500000003400013035122643020347 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X contributingqNXinstalling rsyslog from packageqNXpackage availabilityqNXpackage structureq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU contributingqhUinstalling-rsyslog-from-packageqhUpackage-availabilityqh Upackage-structurequUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX</home/rger/proj/rsyslog-doc/source/installation/packages.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hXInstalling rsyslog from Packageq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5XInstalling rsyslog from Packageq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hXInstalling from package is usually the most convenient way to install rsyslog. Usually, the regular package manager can be used.q(h$]h%]h&]h']h)]uh+Kh,hh]q?h5XInstalling from package is usually the most convenient way to install rsyslog. Usually, the regular package manager can be used.q@qA}qB(hh`, so you should consider that.hhChhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5XpIf you do not find a suitable package for your distribution, there is no reason to panic. It is quite simple to qq}q(hXpIf you do not find a suitable package for your distribution, there is no reason to panic. It is quite simple to hhubcsphinx.addnodes pending_xref q)q}q(hXD:doc:`install rsyslog from the source tarball `qhhhhh U pending_xrefqh"}q(UreftypeXdocqUrefwarnqU reftargetqXinstall_from_sourceU refdomainUh']h&]U refexplicith$]h%]h)]UrefdocqXinstallation/packagesquh+Kh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]q(Uxrefqheh&]h']h)]uhhh]qh5X'install rsyslog from the source tarballqq}q(hUhhubah Uliteralqubaubh5X, so you should consider that.qq}q(hX, so you should consider that.hhubeubeubh)q}q(hUhhhhh h!h"}q(h$]h%]h&]h']qhah)]qh auh+K#h,hh]q(h.)q}q(hXPackage Structureqhhhhh h2h"}q(h$]h%]h&]h']h)]uh+K#h,hh]qh5XPackage Structureqq}q(hhhhubaubh9)q}q(hXAlmost all distributions package rsyslog in multiple packages. This is also the way Adiscon packages are created. The reason is that rsyslog has so many input and output plugins that enable it to connect to different systems like MySQL, HDFS, ElasticSearch and so on. If everything were provided in a single giantic package, you would need to install all of these dependencies, even though they are mostly not needed.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K$h,hh]qh5XAlmost all distributions package rsyslog in multiple packages. This is also the way Adiscon packages are created. The reason is that rsyslog has so many input and output plugins that enable it to connect to different systems like MySQL, HDFS, ElasticSearch and so on. If everything were provided in a single giantic package, you would need to install all of these dependencies, even though they are mostly not needed.qq}q(hhhhubaubh9)q}q(hX6For that reason, rsyslog comes with multiple packages:qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K+h,hh]qh5X6For that reason, rsyslog comes with multiple packages:qq}q(hhhhubaubcdocutils.nodes bullet_list q)q}q(hUhhhhh U bullet_listqh"}q(UbulletqX*h']h&]h$]h%]h)]uh+K-h,hh]q(cdocutils.nodes list_item q)q}q(hX*core package* (usually just called "rsyslog") - this contains core technology that is required as a base for all other packages. It also contains modules like the file writer or syslog forwareder that is extremely often used and has little dependencies.hhhhh U list_itemqh"}q(h$]h%]h&]h']h)]uh+Nh,hh]qh9)q}q(hX*core package* (usually just called "rsyslog") - this contains core technology that is required as a base for all other packages. It also contains modules like the file writer or syslog forwareder that is extremely often used and has little dependencies.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K-h]q(cdocutils.nodes emphasis q)q}q(hX*core package*h"}q(h$]h%]h&]h']h)]uhhh]qh5X core packageqڅq}q(hUhhubah Uemphasisqubh5X (usually just called "rsyslog") - this contains core technology that is required as a base for all other packages. It also contains modules like the file writer or syslog forwareder that is extremely often used and has little dependencies.qޅq}q(hX (usually just called "rsyslog") - this contains core technology that is required as a base for all other packages. It also contains modules like the file writer or syslog forwareder that is extremely often used and has little dependencies.hhubeubaubh)q}q(hX*feature package* (usually called "rsyslog-feature") - there are multiple of these packages. What exactly is available and how it is named depends on the distro. This unfortunately is a bit consistent. Usually, it is a good guess that the package is intuitively named, e.g. "rsyslog-mysql" for the MySQL component and "rsyslog-elasticsearch" for ElasticSearch support. If in doubt, it is suggested to use the distro's package manager and search for "rsyslog*". hhhhh hh"}q(h$]h%]h&]h']h)]uh+Nh,hh]qh9)q}q(hX*feature package* (usually called "rsyslog-feature") - there are multiple of these packages. What exactly is available and how it is named depends on the distro. This unfortunately is a bit consistent. Usually, it is a good guess that the package is intuitively named, e.g. "rsyslog-mysql" for the MySQL component and "rsyslog-elasticsearch" for ElasticSearch support. If in doubt, it is suggested to use the distro's package manager and search for "rsyslog*".hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K1h]q(h)q}q(hX*feature package*h"}q(h$]h%]h&]h']h)]uhhh]qh5Xfeature packageq텁q}q(hUhhubah hubh5X (usually called "rsyslog-feature") - there are multiple of these packages. What exactly is available and how it is named depends on the distro. This unfortunately is a bit consistent. Usually, it is a good guess that the package is intuitively named, e.g. "rsyslog-mysql" for the MySQL component and "rsyslog-elasticsearch" for ElasticSearch support. If in doubt, it is suggested to use the distro's package manager and search for "rsyslog*".qq}q(hX (usually called "rsyslog-feature") - there are multiple of these packages. What exactly is available and how it is named depends on the distro. This unfortunately is a bit consistent. Usually, it is a good guess that the package is intuitively named, e.g. "rsyslog-mysql" for the MySQL component and "rsyslog-elasticsearch" for ElasticSearch support. If in doubt, it is suggested to use the distro's package manager and search for "rsyslog*".hhubeubaubeubeubh)q}q(hUhhhhh h!h"}q(h$]h%]h&]h']qhah)]qhauh+K:h,hh]q(h.)q}q(hX Contributingqhhhhh h2h"}q(h$]h%]h&]h']h)]uh+K:h,hh]qh5X Contributingqq}r(hhhhubaubh9)r}r(hXe**Packaging is a community effort.** If you would like to see support for an additional distribution and know how to build packages, please consider contributing to the project and joining the packaging team. Also, rsyslog's presence on github also contains the sources for the currently maintained packages. They can be found at https://github.com/rsyslog.hhhhh h=h"}r(h$]h%]h&]h']h)]uh+K;h,hh]r(hU)r}r(hX$**Packaging is a community effort.**h"}r(h$]h%]h&]h']h)]uhjh]rh5X Packaging is a community effort.r r }r (hUhjubah h]ubh5X& If you would like to see support for an additional distribution and know how to build packages, please consider contributing to the project and joining the packaging team. Also, rsyslog's presence on github also contains the sources for the currently maintained packages. They can be found at r r }r(hX& If you would like to see support for an additional distribution and know how to build packages, please consider contributing to the project and joining the packaging team. Also, rsyslog's presence on github also contains the sources for the currently maintained packages. They can be found at hjubhp)r}r(hXhttps://github.com/rsyslogrh"}r(Urefurijh']h&]h$]h%]h)]uhjh]rh5Xhttps://github.com/rsyslogrr}r(hUhjubah hyubh5X.r}r(hX.hjubeubeubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr ]r!Usymbol_footnote_refsr"]r#U citationsr$]r%h,hU current_liner&NUtransform_messagesr']r(Ureporterr)NUid_startr*KU autofootnotesr+]r,U citation_refsr-}r.Uindirect_targetsr/]r0Usettingsr1(cdocutils.frontend Values r2or3}r4(Ufootnote_backlinksr5KUrecord_dependenciesr6NU rfc_base_urlr7Uhttps://tools.ietf.org/html/r8U tracebackr9Upep_referencesr:NUstrip_commentsr;NU toc_backlinksr<Uentryr=U language_coder>Uenr?U datestampr@NU report_levelrAKU _destinationrBNU halt_levelrCKU strip_classesrDNh2NUerror_encoding_error_handlerrEUbackslashreplacerFUdebugrGNUembed_stylesheetrHUoutput_encoding_error_handlerrIUstrictrJU sectnum_xformrKKUdump_transformsrLNU docinfo_xformrMKUwarning_streamrNNUpep_file_url_templaterOUpep-%04drPUexit_status_levelrQKUconfigrRNUstrict_visitorrSNUcloak_email_addressesrTUtrim_footnote_reference_spacerUUenvrVNUdump_pseudo_xmlrWNUexpose_internalsrXNUsectsubtitle_xformrYU source_linkrZNUrfc_referencesr[NUoutput_encodingr\Uutf-8r]U source_urlr^NUinput_encodingr_U utf-8-sigr`U_disable_configraNU id_prefixrbUU tab_widthrcKUerror_encodingrdUUTF-8reU_sourcerfhUgettext_compactrgU generatorrhNUdump_internalsriNU smart_quotesrjU pep_base_urlrkU https://www.python.org/dev/peps/rlUsyntax_highlightrmUlongrnUinput_encoding_error_handlerrojJUauto_id_prefixrpUidrqUdoctitle_xformrrUstrip_elements_with_classesrsNU _config_filesrt]Ufile_insertion_enabledruU raw_enabledrvKU dump_settingsrwNubUsymbol_footnote_startrxKUidsry}rz(hhhhhhChhuUsubstitution_namesr{}r|h h,h"}r}(h$]h']h&]Usourcehh%]h)]uU footnotesr~]rUrefidsr}rub.build/.doctrees/installation/install_from_source.doctree0000664000175000017500000015004513035122643022652 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$http://www.gnu.org/copyleft/fdl.htmlqXstep 1 - download softwareqNXwriting syslog data to mysqlqXadisconq Xstep 6 - disable stock syslogdq NX!step 8 - check daily cron scriptsq NXdoneq NXrsyslogq Xstep 4 - installqNX steps to doqNXcompatibilty notes v3qXstep 2 - run ./configureqNX copyrightqNXstep 5 - configure rsyslogdqNXbuild rsyslog from repositoryqXstep 3 - compileqNXwww.rsyslog.comqX let me knowqXbuild requirementsqNXinstalling rsyslog from sourceqNXfeedback requestedqNXhow to make your life easier...qNX"step 7 - enable rsyslogd autostartqNXrevision historyqNXdebianqX http://www.rsyslog.com/downloadsqXhousekeeping stuffq NXrainer gerhardsq!uUsubstitution_defsq"}q#Uparse_messagesq$]q%(cdocutils.nodes system_message q&)q'}q((U rawsourceq)UU attributesq*}q+(Udupnamesq,]UlevelKUidsq-]Ubackrefsq.]q/Uid1q0aUsourceXG/home/rger/proj/rsyslog-doc/source/installation/install_from_source.rstq1Uclassesq2]Unamesq3]UlineKUtypeUINFOq4uUparentq5cdocutils.nodes list_item q6)q7}q8(h)X2014-03181 \* `Rainer Gerhards `_  \* revamped doc to match current state. h5cdocutils.nodes bullet_list q9)q:}q;(h)Uh5cdocutils.nodes section q<)q=}q>(h)Uh5h<)q?}q@(h)Uh5h<)qA}qB(h)Uh5hUsourceqCh1UtagnameqDUsectionqEh*}qF(h,]h2]h.]h-]qGUinstalling-rsyslog-from-sourceqHah3]qIhauUlineqJKUdocumentqKhUchildrenqL]qM(cdocutils.nodes title qN)qO}qP(h)XInstalling rsyslog from SourceqQh5hAhCh1hDUtitleqRh*}qS(h,]h2]h.]h-]h3]uhJKhKhhL]qTcdocutils.nodes Text qUXInstalling rsyslog from SourceqVqW}qX(h)hQh5hOubaubcdocutils.nodes paragraph qY)qZ}q[(h)XV*Written by* `Rainer Gerhards `_q\h5hAhCh1hDU paragraphq]h*}q^(h,]h2]h.]h-]h3]uhJKhKhhL]q_(cdocutils.nodes emphasis q`)qa}qb(h)X *Written by*h*}qc(h,]h2]h.]h-]h3]uh5hZhL]qdhUX Written byqeqf}qg(h)Uh5haubahDUemphasisqhubhUX qi}qj(h)X h5hZubcdocutils.nodes reference qk)ql}qm(h)XI`Rainer Gerhards `_h*}qn(UnameXRainer GerhardsUrefuriqoX4http://www.adiscon.com/en/people/rainer-gerhards.phpqph-]h.]h,]h2]h3]uh5hZhL]qqhUXRainer Gerhardsqrqs}qt(h)Uh5hlubahDU referencequubcdocutils.nodes target qv)qw}qx(h)X7 U referencedqyKh5hZhDUtargetqzh*}q{(Urefurihph-]q|Urainer-gerhardsq}ah.]h,]h2]h3]q~h!auhL]ubeubhY)q}q(h)X**In this paper, I describe how to install** `rsyslog `_. It is intentionally a brief step-by-step guide, targeted to those who want to quickly get it up and running. For more elaborate information, please consult the rest of the :doc:`manual set <../index>`.h5hAhCh1hDh]h*}q(h,]h2]h.]h-]h3]uhJKhKhhL]q(cdocutils.nodes strong q)q}q(h)X,**In this paper, I describe how to install**h*}q(h,]h2]h.]h-]h3]uh5hhL]qhUX(In this paper, I describe how to installqq}q(h)Uh5hubahDUstrongqubhUX q}q(h)X h5hubhk)q}q(h)X$`rsyslog `_h*}q(Unameh hoXhttp://www.rsyslog.com/qh-]h.]h,]h2]h3]uh5hhL]qhUXrsyslogqq}q(h)Uh5hubahDhuubhv)q}q(h)X hyKh5hhDhzh*}q(Urefurihh-]qUrsyslogqah.]h,]h2]h3]qh auhL]ubhUX. It is intentionally a brief step-by-step guide, targeted to those who want to quickly get it up and running. For more elaborate information, please consult the rest of the qq}q(h)X. It is intentionally a brief step-by-step guide, targeted to those who want to quickly get it up and running. For more elaborate information, please consult the rest of the h5hubcsphinx.addnodes pending_xref q)q}q(h)X:doc:`manual set <../index>`qh5hhCh1hDU pending_xrefqh*}q(UreftypeXdocqUrefwarnqU reftargetqX../indexU refdomainUh-]h.]U refexplicith,]h2]h3]UrefdocqX installation/install_from_sourcequhJKhL]qcdocutils.nodes literal q)q}q(h)hh*}q(h,]h2]q(Uxrefqheh.]h-]h3]uh5hhL]qhUX manual setqq}q(h)Uh5hubahDUliteralqubaubhUX.q}q(h)X.h5hubeubh<)q}q(h)Uh5hAhCh1hDhEh*}q(h,]h2]h.]h-]qUhow-to-make-your-life-easierqah3]qhauhJK hKhhL]q(hN)q}q(h)XHow to make your life easier...qh5hhCh1hDhRh*}q(h,]h2]h.]h-]h3]uhJK hKhhL]qhUXHow to make your life easier...qąq}q(h)hh5hubaubhY)q}q(h)XThere are :doc:`RPMs/packages for rsyslog ` available. If you use them, you can spare yourself many of the steps below. This is highly recommended if there is a package for your distribution available.h5hhCh1hDh]h*}q(h,]h2]h.]h-]h3]uhJKhKhhL]q(hUX There are q˅q}q(h)X There are h5hubh)q}q(h)X+:doc:`RPMs/packages for rsyslog `qh5hhCh1hDhh*}q(UreftypeXdocqhhXpackagesU refdomainUh-]h.]U refexplicith,]h2]h3]hhuhJKhL]qh)q}q(h)hh*}q(h,]h2]q(hheh.]h-]h3]uh5hhL]qhUXRPMs/packages for rsyslogqمq}q(h)Uh5hubahDhubaubhUX available. If you use them, you can spare yourself many of the steps below. This is highly recommended if there is a package for your distribution available.q܅q}q(h)X available. If you use them, you can spare yourself many of the steps below. This is highly recommended if there is a package for your distribution available.h5hubeubeubh<)q}q(h)Uh5hAhCh1hDhEh*}q(h,]h2]h.]h-]qU steps-to-doqah3]qhauhJKhKhhL]q(hN)q}q(h)X Steps To Doqh5hhCh1hDhRh*}q(h,]h2]h.]h-]h3]uhJKhKhhL]qhUX Steps To Doq녁q}q(h)hh5hubaubh<)q}q(h)Uh5hhCh1hDhEh*}q(h,]h2]h.]h-]qUstep-1-download-softwareqah3]qhauhJKhKhhL]q(hN)q}q(h)XStep 1 - Download Softwareqh5hhCh1hDhRh*}q(h,]h2]h.]h-]h3]uhJKhKhhL]qhUXStep 1 - Download Softwareqq}q(h)hh5hubaubhY)q}q(h)XFor obvious reasons, you need to download rsyslog. Here, I assume that you use a distribution tarball. If you would like to use a version directly from the repository, see `build rsyslog from repository `_ instead.h5hhCh1hDh]h*}q(h,]h2]h.]h-]h3]uhJKhKhhL]r(hUXFor obvious reasons, you need to download rsyslog. Here, I assume that you use a distribution tarball. If you would like to use a version directly from the repository, see rr}r(h)XFor obvious reasons, you need to download rsyslog. Here, I assume that you use a distribution tarball. If you would like to use a version directly from the repository, see h5hubhk)r}r(h)X7`build rsyslog from repository `_h*}r(UnameXbuild rsyslog from repositoryhoXbuild_from_repo.htmlrh-]h.]h,]h2]h3]uh5hhL]rhUXbuild rsyslog from repositoryr r }r (h)Uh5jubahDhuubhv)r }r (h)X hyKh5hhDhzh*}r(Urefurijh-]rUbuild-rsyslog-from-repositoryrah.]h,]h2]h3]rhauhL]ubhUX instead.rr}r(h)X instead.h5hubeubhY)r}r(h)XLoad the most recent build from `http://www.rsyslog.com/downloads `_. Extract the software with "tar xzf -nameOfDownloadSet-". This will create a new subdirectory rsyslog-version in the current working directory. cd into that.h5hhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]r(hUX Load the most recent build from rr}r(h)X Load the most recent build from h5jubhk)r}r(h)XF`http://www.rsyslog.com/downloads `_h*}r(UnamehhoX http://www.rsyslog.com/downloadsrh-]h.]h,]h2]h3]uh5jhL]r hUX http://www.rsyslog.com/downloadsr!r"}r#(h)Uh5jubahDhuubhv)r$}r%(h)X# hyKh5jhDhzh*}r&(Urefurijh-]r'Uhttp-www-rsyslog-com-downloadsr(ah.]h,]h2]h3]r)hauhL]ubhUX. Extract the software with "tar xzf -nameOfDownloadSet-". This will create a new subdirectory rsyslog-version in the current working directory. cd into that.r*r+}r,(h)X. Extract the software with "tar xzf -nameOfDownloadSet-". This will create a new subdirectory rsyslog-version in the current working directory. cd into that.h5jubeubhY)r-}r.(h)XDepending on your system configuration, you also need to install some build tools, most importantly make, the gcc compiler and the MySQL development system (if you intend to use MySQL - the package is often named "mysql-dev"). On many systems, these things should already be present. If you don't know exactly, simply skip this step for now and see if nice error messages pop up during the compile process. If they do, you can still install the missing build environment tools. So this is nothing that you need to look at very carefully.r/h5hhCh1hDh]h*}r0(h,]h2]h.]h-]h3]uhJK%hKhhL]r1hUXDepending on your system configuration, you also need to install some build tools, most importantly make, the gcc compiler and the MySQL development system (if you intend to use MySQL - the package is often named "mysql-dev"). On many systems, these things should already be present. If you don't know exactly, simply skip this step for now and see if nice error messages pop up during the compile process. If they do, you can still install the missing build environment tools. So this is nothing that you need to look at very carefully.r2r3}r4(h)j/h5j-ubaubeubh<)r5}r6(h)Uh5hhCh1hDhEh*}r7(h,]h2]h.]h-]r8Ubuild-requirementsr9ah3]r:hauhJK0hKhhL]r;(hN)r<}r=(h)XBuild Requirementsr>h5j5hCh1hDhRh*}r?(h,]h2]h.]h-]h3]uhJK0hKhhL]r@hUXBuild RequirementsrArB}rC(h)j>h5j<ubaubhY)rD}rE(h)XLAt a minimum, the following development tools must be present on the system:rFh5j5hCh1hDh]h*}rG(h,]h2]h.]h-]h3]uhJK2hKhhL]rHhUXLAt a minimum, the following development tools must be present on the system:rIrJ}rK(h)jFh5jDubaubh9)rL}rM(h)Uh5j5hCh1hDU bullet_listrNh*}rO(UbulletrPX*h-]h.]h,]h2]h3]uhJK5hKhhL]rQ(h6)rR}rS(h)XC compiler (usually gcc)rTh5jLhCh1hDU list_itemrUh*}rV(h,]h2]h.]h-]h3]uhJNhKhhL]rWhY)rX}rY(h)jTh5jRhCh1hDh]h*}rZ(h,]h2]h.]h-]h3]uhJK5hL]r[hUXC compiler (usually gcc)r\r]}r^(h)jTh5jXubaubaubh6)r_}r`(h)Xmakerah5jLhCh1hDjUh*}rb(h,]h2]h.]h-]h3]uhJNhKhhL]rchY)rd}re(h)jah5j_hCh1hDh]h*}rf(h,]h2]h.]h-]h3]uhJK6hL]rghUXmakerhri}rj(h)jah5jdubaubaubh6)rk}rl(h)Xlibtoolrmh5jLhCh1hDjUh*}rn(h,]h2]h.]h-]h3]uhJNhKhhL]rohY)rp}rq(h)jmh5jkhCh1hDh]h*}rr(h,]h2]h.]h-]h3]uhJK7hL]rshUXlibtoolrtru}rv(h)jmh5jpubaubaubh6)rw}rx(h)XGrst2man (part of Python docutils) if you want to generate the man filesryh5jLhCh1hDjUh*}rz(h,]h2]h.]h-]h3]uhJNhKhhL]r{hY)r|}r}(h)jyh5jwhCh1hDh]h*}r~(h,]h2]h.]h-]h3]uhJK8hL]rhUXGrst2man (part of Python docutils) if you want to generate the man filesrr}r(h)jyh5j|ubaubaubh6)r}r(h)X4Bison and Flex (preferrably, otherwise yacc and lex)rh5jLhCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)jh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJK9hL]rhUX4Bison and Flex (preferrably, otherwise yacc and lex)rr}r(h)jh5jubaubaubh6)r}r(h)X-zlib development package (usually *libz-dev*)rh5jLhCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)jh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJK:hL]r(hUX"zlib development package (usually rr}r(h)X"zlib development package (usually h5jubh`)r}r(h)X *libz-dev*h*}r(h,]h2]h.]h-]h3]uh5jhL]rhUXlibz-devrr}r(h)Uh5jubahDhhubhUX)r}r(h)X)h5jubeubaubh6)r}r(h)X0json-c (usually named *libjson0-dev* or similar)rh5jLhCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)jh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJK;hL]r(hUXjson-c (usually named rr}r(h)Xjson-c (usually named h5jubh`)r}r(h)X*libjson0-dev*h*}r(h,]h2]h.]h-]h3]uh5jhL]rhUX libjson0-devrr}r(h)Uh5jubahDhhubhUX or similar)rr}r(h)X or similar)h5jubeubaubh6)r}r(h)X?libuuid (usually *uuid-dev*, if not present use --disable-uuid)rh5jLhCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)jh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKr?}r@(h)X, but that is just the regular package and not sufficient to buid rsyslog succesfully. To do so, you need to also install something named like h5j0ubh`)rA}rB(h)X*mysql-client-dev*h*}rC(h,]h2]h.]h-]h3]uh5j0hL]rDhUXmysql-client-devrErF}rG(h)Uh5jAubahDhhubhUX.rH}rI(h)X.h5j0ubeubhY)rJ}rK(h)X|Usually, the regular package is automatically installed, when you select the development package, but not vice versa. The exact behaviour and names depend on the distribution you use. It is quite common to name development packages something along the line of *pkgname-dev* or *pkgname-devel* where *pkgname* is the regular package name (like *mysql-client* in the above example).h5j5hCh1hDh]h*}rL(h,]h2]h.]h-]h3]uhJKWhKhhL]rM(hUXUsually, the regular package is automatically installed, when you select the development package, but not vice versa. The exact behaviour and names depend on the distribution you use. It is quite common to name development packages something along the line of rNrO}rP(h)XUsually, the regular package is automatically installed, when you select the development package, but not vice versa. The exact behaviour and names depend on the distribution you use. It is quite common to name development packages something along the line of h5jJubh`)rQ}rR(h)X *pkgname-dev*h*}rS(h,]h2]h.]h-]h3]uh5jJhL]rThUX pkgname-devrUrV}rW(h)Uh5jQubahDhhubhUX or rXrY}rZ(h)X or h5jJubh`)r[}r\(h)X*pkgname-devel*h*}r](h,]h2]h.]h-]h3]uh5jJhL]r^hUX pkgname-develr_r`}ra(h)Uh5j[ubahDhhubhUX where rbrc}rd(h)X where h5jJubh`)re}rf(h)X *pkgname*h*}rg(h,]h2]h.]h-]h3]uh5jJhL]rhhUXpkgnamerirj}rk(h)Uh5jeubahDhhubhUX# is the regular package name (like rlrm}rn(h)X# is the regular package name (like h5jJubh`)ro}rp(h)X*mysql-client*h*}rq(h,]h2]h.]h-]h3]uh5jJhL]rrhUX mysql-clientrsrt}ru(h)Uh5joubahDhhubhUX in the above example).rvrw}rx(h)X in the above example).h5jJubeubeubh<)ry}rz(h)Uh5hhCh1hDhEh*}r{(h,]h2]h.]h-]r|Ustep-2-run-configurer}ah3]r~hauhJK`hKhhL]r(hN)r}r(h)XStep 2 - Run ./configurerh5jyhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJK`hKhhL]rhUXStep 2 - Run ./configurerr}r(h)jh5jubaubhY)r}r(h)XRun ./configure to adopt rsyslog to your environment. While doing so, you can also enable options. Configure will display selected options when it is finished. For example, to enable MySQL support, runrh5jyhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKbhKhhL]rhUXRun ./configure to adopt rsyslog to your environment. While doing so, you can also enable options. Configure will display selected options when it is finished. For example, to enable MySQL support, runrr}r(h)jh5jubaubcdocutils.nodes literal_block r)r}r(h)X./configure --enable-mysqlh5jyhCh1hDU literal_blockrh*}r(U xml:spacerUpreserverh-]h.]h,]h2]h3]uhJKhhKhhL]rhUX./configure --enable-mysqlrr}r(h)Uh5jubaubhY)r}r(h)X:Please note that MySQL support by default is NOT disabled.rh5jyhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKjhKhhL]rhUX:Please note that MySQL support by default is NOT disabled.rr}r(h)jh5jubaubhY)r}r(h)XWTo learn which ./configure options are available and what their default values are, userh5jyhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKlhKhhL]rhUXWTo learn which ./configure options are available and what their default values are, userr}r(h)jh5jubaubhY)r}r(h)X``./configure --help``rh5jyhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKohKhhL]rh)r}r(h)jh*}r(h,]h2]h.]h-]h3]uh5jhL]rhUX./configure --helprr}r(h)Uh5jubahDhubaubeubh<)r}r(h)Uh5hhCh1hDhEh*}r(h,]h2]h.]h-]rUstep-3-compilerah3]rhauhJKshKhhL]r(hN)r}r(h)XStep 3 - Compilerh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKshKhhL]rhUXStep 3 - Compilerr}r(h)jh5jubaubhY)r}r(h)X"That is easy. Just type "make" and let the compiler work. On any recent system, that should be a very quick task, on many systems just a matter of a few seconds. If an error message comes up, most probably a part of your build environment is not installed. Check with step 1 in those cases.rh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKuhKhhL]rhUX"That is easy. Just type "make" and let the compiler work. On any recent system, that should be a very quick task, on many systems just a matter of a few seconds. If an error message comes up, most probably a part of your build environment is not installed. Check with step 1 in those cases.rr}r(h)jh5jubaubeubh<)r}r(h)Uh5hhCh1hDhEh*}r(h,]h2]h.]h-]rUstep-4-installrah3]rhauhJK|hKhhL]r(hN)r}r(h)XStep 4 - Installrh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJK|hKhhL]rhUXStep 4 - Installrr}r(h)jh5jubaubhY)r}r(h)XAgain, that is quite easy. All it takes is a "sudo make install". That will copy the rsyslogd and the man pages to the relevant directories.rh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJK~hKhhL]rhUXAgain, that is quite easy. All it takes is a "sudo make install". That will copy the rsyslogd and the man pages to the relevant directories.rr}r(h)jh5jubaubeubh<)r}r(h)Uh5hhCh1hDhEh*}r(h,]h2]h.]h-]rUstep-5-configure-rsyslogdrah3]rhauhJKhKhhL]r(hN)r}r(h)XStep 5 - Configure rsyslogdrh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXStep 5 - Configure rsyslogdrr}r(h)jh5jubaubhY)r}r(h)XIn this step, you tell rsyslogd what to do with received messages. If you are upgrading from stock syslogd, /etc/syslog.conf is probably a good starting point. Rsyslogd understands stock syslogd syntax, so you can simply copy over /etc/syslog.conf to /etc/rsyslog.conf. Note since version 3 rsyslog requires to load plug-in modules to perform useful work (more about `compatibilty notes v3 `_). To load the most common plug-ins, add the following to the top of rsyslog.conf:h5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]r(hUXoIn this step, you tell rsyslogd what to do with received messages. If you are upgrading from stock syslogd, /etc/syslog.conf is probably a good starting point. Rsyslogd understands stock syslogd syntax, so you can simply copy over /etc/syslog.conf to /etc/rsyslog.conf. Note since version 3 rsyslog requires to load plug-in modules to perform useful work (more about rr}r(h)XoIn this step, you tell rsyslogd what to do with received messages. If you are upgrading from stock syslogd, /etc/syslog.conf is probably a good starting point. Rsyslogd understands stock syslogd syntax, so you can simply copy over /etc/syslog.conf to /etc/rsyslog.conf. Note since version 3 rsyslog requires to load plug-in modules to perform useful work (more about h5jubhk)r}r(h)X/`compatibilty notes v3 `_h*}r(UnameXcompatibilty notes v3hoXv3compatibility.htmlrh-]h.]h,]h2]h3]uh5jhL]rhUXcompatibilty notes v3rr}r(h)Uh5jubahDhuubhv)r}r(h)X hyKh5jhDhzh*}r(Urefurijh-]rUcompatibilty-notes-v3rah.]h,]h2]h3]rhauhL]ubhUXR). To load the most common plug-ins, add the following to the top of rsyslog.conf:r r }r (h)XR). To load the most common plug-ins, add the following to the top of rsyslog.conf:h5jubeubj)r }r (h)X$ModLoad immark # provides --MARK-- message capability $ModLoad imudp # provides UDP syslog reception $ModLoad imtcp # provides TCP syslog reception $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging supporth5jhCh1hDjh*}r(jjh-]h.]h,]h2]h3]uhJKhKhhL]rhUX$ModLoad immark # provides --MARK-- message capability $ModLoad imudp # provides UDP syslog reception $ModLoad imtcp # provides TCP syslog reception $ModLoad imuxsock # provides support for local system logging $ModLoad imklog # provides kernel logging supportrr}r(h)Uh5j ubaubhY)r}r(h)XChange rsyslog.conf for any further enhancements you would like to see. For example, you can add database writing as outlined in the paper "`Writing syslog Data to MySQL `_\ " (remember you need to enable MySQL support during step 2 if you want to do that!).h5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]r(hUXChange rsyslog.conf for any further enhancements you would like to see. For example, you can add database writing as outlined in the paper "rr}r(h)XChange rsyslog.conf for any further enhancements you would like to see. For example, you can add database writing as outlined in the paper "h5jubhk)r}r(h)X4`Writing syslog Data to MySQL `_h*}r(UnameXWriting syslog Data to MySQLhoXrsyslog_mysql.htmlrh-]h.]h,]h2]h3]uh5jhL]rhUXWriting syslog Data to MySQLrr }r!(h)Uh5jubahDhuubhv)r"}r#(h)X hyKh5jhDhzh*}r$(Urefurijh-]r%Uwriting-syslog-data-to-mysqlr&ah.]h,]h2]h3]r'hauhL]ubhUXT" (remember you need to enable MySQL support during step 2 if you want to do that!).r(r)}r*(h)XV\ " (remember you need to enable MySQL support during step 2 if you want to do that!).h5jubeubeubh<)r+}r,(h)Uh5hhCh1hDhEh*}r-(h,]h2]h.]h-]r.Ustep-6-disable-stock-syslogdr/ah3]r0h auhJKhKhhL]r1(hN)r2}r3(h)XStep 6 - Disable stock syslogdr4h5j+hCh1hDhRh*}r5(h,]h2]h.]h-]h3]uhJKhKhhL]r6hUXStep 6 - Disable stock syslogdr7r8}r9(h)j4h5j2ubaubhY)r:}r;(h)X**You can skip this and the following steps if rsyslog was already installed as the stock syslogd on your system (e.g. via a distribution default or package).** In this case, you are finished.h5j+hCh1hDh]h*}r<(h,]h2]h.]h-]h3]uhJKhKhhL]r=(h)r>}r?(h)X**You can skip this and the following steps if rsyslog was already installed as the stock syslogd on your system (e.g. via a distribution default or package).**h*}r@(h,]h2]h.]h-]h3]uh5j:hL]rAhUXYou can skip this and the following steps if rsyslog was already installed as the stock syslogd on your system (e.g. via a distribution default or package).rBrC}rD(h)Uh5j>ubahDhubhUX In this case, you are finished.rErF}rG(h)X In this case, you are finished.h5j:ubeubhY)rH}rI(h)X)If another syslogd is installed, it must be disabled and rsyslog set to become the default. This is because both it and rsyslogd listen to the same sockets, they can NOT be run concurrently. So you need to disable the stock syslogd. To do this, you typically must change your rc.d startup scripts.rJh5j+hCh1hDh]h*}rK(h,]h2]h.]h-]h3]uhJKhKhhL]rLhUX)If another syslogd is installed, it must be disabled and rsyslog set to become the default. This is because both it and rsyslogd listen to the same sockets, they can NOT be run concurrently. So you need to disable the stock syslogd. To do this, you typically must change your rc.d startup scripts.rMrN}rO(h)jJh5jHubaubhY)rP}rQ(h)XFor example, under `Debian `_ this must be done as follows: The default runlevel is 2. We modify the init scripts for runlevel 2 - in practice, you need to do this for all run levels you will ever use (which probably means all). Under /etc/rc2.d there is a S10sysklogd script (actually a symlink). Change the name to \_S10sysklogd (this keeps the symlink in place, but will prevent further execution - effectively disabling it).h5j+hCh1hDh]h*}rR(h,]h2]h.]h-]h3]uhJKhKhhL]rS(hUXFor example, under rTrU}rV(h)XFor example, under h5jPubhk)rW}rX(h)X"`Debian `_h*}rY(UnameXDebianhoXhttp://www.debian.org/rZh-]h.]h,]h2]h3]uh5jPhL]r[hUXDebianr\r]}r^(h)Uh5jWubahDhuubhv)r_}r`(h)X hyKh5jPhDhzh*}ra(UrefurijZh-]rbUdebianrcah.]h,]h2]h3]rdhauhL]ubhUX this must be done as follows: The default runlevel is 2. We modify the init scripts for runlevel 2 - in practice, you need to do this for all run levels you will ever use (which probably means all). Under /etc/rc2.d there is a S10sysklogd script (actually a symlink). Change the name to _S10sysklogd (this keeps the symlink in place, but will prevent further execution - effectively disabling it).rerf}rg(h)X this must be done as follows: The default runlevel is 2. We modify the init scripts for runlevel 2 - in practice, you need to do this for all run levels you will ever use (which probably means all). Under /etc/rc2.d there is a S10sysklogd script (actually a symlink). Change the name to \_S10sysklogd (this keeps the symlink in place, but will prevent further execution - effectively disabling it).h5jPubeubeubh<)rh}ri(h)Uh5hhCh1hDhEh*}rj(h,]h2]h.]h-]rkU step-7-enable-rsyslogd-autostartrlah3]rmhauhJKhKhhL]rn(hN)ro}rp(h)X"Step 7 - Enable rsyslogd Autostartrqh5jhhCh1hDhRh*}rr(h,]h2]h.]h-]h3]uhJKhKhhL]rshUX"Step 7 - Enable rsyslogd Autostartrtru}rv(h)jqh5joubaubhY)rw}rx(h)XThis step is very close to step 3. Now, we want to enable rsyslogd to start automatically. The rsyslog package contains a (currently small) number of startup scripts. They are inside the distro-specific directory (e.g. debian). If there is nothing for your operating system, you can simply copy the stock syslogd startup script and make the minor modifications to run rsyslogd (the samples should be of help if you intend to do this).ryh5jhhCh1hDh]h*}rz(h,]h2]h.]h-]h3]uhJKhKhhL]r{hUXThis step is very close to step 3. Now, we want to enable rsyslogd to start automatically. The rsyslog package contains a (currently small) number of startup scripts. They are inside the distro-specific directory (e.g. debian). If there is nothing for your operating system, you can simply copy the stock syslogd startup script and make the minor modifications to run rsyslogd (the samples should be of help if you intend to do this).r|r}}r~(h)jyh5jwubaubhY)r}r(h)XIn our Debian example, the actual scripts are stored in /etc/init.d. Copy the standard script to that location. Then, you need to add a symlink to it in the respective rc.d directory. In our sample, we modify rc2.d, and can do this via the command "ln -s ../init.d/rsyslogd S10rsyslogd". Please note that the S10 prefix tells the system to start rsyslogd at the same time stock sysklogd was started.rh5jhhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXIn our Debian example, the actual scripts are stored in /etc/init.d. Copy the standard script to that location. Then, you need to add a symlink to it in the respective rc.d directory. In our sample, we modify rc2.d, and can do this via the command "ln -s ../init.d/rsyslogd S10rsyslogd". Please note that the S10 prefix tells the system to start rsyslogd at the same time stock sysklogd was started.rr}r(h)jh5jubaubhY)r}r(h)X/**Important:** if you use the database functionality, you should make sure that MySQL starts before rsyslogd. If it starts later, you will receive an error message during each restart (this might be acceptable to you). To do so, either move MySQL's start order before rsyslogd or rsyslogd's after MySQL.h5jhhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]r(h)r}r(h)X**Important:**h*}r(h,]h2]h.]h-]h3]uh5jhL]rhUX Important:rr}r(h)Uh5jubahDhubhUX! if you use the database functionality, you should make sure that MySQL starts before rsyslogd. If it starts later, you will receive an error message during each restart (this might be acceptable to you). To do so, either move MySQL's start order before rsyslogd or rsyslogd's after MySQL.rr}r(h)X! if you use the database functionality, you should make sure that MySQL starts before rsyslogd. If it starts later, you will receive an error message during each restart (this might be acceptable to you). To do so, either move MySQL's start order before rsyslogd or rsyslogd's after MySQL.h5jubeubeubh<)r}r(h)Uh5hhCh1hDhEh*}r(h,]h2]h.]h-]rUstep-8-check-daily-cron-scriptsrah3]rh auhJKhKhhL]r(hN)r}r(h)X!Step 8 - Check daily cron scriptsrh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUX!Step 8 - Check daily cron scriptsrr}r(h)jh5jubaubhY)r}r(h)XMost distributions come pre-configured with some daily scripts for log rotation. As long as you use the same log file names, the log rotation scripts will probably work quite well. There is one caveat, though. The scripts need to tell syslogd that the files have been rotated. To do this, they typically have a part using syslogd's init script to do that. Obviously, scripts for other default daemons do not know about rsyslogd, so they manipulate the other one. If that happens, in most cases an additional instance of that daemon is started. It also means that rsyslogd is not properly told about the log rotation, which will lead it to continue to write to the now-rotated files.rh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXMost distributions come pre-configured with some daily scripts for log rotation. As long as you use the same log file names, the log rotation scripts will probably work quite well. There is one caveat, though. The scripts need to tell syslogd that the files have been rotated. To do this, they typically have a part using syslogd's init script to do that. Obviously, scripts for other default daemons do not know about rsyslogd, so they manipulate the other one. If that happens, in most cases an additional instance of that daemon is started. It also means that rsyslogd is not properly told about the log rotation, which will lead it to continue to write to the now-rotated files.rr}r(h)jh5jubaubhY)r}r(h)X^So you need to fix these scripts. See your distro-specific documentation how they are located.rh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUX^So you need to fix these scripts. See your distro-specific documentation how they are located.rr}r(h)jh5jubaubeubh<)r}r(h)Uh5hhCh1hDhEh*}r(h,]h2]h.]h-]rUdonerah3]rh auhJKhKhhL]r(hN)r}r(h)XDonerh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXDonerr}r(h)jh5jubaubhY)r}r(h)X_This concludes the steps necessary to install rsyslog. Of course, it is always a good idea to test everything thoroughly. At a minimalist level, you should do a reboot and after that check if everything has come up correctly. Pay attention not only to running processes, but also check if the log files (or the database) are correctly being populated.rh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUX_This concludes the steps necessary to install rsyslog. Of course, it is always a good idea to test everything thoroughly. At a minimalist level, you should do a reboot and after that check if everything has come up correctly. Pay attention not only to running processes, but also check if the log files (or the database) are correctly being populated.rr}r(h)jh5jubaubhY)r}r(h)XIf rsyslogd encounters any serious errors during startup, you should be able to see them at least on the system console. They might not be in log file, as errors might occur before the log file rules are in place. So it is always a good idea to check system console output when things don't go smooth. In some rare cases, enabling debug logging (-d option) in rsyslogd can be helpful. If all fails, go to `www.rsyslog.com `_ and check the forum or mailing list for help with your issue.h5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]r(hUXIf rsyslogd encounters any serious errors during startup, you should be able to see them at least on the system console. They might not be in log file, as errors might occur before the log file rules are in place. So it is always a good idea to check system console output when things don't go smooth. In some rare cases, enabling debug logging (-d option) in rsyslogd can be helpful. If all fails, go to rr}r(h)XIf rsyslogd encounters any serious errors during startup, you should be able to see them at least on the system console. They might not be in log file, as errors might occur before the log file rules are in place. So it is always a good idea to check system console output when things don't go smooth. In some rare cases, enabling debug logging (-d option) in rsyslogd can be helpful. If all fails, go to h5jubhk)r}r(h)X+`www.rsyslog.com `_h*}r(UnamehhoXhttp://www.rsyslog.comrh-]h.]h,]h2]h3]uh5jhL]rhUXwww.rsyslog.comrr}r(h)Uh5jubahDhuubhv)r}r(h)X hyKh5jhDhzh*}r(Urefurijh-]rUwww-rsyslog-comrah.]h,]h2]h3]rhauhL]ubhUX> and check the forum or mailing list for help with your issue.rr}r(h)X> and check the forum or mailing list for help with your issue.h5jubeubeubeubh?eubhCh1hDhEh*}r(h,]h2]h.]h-]rUhousekeeping-stuffrah3]rh auhJKhKhhL]r(hN)r}r(h)XHousekeeping stuffrh5h?hCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXHousekeeping stuffrr}r(h)jh5jubaubhY)r}r(h)X}This section and its subsections contain all these nice things that you usually need to read only if you are really curios ;)rh5h?hCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUX}This section and its subsections contain all these nice things that you usually need to read only if you are really curios ;)rr}r(h)jh5jubaubh<)r}r(h)Uh5h?hCh1hDhEh*}r(h,]h2]h.]h-]rUfeedback-requestedrah3]rhauhJKhKhhL]r(hN)r}r(h)XFeedback requestedrh5jhCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXFeedback requestedrr}r(h)jh5jubaubhY)r}r(h)XI would appreciate feedback on this tutorial. Additional ideas, comments or bug sighting reports are very welcome. Please `let me know `_ about them.h5jhCh1hDh]h*}r (h,]h2]h.]h-]h3]uhJKhKhhL]r (hUXzI would appreciate feedback on this tutorial. Additional ideas, comments or bug sighting reports are very welcome. Please r r }r (h)XzI would appreciate feedback on this tutorial. Additional ideas, comments or bug sighting reports are very welcome. Please h5jubhk)r}r(h)X-`let me know `_h*}r(UnameX let me knowhoXmailto:rgerhards@adiscon.comrh-]h.]h,]h2]h3]uh5jhL]rhUX let me knowrr}r(h)Uh5jubahDhuubhv)r}r(h)X hyKh5jhDhzh*}r(Urefurijh-]rU let-me-knowrah.]h,]h2]h3]rhauhL]ubhUX about them.rr}r(h)X about them.h5jubeubeubh=h<)r}r (h)Uh5h?hCh1hDhEh*}r!(h,]h2]h.]h-]r"U copyrightr#ah3]r$hauhJM hKhhL]r%(hN)r&}r'(h)X Copyrightr(h5jhCh1hDhRh*}r)(h,]h2]h.]h-]h3]uhJM hKhhL]r*hUX Copyrightr+r,}r-(h)j(h5j&ubaubhY)r.}r/(h)XPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at `http://www.gnu.org/copyleft/fdl.html `_.h5jhCh1hDh]h*}r0(h,]h2]h.]h-]h3]uhJMhKhhL]r1(hUX;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at r2r3}r4(h)X;Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license can be viewed at h5j.ubhk)r5}r6(h)XN`http://www.gnu.org/copyleft/fdl.html `_h*}r7(UnamehhoX$http://www.gnu.org/copyleft/fdl.htmlr8h-]h.]h,]h2]h3]uh5j.hL]r9hUX$http://www.gnu.org/copyleft/fdl.htmlr:r;}r<(h)Uh5j5ubahDhuubhv)r=}r>(h)X' hyKh5j.hDhzh*}r?(Urefurij8h-]r@U"http-www-gnu-org-copyleft-fdl-htmlrAah.]h,]h2]h3]rBhauhL]ubhUX.rC}rD(h)X.h5j.ubeubhY)rE}rF(h)XThis documentation is part of the `rsyslog `_ project. Copyright © 2005-2008 by `Rainer Gerhards`_ and `Adiscon `_. Released under the GNU GPL version 1.2 or higher.h5jhCh1hDh]h*}rG(h,]h2]h.]h-]h3]uhJMhKhhL]rH(hUX"This documentation is part of the rIrJ}rK(h)X"This documentation is part of the h5jEubhk)rL}rM(h)X$`rsyslog `_h*}rN(UnameXrsyslogrOhoXhttp://www.rsyslog.com/rPh-]h.]h,]h2]h3]uh5jEhL]rQhUXrsyslogrRrS}rT(h)Uh5jLubahDhuubhv)rU}rV(h)X hyKh5jEhDhzh*}rW(UrefurijPh-]rXUid2rYah.]h,]rZjOah2]h3]uhL]ubhUX$ project. Copyright © 2005-2008 by r[r\}r](h)X$ project. Copyright © 2005-2008 by h5jEubhk)r^}r_(h)X`Rainer Gerhards`_Uresolvedr`Kh5jEhDhuh*}ra(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rbhUXRainer Gerhardsrcrd}re(h)Uh5j^ubaubhUX and rfrg}rh(h)X and h5jEubhk)ri}rj(h)X$`Adiscon `_h*}rk(UnameXAdisconhoXhttp://www.adiscon.com/rlh-]h.]h,]h2]h3]uh5jEhL]rmhUXAdisconrnro}rp(h)Uh5jiubahDhuubhv)rq}rr(h)X hyKh5jEhDhzh*}rs(Urefurijlh-]rtUadisconruah.]h,]h2]h3]rvh auhL]ubhUX3. Released under the GNU GPL version 1.2 or higher.rwrx}ry(h)X3. Released under the GNU GPL version 1.2 or higher.h5jEubeubeubeubhCh1hDhEh*}rz(h,]h2]h.]h-]r{Urevision-historyr|ah3]r}hauhJKhKhhL]r~(hN)r}r(h)XRevision Historyrh5h=hCh1hDhRh*}r(h,]h2]h.]h-]h3]uhJKhKhhL]rhUXRevision Historyrr}r(h)jh5jubaubh:eubhCh1hDjNh*}r(jPX-h-]h.]h,]h2]h3]uhJKhKhhL]r(h6)r}r(h)X;2005-08-08 \* `Rainer Gerhards`_ \* Initial version createdh5h:hCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)X;2005-08-08 \* `Rainer Gerhards`_ \* Initial version createdh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhL]r(hUX 2005-08-08 * rr}r(h)X2005-08-08 \* h5jubhk)r}r(h)X`Rainer Gerhards`_j`Kh5jhDhuh*}r(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rhUXRainer Gerhardsrr}r(h)Uh5jubaubhUX * Initial version createdrr}r(h)X \* Initial version createdh5jubeubaubh6)r}r(h)Xk2005-08-09 \* `Rainer Gerhards`_ \* updated to include distro-specific directories, which are now mandatoryh5h:hCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)Xk2005-08-09 \* `Rainer Gerhards`_ \* updated to include distro-specific directories, which are now mandatoryh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJKhL]r(hUX 2005-08-09 * rr}r(h)X2005-08-09 \* h5jubhk)r}r(h)X`Rainer Gerhards`_j`Kh5jhDhuh*}r(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rhUXRainer Gerhardsrr}r(h)Uh5jubaubhUXJ * updated to include distro-specific directories, which are now mandatoryrr}r(h)XK \* updated to include distro-specific directories, which are now mandatoryh5jubeubaubh6)r}r(h)XM2005-09-06 \* `Rainer Gerhards`_ \* added information on log rotation scriptsh5h:hCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)XM2005-09-06 \* `Rainer Gerhards`_ \* added information on log rotation scriptsh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJMhL]r(hUX 2005-09-06 * rr}r(h)X2005-09-06 \* h5jubhk)r}r(h)X`Rainer Gerhards`_j`Kh5jhDhuh*}r(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rhUXRainer Gerhardsrr}r(h)Uh5jubaubhUX, * added information on log rotation scriptsrr}r(h)X- \* added information on log rotation scriptsh5jubeubaubh6)r}r(h)XP2007-07-13 \* `Rainer Gerhards`_ \* updated to new autotools-based build systemh5h:hCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)XP2007-07-13 \* `Rainer Gerhards`_ \* updated to new autotools-based build systemh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJMhL]r(hUX 2007-07-13 * rr}r(h)X2007-07-13 \* h5jubhk)r}r(h)X`Rainer Gerhards`_j`Kh5jhDhuh*}r(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rhUXRainer Gerhardsrr}r(h)Uh5jubaubhUX/ * updated to new autotools-based build systemrr}r(h)X0 \* updated to new autotools-based build systemh5jubeubaubh6)r}r(h)XR2008-10-01 \* `Rainer Gerhards`_ \* added info on building from source repositoryh5h:hCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)XR2008-10-01 \* `Rainer Gerhards`_ \* added info on building from source repositoryh5jhCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJMhL]r(hUX 2008-10-01 * rr}r(h)X2008-10-01 \* h5jubhk)r}r(h)X`Rainer Gerhards`_j`Kh5jhDhuh*}r(UnameXRainer Gerhardshohph-]h.]h,]h2]h3]uhL]rhUXRainer Gerhardsrr}r(h)Uh5jubaubhUX1 * added info on building from source repositoryrr}r(h)X2 \* added info on building from source repositoryh5jubeubaubh7eubhCh1hDjUh*}r(h,]h2]h.]h-]h3]uhJNhKhhL]rhY)r}r(h)X2014-03181 \* `Rainer Gerhards `_  \* revamped doc to match current state.h5h7hCh1hDh]h*}r(h,]h2]h.]h-]h3]uhJMhL]r(hUX 2014-03181 * rr}r(h)X2014-03181 \* h5jubhk)r}r(h)XI`Rainer Gerhards `_h*}r(UnameXRainer GerhardshoX4http://www.adiscon.com/en/people/rainer-gerhards.phprh-]h.]h,]h2]h3]uh5jhL]rhUXRainer Gerhardsrr}r(h)Uh5jubahDhuubhv)r}r(h)X7 hyKh5jhDhzh*}r(Urefurijh-]rh0ah.]h,]rXrainer gerhardsrah2]h3]uhL]ubhUX)  * revamped doc to match current state.r r }r (h)X*  \* revamped doc to match current state.h5jubeubaubhL]r hY)r }r(h)X2Duplicate explicit target name: "rainer gerhards".h*}r(h,]h2]h.]h-]h3]uh5h'hL]rhUX2Duplicate explicit target name: "rainer gerhards".rr}r(h)Uh5j ubahDh]ubahDUsystem_messagerubh&)r}r(h)Uh5jhCh1hDjh*}r(h,]UlevelKh-]h.]rjYaUsourceh1h2]h3]UlineKUtypeh4uhJMhKhhL]rhY)r}r(h)X*Duplicate explicit target name: "rsyslog".h*}r(h,]h2]h.]h-]h3]uh5jhL]rhUX*Duplicate explicit target name: "rsyslog".rr}r (h)Uh5jubahDh]ubaubeUcurrent_sourcer!NU decorationr"NUautofootnote_startr#KUnameidsr$}r%(hjAhhhj&h juh j/h jh jh hhjhhhjhj}hj#hjhjhjhjhjhj9hhHhjhhhjlhj|hjchj(h jh!h}uhL]r&hAah)UU transformerr'NU footnote_refsr(}r)Urefnamesr*}r+Xrainer gerhards]r,(jjjjjj^esUsymbol_footnotesr-]r.Uautofootnote_refsr/]r0Usymbol_footnote_refsr1]r2U citationsr3]r4hKhU current_liner5NUtransform_messagesr6]r7Ureporterr8NUid_startr9KU autofootnotesr:]r;U citation_refsr<}r=Uindirect_targetsr>]r?Usettingsr@(cdocutils.frontend Values rAorB}rC(Ufootnote_backlinksrDKUrecord_dependenciesrENU rfc_base_urlrFUhttps://tools.ietf.org/html/rGU tracebackrHUpep_referencesrINUstrip_commentsrJNU toc_backlinksrKUentryrLU language_coderMUenrNU datestamprONU report_levelrPKU _destinationrQNU halt_levelrRKU strip_classesrSNhRNUerror_encoding_error_handlerrTUbackslashreplacerUUdebugrVNUembed_stylesheetrWUoutput_encoding_error_handlerrXUstrictrYU sectnum_xformrZKUdump_transformsr[NU docinfo_xformr\KUwarning_streamr]NUpep_file_url_templater^Upep-%04dr_Uexit_status_levelr`KUconfigraNUstrict_visitorrbNUcloak_email_addressesrcUtrim_footnote_reference_spacerdUenvreNUdump_pseudo_xmlrfNUexpose_internalsrgNUsectsubtitle_xformrhU source_linkriNUrfc_referencesrjNUoutput_encodingrkUutf-8rlU source_urlrmNUinput_encodingrnU utf-8-sigroU_disable_configrpNU id_prefixrqUU tab_widthrrKUerror_encodingrsUUTF-8rtU_sourceruh1Ugettext_compactrvU generatorrwNUdump_internalsrxNU smart_quotesryU pep_base_urlrzU https://www.python.org/dev/peps/r{Usyntax_highlightr|Ulongr}Uinput_encoding_error_handlerr~jYUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(j|h=hhj9j5jujqjjjjhhhhhHhAhhj#jjYjUh0jjjjljhjjjAj=jjjj jh?jjjjjcj_j/j+j}jyj(j$j&j"jjjjh}hwuUsubstitution_namesr}rhDhKh*}r(h,]h-]h.]Usourceh1h2]h3]uU footnotesr]rUrefidsr}rub.build/.doctrees/installation/index.doctree0000664000175000017500000001034713035122643017710 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX installationqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU installationqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX9/home/rger/proj/rsyslog-doc/source/installation/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Installationq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Installationq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX+Installation is usually as simple as sayingq6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/X+Installation is usually as simple as sayingq:q;}q<(hh6hh4ubaubh3)q=}q>(hX``$ sudo yum install rsyslog``q?hhhhhh7h}q@(h]h]h ]h!]h#]uh%Kh&hh]qAcdocutils.nodes literal qB)qC}qD(hh?h}qE(h]h]h ]h!]h#]uhh=h]qFh/X$ sudo yum install rsyslogqGqH}qI(hUhhCubahUliteralqJubaubh3)qK}qL(hXorqMhhhhhh7h}qN(h]h]h ]h!]h#]uh%Kh&hh]qOh/XorqPqQ}qR(hhMhhKubaubh3)qS}qT(hX"``$ sudo apt-get install rsyslog``qUhhhhhh7h}qV(h]h]h ]h!]h#]uh%K h&hh]qWhB)qX}qY(hhUh}qZ(h]h]h ]h!]h#]uhhSh]q[h/X$ sudo apt-get install rsyslogq\q]}q^(hUhhXubahhJubaubh3)q_}q`(hX(However, distributions usually provide rather old versions of rsyslog, and so there are chances you want to have something newer. In that case, you need to either use the rsyslog project's own packages, a distribution tarball or build directly from repo. All of this is detailled in this chapter.qahhhhhh7h}qb(h]h]h ]h!]h#]uh%K h&hh]qch/X(However, distributions usually provide rather old versions of rsyslog, and so there are chances you want to have something newer. In that case, you need to either use the rsyslog project's own packages, a distribution tarball or build directly from repo. All of this is detailled in this chapter.qdqe}qf(hhahh_ubaubcdocutils.nodes compound qg)qh}qi(hUhhhhhUcompoundqjh}qk(h]h]qlUtoctree-wrapperqmah ]h!]h#]uh%Nh&hh]qncsphinx.addnodes toctree qo)qp}qq(hUhhhhhhUtoctreeqrh}qs(UnumberedqtKU includehiddenquhXinstallation/indexqvUcaptionqwNUglobqxh!]h ]U titlesonlyqyh]h]h#]Uentriesqz]q{(NXinstallation/packagesq|q}NX installation/install_from_sourceq~qNXinstallation/build_from_repoqqeUhiddenqU includefilesq]q(h|h~heUmaxdepthqKuh%Kh]ubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceq‰UenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqƉU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqԈU generatorqNUdump_internalsqNU smart_quotesq׉U pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformq߉Ustrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/installation/build_from_repo.doctree0000664000175000017500000003153413035122643021751 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xcreating the build environmentqNXobtaining the sourceqNX prequisitesqNX%where to find the rsyslog source codeq Xrsyslog install guideq X-installing rsyslog from the source repositoryq NuUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUcreating-the-build-environmentqhUobtaining-the-sourceqhU prequisitesqh U%where-to-find-the-rsyslog-source-codeqh Ursyslog-install-guideqh U-installing-rsyslog-from-the-source-repositoryquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceq UUparentq!hUsourceq"XC/home/rger/proj/rsyslog-doc/source/installation/build_from_repo.rstq#Utagnameq$Usectionq%U attributesq&}q'(Udupnamesq(]Uclassesq)]Ubackrefsq*]Uidsq+]q,haUnamesq-]q.h auUlineq/KUdocumentq0hh]q1(cdocutils.nodes title q2)q3}q4(h X-Installing rsyslog from the source repositoryq5h!hh"h#h$Utitleq6h&}q7(h(]h)]h*]h+]h-]uh/Kh0hh]q8cdocutils.nodes Text q9X-Installing rsyslog from the source repositoryq:q;}q<(h h5h!h3ubaubcdocutils.nodes paragraph q=)q>}q?(h XIn most cases, people install rsyslog either via a package or use an "official" distribution tarball to generate it. But there may be situations where it is desirable to build directly from the source repository. This is useful for people who would like to participate in development or who would like to use the latest, not-yet-released code. The later may especially be the case if you are asked to try out an experimental version.q@h!hh"h#h$U paragraphqAh&}qB(h(]h)]h*]h+]h-]uh/Kh0hh]qCh9XIn most cases, people install rsyslog either via a package or use an "official" distribution tarball to generate it. But there may be situations where it is desirable to build directly from the source repository. This is useful for people who would like to participate in development or who would like to use the latest, not-yet-released code. The later may especially be the case if you are asked to try out an experimental version.qDqE}qF(h h@h!h>ubaubh=)qG}qH(h XBuilding from the repsitory is not much different than building from the source tarball, but some files are missing because they are output files and thus do not belong into the repository.qIh!hh"h#h$hAh&}qJ(h(]h)]h*]h+]h-]uh/K h0hh]qKh9XBuilding from the repsitory is not much different than building from the source tarball, but some files are missing because they are output files and thus do not belong into the repository.qLqM}qN(h hIh!hGubaubh)qO}qP(h Uh!hh"h#h$h%h&}qQ(h(]h)]h*]h+]qRhah-]qShauh/Kh0hh]qT(h2)qU}qV(h XObtaining the SourceqWh!hOh"h#h$h6h&}qX(h(]h)]h*]h+]h-]uh/Kh0hh]qYh9XObtaining the SourceqZq[}q\(h hWh!hUubaubh=)q]}q^(h XFirst of all, you need to download the sources. Rsyslog is kept in git. The "`Where to find the rsyslog source code `_\ " page on the project site will point you to the current repository location.h!hOh"h#h$hAh&}q_(h(]h)]h*]h+]h-]uh/Kh0hh]q`(h9XMFirst of all, you need to download the sources. Rsyslog is kept in git. The "qaqb}qc(h XMFirst of all, you need to download the sources. Rsyslog is kept in git. The "h!h]ubcdocutils.nodes reference qd)qe}qf(h Xh`Where to find the rsyslog source code `_h&}qg(UnameX%Where to find the rsyslog source codeUrefuriqhX=http://www.rsyslog.com/where-to-find-the-rsyslog-source-code/qih+]h*]h(]h)]h-]uh!h]h]qjh9X%Where to find the rsyslog source codeqkql}qm(h Uh!heubah$U referenceqnubcdocutils.nodes target qo)qp}qq(h X@ U referencedqrKh!h]h$Utargetqsh&}qt(Urefurihih+]quhah*]h(]h)]h-]qvh auh]ubh9XM" page on the project site will point you to the current repository location.qwqx}qy(h XO\ " page on the project site will point you to the current repository location.h!h]ubeubh=)qz}q{(h X:After you have cloned the repository, you are in the master branch by default. This is where we keep the devel branch. If you need any other branch, you need to do a "git checkout --track -b branch origin/branch". For example, the command to check out the beta branch is "git checkout --track -b beta origin/beta".q|h!hOh"h#h$hAh&}q}(h(]h)]h*]h+]h-]uh/Kh0hh]q~h9X:After you have cloned the repository, you are in the master branch by default. This is where we keep the devel branch. If you need any other branch, you need to do a "git checkout --track -b branch origin/branch". For example, the command to check out the beta branch is "git checkout --track -b beta origin/beta".qq}q(h h|h!hzubaubeubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qhauh/K h0hh]q(h2)q}q(h X Prequisitesqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/K h0hh]qh9X Prequisitesqq}q(h hh!hubaubh=)q}q(h X)To build the compilation system, you needqh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K"h0hh]qh9X)To build the compilation system, you needqq}q(h hh!hubaubcdocutils.nodes bullet_list q)q}q(h Uh!hh"h#h$U bullet_listqh&}q(UbulletqX*h+]h*]h(]h)]h-]uh/K$h0hh]q(cdocutils.nodes list_item q)q}q(h X'GNU autotools (autoconf, automake, ...)qh!hh"h#h$U list_itemqh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qh=)q}q(h hh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K$h]qh9X'GNU autotools (autoconf, automake, ...)qq}q(h hh!hubaubaubh)q}q(h Xlibtoolqh!hh"h#h$hh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qh=)q}q(h hh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K%h]qh9Xlibtoolqq}q(h hh!hubaubaubh)q}q(h X pkg-config h!hh"h#h$hh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qh=)q}q(h X pkg-configqh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K&h]qh9X pkg-configq…q}q(h hh!hubaubaubeubh=)q}q(h XUnfortunately, the actual package names vary between distributions. Doing a search for the names above inside the packaging system should lead to the right path, though.qh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K(h0hh]qh9XUnfortunately, the actual package names vary between distributions. Doing a search for the names above inside the packaging system should lead to the right path, though.qʅq}q(h hh!hubaubh=)q}q(h XFIf some of these tools are missing, you will see errors like this one:qh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K,h0hh]qh9XFIf some of these tools are missing, you will see errors like this one:q҅q}q(h hh!hubaubcdocutils.nodes literal_block q)q}q(h Xchecking for SYSLOG_UNIXAF support... yes checking for FSSTND support... yes ./configure: line 25895: syntax error near unexpected token `RELP,' ./configure: line 25895: ` PKG_CHECK_MODULES(RELP, relp >= 0.1.1)'h!hh"h#h$U literal_blockqh&}q(U xml:spaceqUpreserveqh+]h*]h(]h)]h-]uh/K0h0hh]qh9Xchecking for SYSLOG_UNIXAF support... yes checking for FSSTND support... yes ./configure: line 25895: syntax error near unexpected token `RELP,' ./configure: line 25895: ` PKG_CHECK_MODULES(RELP, relp >= 0.1.1)'q݅q}q(h Uh!hubaubh=)q}q(h XSThe actual error message will vary. In the case shown here, pkg-config was missing.qh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K5h0hh]qh9XSThe actual error message will vary. In the case shown here, pkg-config was missing.q允q}q(h hh!hubaubh=)q}q(h XY**Important:** the build dependencies must be present **before** creating the build environment is begun. Otherwise, some hard to interpret errors may occur. For example, the error above will also occur if you install pkg-config, but *after* you have run *autoreconf*. So be sure everything is in place *before* you create the build environment.h!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/K8h0hh]q(cdocutils.nodes strong q)q}q(h X**Important:**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X Important:qq}q(h Uh!hubah$Ustrongqubh9X( the build dependencies must be present qq}q(h X( the build dependencies must be present h!hubh)q}q(h X **before**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9Xbeforeqq}q(h Uh!hubah$hubh9X creating the build environment is begun. Otherwise, some hard to interpret errors may occur. For example, the error above will also occur if you install pkg-config, but qr}r(h X creating the build environment is begun. Otherwise, some hard to interpret errors may occur. For example, the error above will also occur if you install pkg-config, but h!hubcdocutils.nodes emphasis r)r}r(h X*after*h&}r(h(]h)]h*]h+]h-]uh!hh]rh9Xafterrr}r (h Uh!jubah$Uemphasisr ubh9X you have run r r }r (h X you have run h!hubj)r}r(h X *autoreconf*h&}r(h(]h)]h*]h+]h-]uh!hh]rh9X autoreconfrr}r(h Uh!jubah$j ubh9X$. So be sure everything is in place rr}r(h X$. So be sure everything is in place h!hubj)r}r(h X*before*h&}r(h(]h)]h*]h+]h-]uh!hh]rh9Xbeforerr}r(h Uh!jubah$j ubh9X" you create the build environment.rr }r!(h X" you create the build environment.h!hubeubeubh)r"}r#(h Uh!hh"h#h$h%h&}r$(h(]h)]h*]h+]r%hah-]r&hauh/K?h0hh]r'(h2)r(}r)(h XCreating the Build Environmentr*h!j"h"h#h$h6h&}r+(h(]h)]h*]h+]h-]uh/K?h0hh]r,h9XCreating the Build Environmentr-r.}r/(h j*h!j(ubaubh=)r0}r1(h XAThis is fairly easy: just issue "**autoreconf -fvi**\ ", which should do everything you need. Once this is done, you can follow the usual ./configure steps just like when you downloaded an official distribution tarball (see the `rsyslog install guide `_, starting at step 2, for further details about that).h!j"h"h#h$hAh&}r2(h(]h)]h*]h+]h-]uh/KAh0hh]r3(h9X!This is fairly easy: just issue "r4r5}r6(h X!This is fairly easy: just issue "h!j0ubh)r7}r8(h X**autoreconf -fvi**h&}r9(h(]h)]h*]h+]h-]uh!j0h]r:h9Xautoreconf -fvir;r<}r=(h Uh!j7ubah$hubh9X", which should do everything you need. Once this is done, you can follow the usual ./configure steps just like when you downloaded an official distribution tarball (see the r>r?}r@(h X\ ", which should do everything you need. Once this is done, you can follow the usual ./configure steps just like when you downloaded an official distribution tarball (see the h!j0ubhd)rA}rB(h X'`rsyslog install guide `_h&}rC(UnameXrsyslog install guidehhX install.htmlrDh+]h*]h(]h)]h-]uh!j0h]rEh9Xrsyslog install guiderFrG}rH(h Uh!jAubah$hnubho)rI}rJ(h X hrKh!j0h$hsh&}rK(UrefurijDh+]rLhah*]h(]h)]h-]rMh auh]ubh9X6, starting at step 2, for further details about that).rNrO}rP(h X6, starting at step 2, for further details about that).h!j0ubeubeubeubah UU transformerrQNU footnote_refsrR}rSUrefnamesrT}rUUsymbol_footnotesrV]rWUautofootnote_refsrX]rYUsymbol_footnote_refsrZ]r[U citationsr\]r]h0hU current_liner^NUtransform_messagesr_]r`UreporterraNUid_startrbKU autofootnotesrc]rdU citation_refsre}rfUindirect_targetsrg]rhUsettingsri(cdocutils.frontend Values rjork}rl(Ufootnote_backlinksrmKUrecord_dependenciesrnNU rfc_base_urlroUhttps://tools.ietf.org/html/rpU tracebackrqUpep_referencesrrNUstrip_commentsrsNU toc_backlinksrtUentryruU language_codervUenrwU datestamprxNU report_levelryKU _destinationrzNU halt_levelr{KU strip_classesr|Nh6NUerror_encoding_error_handlerr}Ubackslashreplacer~UdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hjIhhhhphj"hhhhOuUsubstitution_namesr}rh$h0h&}r(h(]h+]h*]Usourceh#h)]h-]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/0000775000175000017500000000000013035122643015373 5ustar rgerrgerbuild/.doctrees/configuration/dyn_stats.doctree0000664000175000017500000005576513035122641020772 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X dynamic statsqNXfieldsqNX reportingqNX&dyn_stats(name=""...) (object)q NXdyn-stats configurationq NX&dyn_inc("", ) (function)q NuUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU dynamic-statsqhUfieldsqhU reportingqh Udyn-stats-name-bucket-objectqh Udyn-stats-configurationqh Udyn-inc-bucket-expr-functionquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceq UUparentq!hUsourceq"X>/home/rger/proj/rsyslog-doc/source/configuration/dyn_stats.rstq#Utagnameq$Usectionq%U attributesq&}q'(Udupnamesq(]Uclassesq)]Ubackrefsq*]Uidsq+]q,haUnamesq-]q.hauUlineq/KUdocumentq0hh]q1(cdocutils.nodes title q2)q3}q4(h X Dynamic Statsq5h!hh"h#h$Utitleq6h&}q7(h(]h)]h*]h+]h-]uh/Kh0hh]q8cdocutils.nodes Text q9X Dynamic Statsq:q;}q<(h h5h!h3ubaubcdocutils.nodes paragraph q=)q>}q?(h XRsyslog produces runtime-stats to allow user to study service health, performance, bottlenecks etc. Runtime-stats counters that Rsyslog components publish are statically defined.q@h!hh"h#h$U paragraphqAh&}qB(h(]h)]h*]h+]h-]uh/Kh0hh]qCh9XRsyslog produces runtime-stats to allow user to study service health, performance, bottlenecks etc. Runtime-stats counters that Rsyslog components publish are statically defined.qDqE}qF(h h@h!h>ubaubh=)qG}qH(h X**Dynamic Stats** (called dyn-stats henceforth) component allows user to configure stats-namespaces (called stats-buckets) and increment counters within these buckets using Rainerscript function call.qIh!hh"h#h$hAh&}qJ(h(]h)]h*]h+]h-]uh/Kh0hh]qK(cdocutils.nodes strong qL)qM}qN(h X**Dynamic Stats**h&}qO(h(]h)]h*]h+]h-]uh!hGh]qPh9X Dynamic StatsqQqR}qS(h Uh!hMubah$UstrongqTubh9X (called dyn-stats henceforth) component allows user to configure stats-namespaces (called stats-buckets) and increment counters within these buckets using Rainerscript function call.qUqV}qW(h X (called dyn-stats henceforth) component allows user to configure stats-namespaces (called stats-buckets) and increment counters within these buckets using Rainerscript function call.h!hGubeubh=)qX}qY(h XbThe metric-name in this case can be a message-property or a sub-string extracted from message etc.qZh!hh"h#h$hAh&}q[(h(]h)]h*]h+]h-]uh/Kh0hh]q\h9XbThe metric-name in this case can be a message-property or a sub-string extracted from message etc.q]q^}q_(h hZh!hXubaubh)q`}qa(h Uh!hh"h#h$h%h&}qb(h(]h)]h*]h+]qchah-]qdh auh/K h0hh]qe(h2)qf}qg(h XDyn-stats configurationqhh!h`h"h#h$h6h&}qi(h(]h)]h*]h+]h-]uh/K h0hh]qjh9XDyn-stats configurationqkql}qm(h hhh!hfubaubh=)qn}qo(h X6Dyn-stats configuration involves a **two part setup**.qph!h`h"h#h$hAh&}qq(h(]h)]h*]h+]h-]uh/K h0hh]qr(h9X#Dyn-stats configuration involves a qsqt}qu(h X#Dyn-stats configuration involves a h!hnubhL)qv}qw(h X**two part setup**h&}qx(h(]h)]h*]h+]h-]uh!hnh]qyh9Xtwo part setupqzq{}q|(h Uh!hvubah$hTubh9X.q}}q~(h X.h!hnubeubh)q}q(h Uh!h`h"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qh auh/Kh0hh]q(h2)q}q(h X&dyn_stats(name=""...) (object)qh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9X&dyn_stats(name=""...) (object)qq}q(h hh!hubaubh=)q}q(h X**Defines** the bucket(identified by the bucket-name) and allows user to set some properties that control behavior of the bucket.qh!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/Kh0hh]q(hL)q}q(h X **Defines**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9XDefinesqq}q(h Uh!hubah$hTubh9Xv the bucket(identified by the bucket-name) and allows user to set some properties that control behavior of the bucket.qq}q(h Xv the bucket(identified by the bucket-name) and allows user to set some properties that control behavior of the bucket.h!hubeubcdocutils.nodes literal_block q)q}q(h Xdyn_stats(name="msg_per_host")h!hh"h#h$U literal_blockqh&}q(U xml:spaceqUpreserveqh+]h*]h(]h)]h-]uh/Kh0hh]qh9Xdyn_stats(name="msg_per_host")qq}q(h Uh!hubaubcdocutils.nodes definition_list q)q}q(h Uh!hh"h#h$Udefinition_listqh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qcdocutils.nodes definition_list_item q)q}q(h X Parameters: **name** : Name of the bucket. **resettable** : Whether or not counters should be reset every time they are reported. This works independent of ``resetCounters`` config parameter in :doc:`modules/impstats`. **maxCardinality** : Maximum number of unique counter-names to track. **unusedMetricLife** : Interval between full purges (in seconds). This prevents unused counters from occupying resources forever. h!hh"h#h$Udefinition_list_itemqh&}q(h(]h)]h*]h+]h-]uh/K h]q(cdocutils.nodes term q)q}q(h X Parameters:qh!hh"h#h$Utermqh&}q(h(]h)]h*]h+]h-]uh/K h]qh9X Parameters:qq}q(h hh!hubaubcdocutils.nodes definition q)q}q(h Uh&}q(h(]h)]h*]h+]h-]uh!hh]q(h=)q}q(h X;**name** : Name of the bucket.h!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/Kh]q(hL)q}q(h X**name**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9Xnameqʅq}q(h Uh!hubah$hTubh9X3 : Name of the bucket.qͅq}q(h X3 : Name of the bucket.h!hubeubh=)q}q(h X**resettable** : Whether or not counters should be reset every time they are reported. This works independent of ``resetCounters`` config parameter in :doc:`modules/impstats`.h!hh"h#h$hAh&}q(h(]h)]h*]h+]h-]uh/Kh]q(hL)q}q(h X**resettable**h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X resettableq؅q}q(h Uh!hubah$hTubh9Xy : Whether or not counters should be reset every time they are reported. This works independent of qۅq}q(h Xy : Whether or not counters should be reset every time they are reported. This works independent of h!hubcdocutils.nodes literal q)q}q(h X``resetCounters``h&}q(h(]h)]h*]h+]h-]uh!hh]qh9X resetCountersqㅁq}q(h Uh!hubah$Uliteralqubh9X config parameter in q煁q}q(h X config parameter in h!hubcsphinx.addnodes pending_xref q)q}q(h X:doc:`modules/impstats`qh!hh"h#h$U pending_xrefqh&}q(UreftypeXdocqUrefwarnqU reftargetqXmodules/impstatsU refdomainUh+]h*]U refexplicith(]h)]h-]UrefdocqXconfiguration/dyn_statsquh/Kh]qh)q}q(h hh&}q(h(]h)]q(Uxrefqheh*]h+]h-]uh!hh]qh9Xmodules/impstatsqq}q(h Uh!hubah$hubaubh9X.q}r(h X.h!hubeubh=)r}r(h X]**maxCardinality** : Maximum number of unique counter-names to track.h!hh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/Kh]r(hL)r}r(h X**maxCardinality**h&}r(h(]h)]h*]h+]h-]uh!jh]rh9XmaxCardinalityr r }r (h Uh!jubah$hTubh9XK : Maximum number of unique counter-names to track.r r }r(h XK : Maximum number of unique counter-names to track.h!jubeubh=)r}r(h X**unusedMetricLife** : Interval between full purges (in seconds). This prevents unused counters from occupying resources forever.h!hh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/Kh]r(hL)r}r(h X**unusedMetricLife**h&}r(h(]h)]h*]h+]h-]uh!jh]rh9XunusedMetricLiferr}r(h Uh!jubah$hTubh9X : Interval between full purges (in seconds). This prevents unused counters from occupying resources forever.rr}r(h X : Interval between full purges (in seconds). This prevents unused counters from occupying resources forever.h!jubeubeh$U definitionrubeubaubh=)r}r(h X3A definition setting all the parameters looks like:r h!hh"h#h$hAh&}r!(h(]h)]h*]h+]h-]uh/K"h0hh]r"h9X3A definition setting all the parameters looks like:r#r$}r%(h j h!jubaubh)r&}r'(h X[dyn_stats(name="msg_per_host" resettable="on" maxCardinality="3000" unusedMetricLife="600")h!hh"h#h$hh&}r((hhh+]h*]h(]h)]h-]uh/K&h0hh]r)h9X[dyn_stats(name="msg_per_host" resettable="on" maxCardinality="3000" unusedMetricLife="600")r*r+}r,(h Uh!j&ubaubeubh)r-}r.(h Uh!h`h"h#h$h%h&}r/(h(]h)]h*]h+]r0hah-]r1h auh/K*h0hh]r2(h2)r3}r4(h X&dyn_inc("", ) (function)r5h!j-h"h#h$h6h&}r6(h(]h)]h*]h+]h-]uh/K*h0hh]r7h9X&dyn_inc("", ) (function)r8r9}r:(h j5h!j3ubaubh=)r;}r<(h XT**Increments** counter identified by value of variable in bucket identified by name.r=h!j-h"h#h$hAh&}r>(h(]h)]h*]h+]h-]uh/K,h0hh]r?(hL)r@}rA(h X**Increments**h&}rB(h(]h)]h*]h+]h-]uh!j;h]rCh9X IncrementsrDrE}rF(h Uh!j@ubah$hTubh9XF counter identified by value of variable in bucket identified by name.rGrH}rI(h XF counter identified by value of variable in bucket identified by name.h!j;ubeubh)rJ}rK(h Uh!j-h"h#h$hh&}rL(h(]h)]h*]h+]h-]uh/Nh0hh]rMh)rN}rO(h XParameters: **name** : Name of the bucket **expr** : Name of counter (this name will be reported by impstats to identify the counter) h!jJh"h#h$hh&}rP(h(]h)]h*]h+]h-]uh/K1h]rQ(h)rR}rS(h X Parameters:rTh!jNh"h#h$hh&}rU(h(]h)]h*]h+]h-]uh/K1h]rVh9X Parameters:rWrX}rY(h jTh!jRubaubh)rZ}r[(h Uh&}r\(h(]h)]h*]h+]h-]uh!jNh]r](h=)r^}r_(h X:**name** : Name of the bucketh!jZh"h#h$hAh&}r`(h(]h)]h*]h+]h-]uh/K/h]ra(hL)rb}rc(h X**name**h&}rd(h(]h)]h*]h+]h-]uh!j^h]reh9Xnamerfrg}rh(h Uh!jbubah$hTubh9X2 : Name of the bucketrirj}rk(h X2 : Name of the bucketh!j^ubeubh=)rl}rm(h X~**expr** : Name of counter (this name will be reported by impstats to identify the counter)h!jZh"h#h$hAh&}rn(h(]h)]h*]h+]h-]uh/K1h]ro(hL)rp}rq(h X**expr**h&}rr(h(]h)]h*]h+]h-]uh!jlh]rsh9Xexprrtru}rv(h Uh!jpubah$hTubh9Xv : Name of counter (this name will be reported by impstats to identify the counter)rwrx}ry(h Xv : Name of counter (this name will be reported by impstats to identify the counter)h!jlubeubeh$jubeubaubh=)rz}r{(h XA ``dyn_inc`` call looks like:r|h!j-h"h#h$hAh&}r}(h(]h)]h*]h+]h-]uh/K3h0hh]r~(h9XA rr}r(h XA h!jzubh)r}r(h X ``dyn_inc``h&}r(h(]h)]h*]h+]h-]uh!jzh]rh9Xdyn_incrr}r(h Uh!jubah$hubh9X call looks like:rr}r(h X call looks like:h!jzubeubh)r}r(h XRset $.inc = dyn_inc("msg_per_host", $hostname); if ($.inc != 0) then { .... }h!j-h"h#h$hh&}r(hhh+]h*]h(]h)]h-]uh/K7h0hh]rh9XRset $.inc = dyn_inc("msg_per_host", $hostname); if ($.inc != 0) then { .... }rr}r(h Uh!jubaubh=)r}r(h X``$.inc`` captures the error-code. It has value ``0`` when increment operation is successful and non-zero when it fails. It uses Rsyslog error-codes.rh!j-h"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/K=h0hh]r(h)r}r(h X ``$.inc``h&}r(h(]h)]h*]h+]h-]uh!jh]rh9X$.incrr}r(h Uh!jubah$hubh9X' captures the error-code. It has value rr}r(h X' captures the error-code. It has value h!jubh)r}r(h X``0``h&}r(h(]h)]h*]h+]h-]uh!jh]rh9X0r}r(h Uh!jubah$hubh9X` when increment operation is successful and non-zero when it fails. It uses Rsyslog error-codes.rr}r(h X` when increment operation is successful and non-zero when it fails. It uses Rsyslog error-codes.h!jubeubeubeubh)r}r(h Uh!hh"h#h$h%h&}r(h(]h)]h*]h+]rhah-]rhauh/K@h0hh]r(h2)r}r(h X Reportingrh!jh"h#h$h6h&}r(h(]h)]h*]h+]h-]uh/K@h0hh]rh9X Reportingrr}r(h jh!jubaubh=)r}r(h XLegacy format:rh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/KBh0hh]rh9XLegacy format:rr}r(h jh!jubaubh)r}r(h X... global: origin=dynstats msg_per_host.ops_overflow=1 msg_per_host.new_metric_add=3 msg_per_host.no_metric=0 msg_per_host.metrics_purged=0 msg_per_host.ops_ignored=0 ... msg_per_host: origin=dynstats.bucket foo=2 bar=1 baz=1 ...h!jh"h#h$hh&}r(hhh+]h*]h(]h)]h-]uh/KFh0hh]rh9X... global: origin=dynstats msg_per_host.ops_overflow=1 msg_per_host.new_metric_add=3 msg_per_host.no_metric=0 msg_per_host.metrics_purged=0 msg_per_host.ops_ignored=0 ... msg_per_host: origin=dynstats.bucket foo=2 bar=1 baz=1 ...rr}r(h Uh!jubaubh=)r}r(h X~Json(variants with the same structure are used in other Json based formats such as ``cee`` and ``json-elasticsearch``) format:rh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/KLh0hh]r(h9XSJson(variants with the same structure are used in other Json based formats such as rr}r(h XSJson(variants with the same structure are used in other Json based formats such as h!jubh)r}r(h X``cee``h&}r(h(]h)]h*]h+]h-]uh!jh]rh9Xceerr}r(h Uh!jubah$hubh9X and rr}r(h X and h!jubh)r}r(h X``json-elasticsearch``h&}r(h(]h)]h*]h+]h-]uh!jh]rh9Xjson-elasticsearchrr}r(h Uh!jubah$hubh9X ) format:rr}r(h X ) format:h!jubeubh)r}r(h XH... { "name": "global", "origin": "dynstats", "values": { "msg_per_host.ops_overflow": 1, "msg_per_host.new_metric_add": 3, "msg_per_host.no_metric": 0, "msg_per_host.metrics_purged": 0, "msg_per_host.ops_ignored": 0 } } ... { "name": "msg_per_host", "origin": "dynstats.bucket", "values": { "foo": 2, "bar": 1, "baz": 1 } } ...h!jh"h#h$hh&}r(hhh+]h*]h(]h)]h-]uh/KPh0hh]rh9XH... { "name": "global", "origin": "dynstats", "values": { "msg_per_host.ops_overflow": 1, "msg_per_host.new_metric_add": 3, "msg_per_host.no_metric": 0, "msg_per_host.metrics_purged": 0, "msg_per_host.ops_ignored": 0 } } ... { "name": "msg_per_host", "origin": "dynstats.bucket", "values": { "foo": 2, "bar": 1, "baz": 1 } } ...rr}r(h Uh!jubaubh=)r}r(h X]In this case counters are encapsulated inside an object hanging off top-level-key ``values``.rh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/KVh0hh]r(h9XRIn this case counters are encapsulated inside an object hanging off top-level-key rr}r(h XRIn this case counters are encapsulated inside an object hanging off top-level-key h!jubh)r}r(h X ``values``h&}r(h(]h)]h*]h+]h-]uh!jh]rh9Xvaluesrr}r(h Uh!jubah$hubh9X.r}r(h X.h!jubeubh)r}r(h Uh!jh"h#h$h%h&}r(h(]h)]h*]h+]rhah-]rhauh/KYh0hh]r(h2)r}r(h XFieldsrh!jh"h#h$h6h&}r(h(]h)]h*]h+]h-]uh/KYh0hh]rh9XFieldsrr}r (h jh!jubaubh)r }r (h Uh!jh"h#h$hh&}r (h(]h)]h*]h+]h-]uh/Nh0hh]r (h)r}r(h X**global: origin=dynstats**: **ops_overflow**: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality. **new_metric_add**: Number of "new" metrics added (new counters created). **no_metric**: Counter-name given was invalid (length = 0). **metrics_purged**: Number of counters discarded at discard-cycle (controlled by **unusedMetricLife**). **ops_ignored**: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can't get access to counter without delay(lock acquiring latency). **purge_triggered**: Indicates that a discard was performed (1 implies a discard-cycle run). h!j h"h#h$hh&}r(h(]h)]h*]h+]h-]uh/Kfh]r(h)r}r(h X**global: origin=dynstats**:rh!jh"h#h$hh&}r(h(]h)]h*]h+]h-]uh/Kfh]r(hL)r}r(h X**global: origin=dynstats**h&}r(h(]h)]h*]h+]h-]uh!jh]rh9Xglobal: origin=dynstatsrr}r(h Uh!jubah$hTubh9X:r}r(h X:h!jubeubh)r }r!(h Uh&}r"(h(]h)]h*]h+]h-]uh!jh]r#(h=)r$}r%(h Xu**ops_overflow**: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality.h!j h"h#h$hAh&}r&(h(]h)]h*]h+]h-]uh/K\h]r'(hL)r(}r)(h X**ops_overflow**h&}r*(h(]h)]h*]h+]h-]uh!j$h]r+h9X ops_overflowr,r-}r.(h Uh!j(ubah$hTubh9Xe: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality.r/r0}r1(h Xe: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality.h!j$ubeubh=)r2}r3(h XI**new_metric_add**: Number of "new" metrics added (new counters created).h!j h"h#h$hAh&}r4(h(]h)]h*]h+]h-]uh/K^h]r5(hL)r6}r7(h X**new_metric_add**h&}r8(h(]h)]h*]h+]h-]uh!j2h]r9h9Xnew_metric_addr:r;}r<(h Uh!j6ubah$hTubh9X7: Number of "new" metrics added (new counters created).r=r>}r?(h X7: Number of "new" metrics added (new counters created).h!j2ubeubh=)r@}rA(h X;**no_metric**: Counter-name given was invalid (length = 0).h!j h"h#h$hAh&}rB(h(]h)]h*]h+]h-]uh/K`h]rC(hL)rD}rE(h X **no_metric**h&}rF(h(]h)]h*]h+]h-]uh!j@h]rGh9X no_metricrHrI}rJ(h Uh!jDubah$hTubh9X.: Counter-name given was invalid (length = 0).rKrL}rM(h X.: Counter-name given was invalid (length = 0).h!j@ubeubh=)rN}rO(h Xg**metrics_purged**: Number of counters discarded at discard-cycle (controlled by **unusedMetricLife**).h!j h"h#h$hAh&}rP(h(]h)]h*]h+]h-]uh/Kbh]rQ(hL)rR}rS(h X**metrics_purged**h&}rT(h(]h)]h*]h+]h-]uh!jNh]rUh9Xmetrics_purgedrVrW}rX(h Uh!jRubah$hTubh9X?: Number of counters discarded at discard-cycle (controlled by rYrZ}r[(h X?: Number of counters discarded at discard-cycle (controlled by h!jNubhL)r\}r](h X**unusedMetricLife**h&}r^(h(]h)]h*]h+]h-]uh!jNh]r_h9XunusedMetricLifer`ra}rb(h Uh!j\ubah$hTubh9X).rcrd}re(h X).h!jNubeubh=)rf}rg(h X**ops_ignored**: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can't get access to counter without delay(lock acquiring latency).h!j h"h#h$hAh&}rh(h(]h)]h*]h+]h-]uh/Kdh]ri(hL)rj}rk(h X**ops_ignored**h&}rl(h(]h)]h*]h+]h-]uh!jfh]rmh9X ops_ignoredrnro}rp(h Uh!jjubah$hTubh9X: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can't get access to counter without delay(lock acquiring latency).rqrr}rs(h X: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can't get access to counter without delay(lock acquiring latency).h!jfubeubh=)rt}ru(h X\**purge_triggered**: Indicates that a discard was performed (1 implies a discard-cycle run).h!j h"h#h$hAh&}rv(h(]h)]h*]h+]h-]uh/Kfh]rw(hL)rx}ry(h X**purge_triggered**h&}rz(h(]h)]h*]h+]h-]uh!jth]r{h9Xpurge_triggeredr|r}}r~(h Uh!jxubah$hTubh9XI: Indicates that a discard was performed (1 implies a discard-cycle run).rr}r(h XI: Indicates that a discard was performed (1 implies a discard-cycle run).h!jtubeubeh$jubeubh)r}r(h Xk**msg_per_host: origin=dynstats.bucket**: ****: Value of counter identified by . h!j h"h#h$hh&}r(h(]h)]h*]h+]h-]uh/Kih0hh]r(h)r}r(h X)**msg_per_host: origin=dynstats.bucket**:rh!jh"h#h$hh&}r(h(]h)]h*]h+]h-]uh/Kih]r(hL)r}r(h X(**msg_per_host: origin=dynstats.bucket**h&}r(h(]h)]h*]h+]h-]uh!jh]rh9X$msg_per_host: origin=dynstats.bucketrr}r(h Uh!jubah$hTubh9X:r}r(h X:h!jubeubh)r}r(h Uh&}r(h(]h)]h*]h+]h-]uh!jh]rh=)r}r(h X@****: Value of counter identified by .rh!jh"h#h$hAh&}r(h(]h)]h*]h+]h-]uh/Kih]r(hL)r}r(h X****h&}r(h(]h)]h*]h+]h-]uh!jh]rh9X rr}r(h Uh!jubah$hTubh9X/: Value of counter identified by .rr}r(h X/: Value of counter identified by .h!jubeubah$jubeubeubeubeubeubah UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh0hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh6NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hh`hhhjhjhj-hhuUsubstitution_namesr }r h$h0h&}r (h(]h+]h*]Usourceh#h)]h-]uU footnotesr ]r Urefidsr}rub.build/.doctrees/configuration/input.doctree0000664000175000017500000002547713035122641020116 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqX cfgobj_inputqXadisconqXgeneral input parametersq NXrsyslogq Xinputq NuUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhU cfgobj-inputqhUadisconqh Ugeneral-input-parametersqh Ursyslogqh UinputquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceq UUparentq!hUsourceq"X:/home/rger/proj/rsyslog-doc/source/configuration/input.rstq#Utagnameq$Usectionq%U attributesq&}q'(Udupnamesq(]Uclassesq)]Ubackrefsq*]Uidsq+]q,haUnamesq-]q.h auUlineq/KUdocumentq0hh]q1(cdocutils.nodes title q2)q3}q4(h XInputq5h!hh"h#h$Utitleq6h&}q7(h(]h)]h*]h+]h-]uh/Kh0hh]q8cdocutils.nodes Text q9XInputq:q;}q<(h h5h!h3ubaubcsphinx.addnodes index q=)q>}q?(h Uh!hh"h#h$Uindexq@h&}qA(h+]h*]h(]h)]h-]UentriesqB]qC(UsingleqDXinputUindex-0qEUmainqFtqGaUinlineqHuh/Kh0hh]ubcdocutils.nodes target qI)qJ}qK(h Uh!hh"h#h$UtargetqLh&}qM(h+]h*]h(]h)]h-]UrefidqNhEuh/Kh0hh]ubhI)qO}qP(h X.. _cfgobj_input:h!hh"h#Uexpect_referenced_by_nameqQ}h$hLh&}qR(h+]h*]h(]h)]h-]hNhuh/Kh0hUexpect_referenced_by_idqS}qThEhJsh]ubcdocutils.nodes paragraph qU)qV}qW(h XThe ``input`` object, as its name suggests, describes message input sources. Without input, no processing happens at all, because no messages enter the rsyslog system. Inputs are implemented via :doc:`input modules `.h!hh"h#hQ}qXhhOsh$U paragraphqYh&}qZ(h(]h)]h*]h+]q[(hhEeh-]q\hauh/Kh0hhS}q](hEhJhhOuh]q^(h9XThe q_q`}qa(h XThe h!hVubcdocutils.nodes literal qb)qc}qd(h X ``input``h&}qe(h(]h)]h*]h+]h-]uh!hVh]qfh9Xinputqgqh}qi(h Uh!hcubah$Uliteralqjubh9X object, as its name suggests, describes message input sources. Without input, no processing happens at all, because no messages enter the rsyslog system. Inputs are implemented via qkql}qm(h X object, as its name suggests, describes message input sources. Without input, no processing happens at all, because no messages enter the rsyslog system. Inputs are implemented via h!hVubcsphinx.addnodes pending_xref qn)qo}qp(h X(:doc:`input modules `qqh!hVh"h#h$U pending_xrefqrh&}qs(UreftypeXdocqtUrefwarnquU reftargetqvXmodules/idx_inputU refdomainUh+]h*]U refexplicith(]h)]h-]UrefdocqwXconfiguration/inputqxuh/Kh]qyhb)qz}q{(h hqh&}q|(h(]h)]q}(Uxrefq~hteh*]h+]h-]uh!hoh]qh9X input modulesqq}q(h Uh!hzubah$hjubaubh9X.q}q(h X.h!hVubeubhU)q}q(h X*The input object has different parameters:qh!hh"h#h$hYh&}q(h(]h)]h*]h+]h-]uh/K h0hh]qh9X*The input object has different parameters:qq}q(h hh!hubaubcdocutils.nodes bullet_list q)q}q(h Uh!hh"h#h$U bullet_listqh&}q(UbulletqX-h+]h*]h(]h)]h-]uh/Kh0hh]q(cdocutils.nodes list_item q)q}q(h Xethose that apply to all input and are generally available for all inputs. These are documented below.h!hh"h#h$U list_itemqh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qhU)q}q(h Xethose that apply to all input and are generally available for all inputs. These are documented below.qh!hh"h#h$hYh&}q(h(]h)]h*]h+]h-]uh/Kh]qh9Xethose that apply to all input and are generally available for all inputs. These are documented below.qq}q(h hh!hubaubaubh)q}q(h Xinput-specific parameters. These are specific to a certain type of input. They are documented by the :doc:`input module ` in question. h!hh"h#h$hh&}q(h(]h)]h*]h+]h-]uh/Nh0hh]qhU)q}q(h Xinput-specific parameters. These are specific to a certain type of input. They are documented by the :doc:`input module ` in question.h!hh"h#h$hYh&}q(h(]h)]h*]h+]h-]uh/Kh]q(h9Xeinput-specific parameters. These are specific to a certain type of input. They are documented by the qq}q(h Xeinput-specific parameters. These are specific to a certain type of input. They are documented by the h!hubhn)q}q(h X':doc:`input module `qh!hh"h#h$hrh&}q(UreftypeXdocqhuhvXmodules/idx_inputU refdomainUh+]h*]U refexplicith(]h)]h-]hwhxuh/Kh]qhb)q}q(h hh&}q(h(]h)]q(h~heh*]h+]h-]uh!hh]qh9X input moduleqq}q(h Uh!hubah$hjubaubh9X in question.qq}q(h X in question.h!hubeubaubeubh)q}q(h Uh!hh"h#h$h%h&}q(h(]h)]h*]h+]qhah-]qh auh/Kh0hh]q(h2)q}q(h XGeneral Input Parametersqh!hh"h#h$h6h&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9XGeneral Input ParametersqɅq}q(h hh!hubaubh=)q}q(h Uh!hh"h#h$h@h&}q(h+]h*]h(]h)]h-]Uentries]uh/Nh0hh]ubcsphinx.addnodes desc q)q}q(h Uh!hh"h#h$Udescqh&}q(UnoindexqԉUdomainqXpyh+]h*]h(]h)]h-]UobjtypeqXfunctionqUdesctypeqhuh/Nh0hh]q(csphinx.addnodes desc_signature q)q}q(h Xtype qh!hh"h#h$Udesc_signatureqh&}q(h+]h*]h(]h)]h-]Ufirstquh/Kh0hh]qcsphinx.addnodes desc_name q)q}q(h hh!hh"h#h$U desc_nameqh&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qh9Xtype q腁q}q(h Uh!hubaubaubcsphinx.addnodes desc_content q)q}q(h Uh!hh"h#h$U desc_contentqh&}q(h(]h)]h*]h+]h-]uh/Kh0hh]q(hU)q}q(h X *Mandatory*qh!hh"h#h$hYh&}q(h(]h)]h*]h+]h-]uh/Kh0hh]qcdocutils.nodes emphasis q)q}q(h hh&}q(h(]h)]h*]h+]h-]uh!hh]qh9X Mandatoryqq}q(h Uh!hubah$UemphasisqubaubhU)q}r(h XThe ```` is a string identifying the input module as given it each module's documentation. For example, the :doc:`UDP syslog input ` is named "imudp".h!hh"h#h$hYh&}r(h(]h)]h*]h+]h-]uh/Kh0hh]r(h9XThe rr}r(h XThe h!hubhb)r}r(h X````h&}r(h(]h)]h*]h+]h-]uh!hh]r h9X r r }r (h Uh!jubah$hjubh9Xd is a string identifying the input module as given it each module's documentation. For example, the r r}r(h Xd is a string identifying the input module as given it each module's documentation. For example, the h!hubhn)r}r(h X':doc:`UDP syslog input `rh!hh"h#h$hrh&}r(UreftypeXdocrhuhvX modules/imudpU refdomainUh+]h*]U refexplicith(]h)]h-]hwhxuh/Kh]rhb)r}r(h jh&}r(h(]h)]r(h~jeh*]h+]h-]uh!jh]rh9XUDP syslog inputrr}r(h Uh!jubah$hjubaubh9X is named "imudp".rr}r (h X is named "imudp".h!hubeubeubeubhU)r!}r"(h XThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h!hh"h#h$hYh&}r#(h(]h)]h*]h+]h-]uh/Kh0hh]r$(h9X"This documentation is part of the r%r&}r'(h X"This documentation is part of the h!j!ubcdocutils.nodes reference r()r)}r*(h X$`rsyslog `_h&}r+(Unameh Urefurir,Xhttp://www.rsyslog.com/r-h+]h*]h(]h)]h-]uh!j!h]r.h9Xrsyslogr/r0}r1(h Uh!j)ubah$U referencer2ubhI)r3}r4(h X U referencedr5Kh!j!h$hLh&}r6(Urefurij-h+]r7hah*]h(]h)]h-]r8h auh]ubh9X$ project. Copyright © 2008-2014 by r9r:}r;(h X$ project. Copyright © 2008-2014 by h!j!ubj()r<}r=(h X3`Rainer Gerhards `_h&}r>(UnameXRainer Gerhardsj,Xhttp://www.gerhards.net/rainerr?h+]h*]h(]h)]h-]uh!j!h]r@h9XRainer GerhardsrArB}rC(h Uh!j<ubah$j2ubhI)rD}rE(h X! j5Kh!j!h$hLh&}rF(Urefurij?h+]rGhah*]h(]h)]h-]rHhauh]ubh9X and rIrJ}rK(h X and h!j!ubj()rL}rM(h X$`Adiscon `_h&}rN(UnameXAdisconj,Xhttp://www.adiscon.com/rOh+]h*]h(]h)]h-]uh!j!h]rPh9XAdisconrQrR}rS(h Uh!jLubah$j2ubhI)rT}rU(h X j5Kh!j!h$hLh&}rV(UrefurijOh+]rWhah*]h(]h)]h-]rXhauh]ubh9X1. Released under the GNU GPL version 2 or higher.rYrZ}r[(h X1. Released under the GNU GPL version 2 or higher.h!j!ubeubeubeubah UU transformerr\NU footnote_refsr]}r^Urefnamesr_}r`Usymbol_footnotesra]rbUautofootnote_refsrc]rdUsymbol_footnote_refsre]rfU citationsrg]rhh0hU current_lineriNUtransform_messagesrj]rk(cdocutils.nodes system_message rl)rm}rn(h Uh&}ro(h(]UlevelKh+]h*]Usourceh#h)]h-]UlineKUtypeUINFOrpuh]rqhU)rr}rs(h Uh&}rt(h(]h)]h*]h+]h-]uh!jmh]ruh9X-Hyperlink target "index-0" is not referenced.rvrw}rx(h Uh!jrubah$hYubah$Usystem_messageryubjl)rz}r{(h Uh&}r|(h(]UlevelKh+]h*]Usourceh#h)]h-]UlineKUtypejpuh]r}hU)r~}r(h Uh&}r(h(]h)]h*]h+]h-]uh!jzh]rh9X2Hyperlink target "cfgobj-input" is not referenced.rr}r(h Uh!j~ubah$hYubah$jyubeUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh6NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh#Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhVhEhVhjThj3hhhjDuUsubstitution_namesr}rh$h0h&}r(h(]h+]h*]Usourceh#h)]h-]uU footnotesr]rUrefidsr}r(hE]rhJah]rhOauub.build/.doctrees/configuration/timezone.doctree0000664000175000017500000003075013035122643020601 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X parametersqNXrainer gerhardsqX cfgobj_inputqXadisconq Xsampleq NXrsyslogq Xtimezoneq NuUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU parametersqhUrainer-gerhardsqhU cfgobj-inputqh Uadisconqh Usampleqh Ursyslogqh UtimezonequUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$X=/home/rger/proj/rsyslog-doc/source/configuration/timezone.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0h auUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"Xtimezoneq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;Xtimezoneq(h"h7h#h5ubaubcsphinx.addnodes index q?)q@}qA(h"Uh#h h$h%h&UindexqBh(}qC(h-]h,]h*]h+]h/]UentriesqD]qE(UsingleqFXtimezoneUindex-0qGUmainqHtqIaUinlineqJuh1Kh2hh]ubcdocutils.nodes target qK)qL}qM(h"Uh#h h$h%h&UtargetqNh(}qO(h-]h,]h*]h+]h/]UrefidqPhGuh1Kh2hh]ubhK)qQ}qR(h"X.. _cfgobj_input:h#h h$h%Uexpect_referenced_by_nameqS}h&hNh(}qT(h-]h,]h*]h+]h/]hPhuh1Kh2hUexpect_referenced_by_idqU}qVhGhLsh]ubcdocutils.nodes paragraph qW)qX}qY(h"X4The ``timezone`` object, as its name suggests, describes timezones. Currently, they are used by message parser modules to interpret timestamps that contain timezone information via a timezone string (but not an offset, e.g. "CET" but not "-01:00"). The object describes an UTC offset for a given timezone ID.h#h h$h%hS}qZhhQsh&U paragraphq[h(}q\(h*]h+]h,]h-]q](hhGeh/]q^hauh1Kh2hhU}q_(hGhLhhQuh]q`(h;XThe qaqb}qc(h"XThe h#hXubcdocutils.nodes literal qd)qe}qf(h"X ``timezone``h(}qg(h*]h+]h,]h-]h/]uh#hXh]qhh;Xtimezoneqiqj}qk(h"Uh#heubah&Uliteralqlubh;X$ object, as its name suggests, describes timezones. Currently, they are used by message parser modules to interpret timestamps that contain timezone information via a timezone string (but not an offset, e.g. "CET" but not "-01:00"). The object describes an UTC offset for a given timezone ID.qmqn}qo(h"X$ object, as its name suggests, describes timezones. Currently, they are used by message parser modules to interpret timestamps that contain timezone information via a timezone string (but not an offset, e.g. "CET" but not "-01:00"). The object describes an UTC offset for a given timezone ID.h#hXubeubhW)qp}qq(h"XEach timestamp object adds the zone definition to a global table with timezone information. Duplicate IDs are forbidden, but the same offset may be used with multiple IDs.qrh#h h$h%h&h[h(}qs(h*]h+]h,]h-]h/]uh1K h2hh]qth;XEach timestamp object adds the zone definition to a global table with timezone information. Duplicate IDs are forbidden, but the same offset may be used with multiple IDs.quqv}qw(h"hrh#hpubaubh)qx}qy(h"Uh#h h$h%h&h'h(}qz(h*]h+]h,]h-]q{hah/]q|hauh1Kh2hh]q}(h4)q~}q(h"X Parametersqh#hxh$h%h&h8h(}q(h*]h+]h,]h-]h/]uh1Kh2hh]qh;X Parametersqq}q(h"hh#h~ubaubh?)q}q(h"Uh#hxh$h%h&hBh(}q(h-]h,]h*]h+]h/]Uentries]uh1Nh2hh]ubcsphinx.addnodes desc q)q}q(h"Uh#hxh$h%h&Udescqh(}q(UnoindexqUdomainqXpyh-]h,]h*]h+]h/]UobjtypeqXfunctionqUdesctypeqhuh1Nh2hh]q(csphinx.addnodes desc_signature q)q}q(h"Xid qh#hh$h%h&Udesc_signatureqh(}q(h-]h,]h*]h+]h/]Ufirstquh1K!h2hh]qcsphinx.addnodes desc_name q)q}q(h"hh#hh$h%h&U desc_nameqh(}q(h*]h+]h,]h-]h/]uh1K!h2hh]qh;Xid qq}q(h"Uh#hubaubaubcsphinx.addnodes desc_content q)q}q(h"Uh#hh$h%h&U desc_contentqh(}q(h*]h+]h,]h-]h/]uh1K!h2hh]q(hW)q}q(h"X *Mandatory*qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1Kh2hh]qcdocutils.nodes emphasis q)q}q(h"hh(}q(h*]h+]h,]h-]h/]uh#hh]qh;X Mandatoryqq}q(h"Uh#hubah&UemphasisqubaubhW)q}q(h"X This identifies the timezone. Note that this id must match the zone name as reported within the timestamps. Different devices and vendors use different, often non-standard, names and so it is important to use the actual ids that messages contain. For multiple devices, this may mean that you may need to include multiple definitions, each one with a different id, for the same time zone. For example, it is seen that some devices report "CEST" for central European daylight savings time while others report "METDST" for it.qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1Kh2hh]qh;X This identifies the timezone. Note that this id must match the zone name as reported within the timestamps. Different devices and vendors use different, often non-standard, names and so it is important to use the actual ids that messages contain. For multiple devices, this may mean that you may need to include multiple definitions, each one with a different id, for the same time zone. For example, it is seen that some devices report "CEST" for central European daylight savings time while others report "METDST" for it.qq}q(h"hh#hubaubeubeubh?)q}q(h"Uh#hxh$h%h&hBh(}q(h-]h,]h*]h+]h/]Uentries]uh1Nh2hh]ubh)q}q(h"Uh#hxh$h%h&hh(}q(hhXpyh-]h,]h*]h+]h/]hXfunctionqhhuh1Nh2hh]q(h)q}q(h"Xoffset <[+/-]>:qh#hh$h%h&hh(}q(h-]h,]h*]h+]h/]huh1K+h2hh]qh)q}q(h"hh#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1K+h2hh]qh;Xoffset <[+/-]>:q҅q}q(h"Uh#hubaubaubh)q}q(h"Uh#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1K+h2hh]q(hW)q}q(h"X *Mandatory*qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1K$h2hh]qh)q}q(h"hh(}q(h*]h+]h,]h-]h/]uh#hh]qh;X Mandatoryq⅁q}q(h"Uh#hubah&hubaubhW)q}q(h"XMThis defines the timezone offset over UTC. It must always be 6 characters and start with a "+" (east of UTC) or "-" (west uf UTC) followed by a two-digit hour offset, a colon and a two-digit minute offset. Hour offsets can be in the range from zero to twelve, minute offsets in the range from zero to 59. Any other format is invalid.qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1K&h2hh]qh;XMThis defines the timezone offset over UTC. It must always be 6 characters and start with a "+" (east of UTC) or "-" (west uf UTC) followed by a two-digit hour offset, a colon and a two-digit minute offset. Hour offsets can be in the range from zero to twelve, minute offsets in the range from zero to 59. Any other format is invalid.qꅁq}q(h"hh#hubaubeubeubeubh)q}q(h"Uh#h h$h%h&h'h(}q(h*]h+]h,]h-]qhah/]qh auh1K-h2hh]q(h4)q}q(h"XSampleqh#hh$h%h&h8h(}q(h*]h+]h,]h-]h/]uh1K-h2hh]qh;XSampleqq}q(h"hh#hubaubhW)q}q(h"XThe following sample defines UTC time. From rsyslog PoV, it doesn't matter if a plus or minus offset prefix is used. For consistency, plus is suggested.qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1K.h2hh]qh;XThe following sample defines UTC time. From rsyslog PoV, it doesn't matter if a plus or minus offset prefix is used. For consistency, plus is suggested.rr}r(h"hh#hubaubcdocutils.nodes literal_block r)r}r(h"X"timezone(id="UTC" offset="+00:00")h#hh$h%h&U literal_blockrh(}r(U xml:spacerUpreserver h-]h,]h*]h+]h/]uh1K4h2hh]r h;X"timezone(id="UTC" offset="+00:00")r r }r (h"Uh#jubaubhW)r}r(h"X.The next sample defines some common timezones:rh#hh$h%h&h[h(}r(h*]h+]h,]h-]h/]uh1K6h2hh]rh;X.The next sample defines some common timezones:rr}r(h"jh#jubaubj)r}r(h"X timezone(id="CET" offset="+01:00") timezone(id="CEST" offset="+02:00") timezone(id="METDST" offset="+02:00") # duplicate to support differnt formats timezone(id="EST" offset="-05:00") timezone(id="EDT" offset="-04:00") timezone(id="PST" offset="-08:00") timezone(id="PDT" offset="-07:00")h#hh$h%h&jh(}r(jj h-]h,]h*]h+]h/]uh1K:h2hh]rh;X timezone(id="CET" offset="+01:00") timezone(id="CEST" offset="+02:00") timezone(id="METDST" offset="+02:00") # duplicate to support differnt formats timezone(id="EST" offset="-05:00") timezone(id="EDT" offset="-04:00") timezone(id="PST" offset="-08:00") timezone(id="PDT" offset="-07:00")rr}r(h"Uh#jubaubhW)r}r(h"XThis documentation is part of the `rsyslog `_ project. Copyright © 2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h#hh$h%h&h[h(}r(h*]h+]h,]h-]h/]uh1KCh2hh]r (h;X"This documentation is part of the r!r"}r#(h"X"This documentation is part of the h#jubcdocutils.nodes reference r$)r%}r&(h"X$`rsyslog `_h(}r'(Unameh Urefurir(Xhttp://www.rsyslog.com/r)h-]h,]h*]h+]h/]uh#jh]r*h;Xrsyslogr+r,}r-(h"Uh#j%ubah&U referencer.ubhK)r/}r0(h"X U referencedr1Kh#jh&hNh(}r2(Urefurij)h-]r3hah,]h*]h+]h/]r4h auh]ubh;X project. Copyright © 2014 by r5r6}r7(h"X project. Copyright © 2014 by h#jubj$)r8}r9(h"X3`Rainer Gerhards `_h(}r:(UnameXRainer Gerhardsj(Xhttp://www.gerhards.net/rainerr;h-]h,]h*]h+]h/]uh#jh]r<h;XRainer Gerhardsr=r>}r?(h"Uh#j8ubah&j.ubhK)r@}rA(h"X! j1Kh#jh&hNh(}rB(Urefurij;h-]rChah,]h*]h+]h/]rDhauh]ubh;X and rErF}rG(h"X and h#jubj$)rH}rI(h"X$`Adiscon `_h(}rJ(UnameXAdisconj(Xhttp://www.adiscon.com/rKh-]h,]h*]h+]h/]uh#jh]rLh;XAdisconrMrN}rO(h"Uh#jHubah&j.ubhK)rP}rQ(h"X j1Kh#jh&hNh(}rR(UrefurijKh-]rShah,]h*]h+]h/]rTh auh]ubh;X1. Released under the GNU GPL version 2 or higher.rUrV}rW(h"X1. Released under the GNU GPL version 2 or higher.h#jubeubeubeubah"UU transformerrXNU footnote_refsrY}rZUrefnamesr[}r\Usymbol_footnotesr]]r^Uautofootnote_refsr_]r`Usymbol_footnote_refsra]rbU citationsrc]rdh2hU current_linereNUtransform_messagesrf]rg(cdocutils.nodes system_message rh)ri}rj(h"Uh(}rk(h*]UlevelKh-]h,]Usourceh%h+]h/]UlineKUtypeUINFOrluh]rmhW)rn}ro(h"Uh(}rp(h*]h+]h,]h-]h/]uh#jih]rqh;X-Hyperlink target "index-0" is not referenced.rrrs}rt(h"Uh#jnubah&h[ubah&Usystem_messageruubjh)rv}rw(h"Uh(}rx(h*]UlevelKh-]h,]Usourceh%h+]h/]UlineKUtypejluh]ryhW)rz}r{(h"Uh(}r|(h*]h+]h,]h-]h/]uh#jvh]r}h;X2Hyperlink target "cfgobj-input" is not referenced.r~r}r(h"Uh#jzubah&h[ubah&juubeUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh%Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhxhhXhhhGhXhjPhj/hh hj@uUsubstitution_namesr}rh&h2h(}r(h*]h-]h,]Usourceh%h+]h/]uU footnotesr]rUrefidsr}r(hG]rhLah]rhQauub.build/.doctrees/configuration/property_replacer.doctree0000664000175000017500000022326213035122643022512 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrfc 4180qXconfiguration file syntaxqXcharacter positionsqNXproperty optionsq NX further linksq NXaccessing propertiesq NXthe property replacerq NXavailable propertiesq NX,rsyslog regular expression checker/generatorqX!$escapecontrolcharactersonreceivequUsubstitution_defsq}qUparse_messagesq]q(cdocutils.nodes system_message q)q}q(U rawsourceqUU attributesq}q(Udupnamesq]UlevelKUidsq]Ubackrefsq]qUid1qaUsourceXF/home/rger/proj/rsyslog-doc/source/configuration/property_replacer.rstqUclassesq ]Unamesq!]UlineKUtypeUINFOq"uUparentq#cdocutils.nodes definition q$)q%}q&(hUh}q'(h]h ]h]h]h!]uh#cdocutils.nodes definition_list_item q()q)}q*(hX**space-cc** replace control characters by spaces Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off. h#cdocutils.nodes definition_list q+)q,}q-(hUh#cdocutils.nodes section q.)q/}q0(hUh#h.)q1}q2(hUh#h.)q3}q4(hUh#hUsourceq5hUtagnameq6Usectionq7h}q8(h]h ]h]h]q9Uthe-property-replacerq:ah!]q;h auUlineq]q?(cdocutils.nodes title q@)qA}qB(hXThe Property ReplacerqCh#h3h5hh6UtitleqDh}qE(h]h ]h]h]h!]uh]qFcdocutils.nodes Text qGXThe Property ReplacerqHqI}qJ(hhCh#hAubaubcdocutils.nodes paragraph qK)qL}qM(hXf**The property replacer is a core component in rsyslogd's string template system.** A syslog message has a number of well-defined properties. Each of this properties can be accessed **and** manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.h#h3h5hh6U paragraphqNh}qO(h]h ]h]h]h!]uh]qP(cdocutils.nodes strong qQ)qR}qS(hXS**The property replacer is a core component in rsyslogd's string template system.**h}qT(h]h ]h]h]h!]uh#hLh>]qUhGXOThe property replacer is a core component in rsyslogd's string template system.qVqW}qX(hUh#hRubah6UstrongqYubhGXc A syslog message has a number of well-defined properties. Each of this properties can be accessed qZq[}q\(hXc A syslog message has a number of well-defined properties. Each of this properties can be accessed h#hLubhQ)q]}q^(hX**and**h}q_(h]h ]h]h]h!]uh#hLh>]q`hGXandqaqb}qc(hUh#h]ubah6hYubhGX manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.qdqe}qf(hX manipulated by the property replacer. With it, it is easy to use only part of a property value or manipulate the value, e.g. by converting all characters to lower case.h#hLubeubh1h.)qg}qh(hUh#h3h5hh6h7h}qi(h]h ]h]h]qjU further-linksqkah!]qlh auh]qm(h@)qn}qo(hX Further Linksqph#hgh5hh6hDh}qq(h]h ]h]h]h!]uh]qrhGX Further Linksqsqt}qu(hhph#hnubaubcdocutils.nodes bullet_list qv)qw}qx(hUh#hgh5hh6U bullet_listqyh}qz(Ubulletq{X-h]h]h]h ]h!]uh]q|(cdocutils.nodes list_item q})q~}q(hXArticle on ":doc:`Recording the Priority of Syslog Messages <../tutorials/recording_pri>`" (describes use of templates to record severity and facility of a message)h#hwh5hh6U list_itemqh}q(h]h ]h]h]h!]uh]qhK)q}q(hXArticle on ":doc:`Recording the Priority of Syslog Messages <../tutorials/recording_pri>`" (describes use of templates to record severity and facility of a message)h#h~h5hh6hNh}q(h]h ]h]h]h!]uh]q(hGX Article on "qq}q(hX Article on "h#hubcsphinx.addnodes pending_xref q)q}q(hXM:doc:`Recording the Priority of Syslog Messages <../tutorials/recording_pri>`qh#hh5hh6U pending_xrefqh}q(UreftypeXdocqUrefwarnqU reftargetqX../tutorials/recording_priU refdomainUh]h]U refexplicith]h ]h!]UrefdocqXconfiguration/property_replacerquh]qcdocutils.nodes literal q)q}q(hhh}q(h]h ]q(Uxrefqheh]h]h!]uh#hh>]qhGX)Recording the Priority of Syslog Messagesqq}q(hUh#hubah6UliteralqubaubhGXK" (describes use of templates to record severity and facility of a message)qq}q(hXK" (describes use of templates to record severity and facility of a message)h#hubeubaubh})q}q(hXh`Configuration file syntax `_, this is where you actually use the property replacer. h#hwh5hh6hh}q(h]h ]h]h]h!]uh]qhK)q}q(hXg`Configuration file syntax `_, this is where you actually use the property replacer.h#hh5hh6hNh}q(h]h ]h]h]h!]uh]q(cdocutils.nodes reference q)q}q(hX0`Configuration file syntax `_h}q(UnameXConfiguration file syntaxUrefuriqXrsyslog_conf.htmlqh]h]h]h ]h!]uh#hh>]qhGXConfiguration file syntaxqq}q(hUh#hubah6U referencequbcdocutils.nodes target q)q}q(hX U referencedqKh#hh6Utargetqh}q(Urefurihh]qUconfiguration-file-syntaxqah]h]h ]h!]qhauh>]ubhGX7, this is where you actually use the property replacer.qq}q(hX7, this is where you actually use the property replacer.h#hubeubaubeubcdocutils.nodes compound q)q}q(hUh#hgh5hh6Ucompoundqh}q(h]h ]qUtoctree-wrapperqah]h]h!]uh]qcsphinx.addnodes toctree q)q}q(hUh#hh5hh6Utoctreeqh}q(UnumberedqKU includehiddenqщh#hUcaptionqNUglobqӉh]h]U titlesonlyqԉh]h ]h!]Uentriesq]qNXconfiguration/nomatchq׆qaUhiddenqىU includefilesq]qhaUmaxdepthqKuh]ubaubeubeubh5hh6h7h}q(h]h ]h]h]qUaccessing-propertiesqah!]qh auh]q(h@)q}q(hXAccessing Propertiesqh#h1h5hh6hDh}q(h]h ]h]h]h!]uh]qhGXAccessing Propertiesq煁q}q(hhh#hubaubhK)q}q(hXSyslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by the property replacer. The full syntax is as follows:qh#h1h5hh6hNh}q(h]h ]h]h]h!]uh]qhGXSyslog message properties are used inside templates. They are accessed by putting them between percent signs. Properties can be modified by the property replacer. The full syntax is as follows:qq}q(hhh#hubaubcdocutils.nodes literal_block q)q}q(hX"%property:fromChar:toChar:options%h#h1h5hh6U literal_blockqh}q(U xml:spaceqUpreserveqh]h]h]h ]h!]uh]qhGX"%property:fromChar:toChar:options%qq}q(hUh#hubaubh.)q}q(hUh#h1h5hh6h7h}q(h]h ]h]h]rUavailable-propertiesrah!]rh auh]r(h@)r}r(hXAvailable Propertiesrh#hh5hh6hDh}r(h]h ]h]h]h!]uh]rhGXAvailable Propertiesr r }r (hjh#jubaubhK)r }r (hXIThe property replacer can use all :doc:`rsyslog properties `.rh#hh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGX"The property replacer can use all rr}r(hX"The property replacer can use all h#j ubh)r}r(hX&:doc:`rsyslog properties `rh#j h5hh6hh}r(UreftypeXdocrhhX propertiesU refdomainUh]h]U refexplicith]h ]h!]hhuh]rh)r}r(hjh}r(h]h ]r(hjeh]h]h!]uh#jh>]rhGXrsyslog propertiesrr }r!(hUh#jubah6hubaubhGX.r"}r#(hX.h#j ubeubeubh.)r$}r%(hUh#h1h5hh6h7h}r&(h]h ]h]h]r'Ucharacter-positionsr(ah!]r)hauh]r*(h@)r+}r,(hXCharacter Positionsr-h#j$h5hh6hDh}r.(h]h ]h]h]h!]uh]r/hGXCharacter Positionsr0r1}r2(hj-h#j+ubaubhK)r3}r4(hX**FromChar** and **toChar** are used to build substrings. They specify the offset within the string that should be copied. Offset counting starts at 1, so if you need to obtain the first 2 characters of the message text, you can use this syntax: "%msg:1:2%". If you do not whish to specify from and to, but you want to specify options, you still need to include the colons. For example, if you would like to convert the full message text to lower case, use "%msg:::lowercase%". If you would like to extract from a position until the end of the string, you can place a dollar-sign ("$") in toChar (e.g. %msg:10:$%, which will extract from position 10 to the end of the string).h#j$h5hh6hNh}r5(h]h ]h]h]h!]uh]r6(hQ)r7}r8(hX **FromChar**h}r9(h]h ]h]h]h!]uh#j3h>]r:hGXFromCharr;r<}r=(hUh#j7ubah6hYubhGX and r>r?}r@(hX and h#j3ubhQ)rA}rB(hX **toChar**h}rC(h]h ]h]h]h!]uh#j3h>]rDhGXtoCharrErF}rG(hUh#jAubah6hYubhGX are used to build substrings. They specify the offset within the string that should be copied. Offset counting starts at 1, so if you need to obtain the first 2 characters of the message text, you can use this syntax: "%msg:1:2%". If you do not whish to specify from and to, but you want to specify options, you still need to include the colons. For example, if you would like to convert the full message text to lower case, use "%msg:::lowercase%". If you would like to extract from a position until the end of the string, you can place a dollar-sign ("$") in toChar (e.g. %msg:10:$%, which will extract from position 10 to the end of the string).rHrI}rJ(hX are used to build substrings. They specify the offset within the string that should be copied. Offset counting starts at 1, so if you need to obtain the first 2 characters of the message text, you can use this syntax: "%msg:1:2%". If you do not whish to specify from and to, but you want to specify options, you still need to include the colons. For example, if you would like to convert the full message text to lower case, use "%msg:::lowercase%". If you would like to extract from a position until the end of the string, you can place a dollar-sign ("$") in toChar (e.g. %msg:10:$%, which will extract from position 10 to the end of the string).h#j3ubeubhK)rK}rL(hXThere is also support for **regular expressions**. To use them, you need to place a "R" into FromChar. This tells rsyslog that a regular expression instead of position-based extraction is desired. The actual regular expression must then be provided in toChar. The regular expression **must** be followed by the string "--end". It denotes the end of the regular expression and will not become part of it. If you are using regular expressions, the property replacer will return the part of the property text that matches the regular expression. An example for a property replacer sequence with a regular expression is: "%msg:R:.\*Sev:. \\(.\*\\) \\[.\*--end%"h#j$h5hh6hNh}rM(h]h ]h]h]h!]uh]rN(hGXThere is also support for rOrP}rQ(hXThere is also support for h#jKubhQ)rR}rS(hX**regular expressions**h}rT(h]h ]h]h]h!]uh#jKh>]rUhGXregular expressionsrVrW}rX(hUh#jRubah6hYubhGX. To use them, you need to place a "R" into FromChar. This tells rsyslog that a regular expression instead of position-based extraction is desired. The actual regular expression must then be provided in toChar. The regular expression rYrZ}r[(hX. To use them, you need to place a "R" into FromChar. This tells rsyslog that a regular expression instead of position-based extraction is desired. The actual regular expression must then be provided in toChar. The regular expression h#jKubhQ)r\}r](hX**must**h}r^(h]h ]h]h]h!]uh#jKh>]r_hGXmustr`ra}rb(hUh#j\ubah6hYubhGXh be followed by the string "--end". It denotes the end of the regular expression and will not become part of it. If you are using regular expressions, the property replacer will return the part of the property text that matches the regular expression. An example for a property replacer sequence with a regular expression is: "%msg:R:.*Sev:. \(.*\) \[.*--end%"rcrd}re(hXn be followed by the string "--end". It denotes the end of the regular expression and will not become part of it. If you are using regular expressions, the property replacer will return the part of the property text that matches the regular expression. An example for a property replacer sequence with a regular expression is: "%msg:R:.\*Sev:. \\(.\*\\) \\[.\*--end%"h#jKubeubhK)rf}rg(hX\It is possible to specify some parametes after the "R". These are comma-separated. They are:rhh#j$h5hh6hNh}ri(h]h ]h]h]h!]uh]rjhGX\It is possible to specify some parametes after the "R". These are comma-separated. They are:rkrl}rm(hjhh#jfubaubhK)rn}ro(hXFR,,,<:doc:`nomatch `\ >,rph#j$h5hh6hNh}rq(h]h ]h]h]h!]uh]rr(hGXR,,,,,`rxh#jnh5hh6hh}ry(UreftypeXdocrzhhXnomatchU refdomainUh]h]U refexplicith]h ]h!]hhuh]r{h)r|}r}(hjxh}r~(h]h ]r(hjzeh]h]h!]uh#jvh>]rhGXnomatchrr}r(hUh#j|ubah6hubaubhGX>,rr}r(hX\ >,h#jnubeubhK)r}r(hX$regexp-type is either "BRE" for Posix basic regular expressions or "ERE" for extended ones. The string must be given in upper case. The default is "BRE" to be consistent with earlier versions of rsyslog that did not support ERE. The submatch identifies the submatch to be used with the result. A single digit is supported. Match 0 is the full match, while 1 to 9 are the acutal submatches. The match-number identifies which match to use, if the expression occurs more than once inside the string. Please note that the first match is number 0, the second 1 and so on. Up to 10 matches (up to number 9) are supported. Please note that it would be more natural to have the match-number in front of submatch, but this would break backward-compatibility. So the match-number must be specified after "nomatch".rh#j$h5hh6hNh}r(h]h ]h]h]h!]uh]rhGX$regexp-type is either "BRE" for Posix basic regular expressions or "ERE" for extended ones. The string must be given in upper case. The default is "BRE" to be consistent with earlier versions of rsyslog that did not support ERE. The submatch identifies the submatch to be used with the result. A single digit is supported. Match 0 is the full match, while 1 to 9 are the acutal submatches. The match-number identifies which match to use, if the expression occurs more than once inside the string. Please note that the first match is number 0, the second 1 and so on. Up to 10 matches (up to number 9) are supported. Please note that it would be more natural to have the match-number in front of submatch, but this would break backward-compatibility. So the match-number must be specified after "nomatch".rr}r(hjh#jubaubhK)r}r(hXQ:doc:`nomatch ` specifies what should be used in case no match is found.h#j$h5hh6hNh}r(h]h ]h]h]h!]uh]r(h)r}r(hX:doc:`nomatch `rh#jh5hh6hh}r(UreftypeXdocrhhXnomatchU refdomainUh]h]U refexplicith]h ]h!]hhuh]rh)r}r(hjh}r(h]h ]r(hjeh]h]h!]uh#jh>]rhGXnomatchrr}r(hUh#jubah6hubaubhGX9 specifies what should be used in case no match is found.rr}r(hX9 specifies what should be used in case no match is found.h#jubeubhK)r}r(hXThe following is a sample of an ERE expression that takes the first submatch from the message string and replaces the expression with the full field if no match is found:rh#j$h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXThe following is a sample of an ERE expression that takes the first submatch from the message string and replaces the expression with the full field if no match is found:rr}r(hjh#jubaubh)r}r(hX+%msg:R,ERE,1,FIELD:for (vlan[0-9]\*):--end%rh#j$h5hh6hh}r(hhh]h]h]h ]h!]uh]rhGX+%msg:R,ERE,1,FIELD:for (vlan[0-9]\*):--end%rr}r(hUh#jubaubhK)r}r(hXIand this takes the first submatch of the second match of said expression:rh#j$h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXIand this takes the first submatch of the second match of said expression:rr}r(hjh#jubaubh)r}r(hX-%msg:R,ERE,1,FIELD,1:for (vlan[0-9]\*):--end%rh#j$h5hh6hh}r(hhh]h]h]h ]h!]uh]rhGX-%msg:R,ERE,1,FIELD,1:for (vlan[0-9]\*):--end%rr}r(hUh#jubaubhK)r}r(hX **Please note: there is also a** `rsyslog regular expression checker/generator `_ **online tool available.** With that tool, you can check your regular expressions and also generate a valid property replacer sequence. Usage of this tool is recommended. Depending on the version offered, the tool may not cover all subleties that can be done with the property replacer. It concentrates on the most often used cases. So it is still useful to hand-craft expressions for demanding environments.h#j$h5hh6hNh}r(h]h ]h]h]h!]uh]r(hQ)r}r(hX **Please note: there is also a**h}r(h]h ]h]h]h!]uh#jh>]rhGXPlease note: there is also arr}r(hUh#jubah6hYubhGX r}r(hX h#jubh)r}r(hXS`rsyslog regular expression checker/generator `_h}r(UnameX,rsyslog regular expression checker/generatorhX!http://www.rsyslog.com/tool-regexrh]h]h]h ]h!]uh#jh>]rhGX,rsyslog regular expression checker/generatorrr}r(hUh#jubah6hubh)r}r(hX$ hKh#jh6hh}r(Urefurijh]rU,rsyslog-regular-expression-checker-generatorrah]h]h ]h!]rhauh>]ubhGX r}r(hX h#jubhQ)r}r(hX**online tool available.**h}r(h]h ]h]h]h!]uh#jh>]rhGXonline tool available.rr}r(hUh#jubah6hYubhGX~ With that tool, you can check your regular expressions and also generate a valid property replacer sequence. Usage of this tool is recommended. Depending on the version offered, the tool may not cover all subleties that can be done with the property replacer. It concentrates on the most often used cases. So it is still useful to hand-craft expressions for demanding environments.rr}r(hX~ With that tool, you can check your regular expressions and also generate a valid property replacer sequence. Usage of this tool is recommended. Depending on the version offered, the tool may not cover all subleties that can be done with the property replacer. It concentrates on the most often used cases. So it is still useful to hand-craft expressions for demanding environments.h#jubeubhK)r}r(hX**Also, extraction can be done based on so-called "fields"**. To do so, place a "F" into FromChar. A field in its current definition is anything that is delimited by a delimiter character. The delimiter by default is TAB (US-ASCII value 9). However, if can be changed to any other US-ASCII character by specifying a comma and the **decimal** US-ASCII value of the delimiter immediately after the "F". For example, to use comma (",") as a delimiter, use this field specifier: "F,44".  If your syslog data is delimited, this is a quicker way to extract than via regular expressions (actually, a *much* quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a "field not found" error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the "ToChar" parameter. An example where the 3rd field (delimited by TAB) from the msg property is extracted is as follows: "%msg:F:3%". The same example with semicolon as delimiter is "%msg:F,59:3%".h#j$h5hh6hNh}r(h]h ]h]h]h!]uh]r(hQ)r}r(hX<**Also, extraction can be done based on so-called "fields"**h}r(h]h ]h]h]h!]uh#jh>]rhGX8Also, extraction can be done based on so-called "fields"rr}r(hUh#jubah6hYubhGX. To do so, place a "F" into FromChar. A field in its current definition is anything that is delimited by a delimiter character. The delimiter by default is TAB (US-ASCII value 9). However, if can be changed to any other US-ASCII character by specifying a comma and the rr}r(hX. To do so, place a "F" into FromChar. A field in its current definition is anything that is delimited by a delimiter character. The delimiter by default is TAB (US-ASCII value 9). However, if can be changed to any other US-ASCII character by specifying a comma and the h#jubhQ)r}r(hX **decimal**h}r(h]h ]h]h]h!]uh#jh>]rhGXdecimalrr}r(hUh#jubah6hYubhGX US-ASCII value of the delimiter immediately after the "F". For example, to use comma (",") as a delimiter, use this field specifier: "F,44".  If your syslog data is delimited, this is a quicker way to extract than via regular expressions (actually, a rr}r(hX US-ASCII value of the delimiter immediately after the "F". For example, to use comma (",") as a delimiter, use this field specifier: "F,44".  If your syslog data is delimited, this is a quicker way to extract than via regular expressions (actually, a h#jubcdocutils.nodes emphasis r)r}r(hX*much*h}r(h]h ]h]h]h!]uh#jh>]rhGXmuchrr }r (hUh#jubah6Uemphasisr ubhGX quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a "field not found" error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the "ToChar" parameter. An example where the 3rd field (delimited by TAB) from the msg property is extracted is as follows: "%msg:F:3%". The same example with semicolon as delimiter is "%msg:F,59:3%".r r }r(hX quicker way). Field counting starts at 1. Field zero is accepted, but will always lead to a "field not found" error. The same happens if a field number higher than the number of fields in the property is requested. The field number must be placed in the "ToChar" parameter. An example where the 3rd field (delimited by TAB) from the msg property is extracted is as follows: "%msg:F:3%". The same example with semicolon as delimiter is "%msg:F,59:3%".h#jubeubhK)r}r(hXThe use of fields does not permit to select substrings, what is rather unfortunate. To solve this issue, starting with 6.3.9, fromPos and toPos can be specified for strings as well. However, the syntax is quite ugly, but it was the only way to integrate this functonality into the already-existing system. To do so, use ",fromPos" and ",toPos" during field extraction. Let's assume you want to extract the substring from position 5 to 9 in the previous example. Then, the syntax is as follows: "%msg:F,59,5:3,9%". As you can see, "F,59" means field-mode, with semicolon delimiter and ",5" means starting at position 5. Then "3,9" means field 3 and string extraction to position 9.rh#j$h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXThe use of fields does not permit to select substrings, what is rather unfortunate. To solve this issue, starting with 6.3.9, fromPos and toPos can be specified for strings as well. However, the syntax is quite ugly, but it was the only way to integrate this functonality into the already-existing system. To do so, use ",fromPos" and ",toPos" during field extraction. Let's assume you want to extract the substring from position 5 to 9 in the previous example. Then, the syntax is as follows: "%msg:F,59,5:3,9%". As you can see, "F,59" means field-mode, with semicolon delimiter and ",5" means starting at position 5. Then "3,9" means field 3 and string extraction to position 9.rr}r(hjh#jubaubhK)r}r(hXPlease note that the special characters "F" and "R" are case-sensitive. Only upper case works, lower case will return an error. There are no white spaces permitted inside the sequence (that will lead to error messages and will NOT provide the intended result).rh#j$h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXPlease note that the special characters "F" and "R" are case-sensitive. Only upper case works, lower case will return an error. There are no white spaces permitted inside the sequence (that will lead to error messages and will NOT provide the intended result).rr}r(hjh#jubaubhK)r}r (hX\Each occurence of the field delimiter starts a new field. However, if you add a plus sign ("+") after the field delimiter, multiple delimiters, one immediately after the others, are treated as separate fields. This can be useful in cases where the syslog message contains such sequences. A frequent case may be with code that is written as follows:r!h#j$h5hh6hNh}r"(h]h ]h]h]h!]uh]r#hGX\Each occurence of the field delimiter starts a new field. However, if you add a plus sign ("+") after the field delimiter, multiple delimiters, one immediately after the others, are treated as separate fields. This can be useful in cases where the syslog message contains such sequences. A frequent case may be with code that is written as follows:r$r%}r&(hj!h#jubaubcdocutils.nodes transition r')r(}r)(hX````r*h#j$h5hh6U transitionr+h}r,(h]h ]h]h]h!]uh]ubh)r-}r.(hX3int n, m; ... syslog(LOG_ERR, "%d test %6d", n, m);h#j$h5hh6hh}r/(hhh]h]h]h ]h!]uh]r0hGX3int n, m; ... syslog(LOG_ERR, "%d test %6d", n, m);r1r2}r3(hUh#j-ubaubhK)r4}r5(hXzThis will result into things like this in syslog messages: "1 test      2", "1 test     23", "1 test  234567"r6h#j$h5hh6hNh}r7(h]h ]h]h]h!]uh]r8hGXzThis will result into things like this in syslog messages: "1 test      2", "1 test     23", "1 test  234567"r9r:}r;(hj6h#j4ubaubhK)r<}r=(hXAs you can see, the fields are delimited by space characters, but their exact number is unknown. They can properly be extracted as follows:r>h#j$h5hh6hNh}r?(h]h ]h]h]h!]uh]r@hGXAs you can see, the fields are delimited by space characters, but their exact number is unknown. They can properly be extracted as follows:rArB}rC(hj>h#j<ubaubh)rD}rE(hX""%msg:F,32:2%" to "%msg:F,32+:2%".h#j$h5hh6hh}rF(hhh]h]h]h ]h!]uh]rGhGX""%msg:F,32:2%" to "%msg:F,32+:2%".rHrI}rJ(hUh#jDubaubhK)rK}rL(hX{This feature was suggested by Zhuang Yuyao and implemented by him. It is modeled after perl compatible regular expressions.rMh#j$h5hh6hNh}rN(h]h ]h]h]h!]uh]rOhGX{This feature was suggested by Zhuang Yuyao and implemented by him. It is modeled after perl compatible regular expressions.rPrQ}rR(hjMh#jKubaubeubh/eubh5hh6h7h}rS(h]h ]h]h]rTUproperty-optionsrUah!]rVh auh]rW(h@)rX}rY(hXProperty OptionsrZh#h/h5hh6hDh}r[(h]h ]h]h]h!]uh]r\hGXProperty Optionsr]r^}r_(hjZh#jXubaubhK)r`}ra(hXX**Property options** are case-insensitive. Currently, the following options are defined:h#h/h5hh6hNh}rb(h]h ]h]h]h!]uh]rc(hQ)rd}re(hX**Property options**h}rf(h]h ]h]h]h!]uh#j`h>]rghGXProperty optionsrhri}rj(hUh#jdubah6hYubhGXD are case-insensitive. Currently, the following options are defined:rkrl}rm(hXD are case-insensitive. Currently, the following options are defined:h#j`ubeubh,hK)rn}ro(hXETo use multiple options, simply place them one after each other with a comma delimiting them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together, the last one will override the previous one. For example, using "escape-cc,drop-cc" will use drop-cc and "drop-cc,escape-cc" will use escape-cc mode.rph#h/h5hh6hNh}rq(h]h ]h]h]h!]uh]rrhGXETo use multiple options, simply place them one after each other with a comma delimiting them. For example "escape-cc,sp-if-no-1st-sp". If you use conflicting options together, the last one will override the previous one. For example, using "escape-cc,drop-cc" will use drop-cc and "drop-cc,escape-cc" will use escape-cc mode.rsrt}ru(hjph#jnubaubeubh5hh6Udefinition_listrvh}rw(h]h ]h]h]h!]uh]rx(h()ry}rz(hX1**uppercase** convert property to uppercase only h#h,h5hh6Udefinition_list_itemr{h}r|(h]h ]h]h]h!]uh]r}(cdocutils.nodes term r~)r}r(hX **uppercase**rh#jyh5hh6Utermrh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX uppercaserr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jyh>]rhK)r}r(hX"convert property to uppercase onlyrh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX"convert property to uppercase onlyrr}r(hjh#jubaubah6U definitionrubeubh()r}r(hX6**lowercase** convert property text to lowercase only h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **lowercase**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX lowercaserr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hX'convert property text to lowercase onlyrh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX'convert property text to lowercase onlyrr}r(hjh#jubaubah6jubeubh()r}r(hX**fixed-width** changes behaviour of toChar so that it pads the source string with spaces up to the value of toChar if the source string is shorter. *This feature was introduced in rsyslog 8.13.0* h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**fixed-width**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX fixed-widthrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXchanges behaviour of toChar so that it pads the source string with spaces up to the value of toChar if the source string is shorter. *This feature was introduced in rsyslog 8.13.0*h#jh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGXchanges behaviour of toChar so that it pads the source string with spaces up to the value of toChar if the source string is shorter. rr}r(hXchanges behaviour of toChar so that it pads the source string with spaces up to the value of toChar if the source string is shorter. h#jubj)r}r(hX/*This feature was introduced in rsyslog 8.13.0*h}r(h]h ]h]h]h!]uh#jh>]rhGX-This feature was introduced in rsyslog 8.13.0rr}r(hUh#jubah6j ubeubah6jubeubh()r}r(hX**json** encode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for example US-ASCII LF is replaced by "\\n". The json option cannot be used together with either jsonf or csv options. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**json**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXjsonrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXencode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for example US-ASCII LF is replaced by "\\n". The json option cannot be used together with either jsonf or csv options.h#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXencode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for example US-ASCII LF is replaced by "\n". The json option cannot be used together with either jsonf or csv options.rr}r(hXencode the value so that it can be used inside a JSON field. This means that several characters (according to the JSON spec) are being escaped, for example US-ASCII LF is replaced by "\\n". The json option cannot be used together with either jsonf or csv options.h#jubaubah6jubeubh()r}r(hX**jsonf** (available in 6.3.9+) This signifies that the property should be expressed as a json field. That means not only the property is written, but rather a complete json field in the format ``"fieldname"="value"`` where "filedname" is given in the *outname* property (or the property name if none was assigned) and value is the end result of property replacer operation. Note that value supports all property replacer options, like substrings, case converson and the like. Values are properly json-escaped. However, field names are (currently) not. It is expected that proper field names are configured. The jsonf option cannot be used together with either json or csv options. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **jsonf**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXjsonfrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]r(hK)r}r(hX(available in 6.3.9+) This signifies that the property should be expressed as a json field. That means not only the property is written, but rather a complete json field in the formatrh#jh5hh6hNh}r (h]h ]h]h]h!]uh]r hGX(available in 6.3.9+) This signifies that the property should be expressed as a json field. That means not only the property is written, but rather a complete json field in the formatr r }r (hjh#jubaubhK)r}r(hX``"fieldname"="value"``rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rh)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX"fieldname"="value"rr}r(hUh#jubah6hubaubhK)r}r(hXwhere "filedname" is given in the *outname* property (or the property name if none was assigned) and value is the end result of property replacer operation. Note that value supports all property replacer options, like substrings, case converson and the like. Values are properly json-escaped. However, field names are (currently) not. It is expected that proper field names are configured. The jsonf option cannot be used together with either json or csv options.h#jh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGX"where "filedname" is given in the rr}r (hX"where "filedname" is given in the h#jubj)r!}r"(hX *outname*h}r#(h]h ]h]h]h!]uh#jh>]r$hGXoutnamer%r&}r'(hUh#j!ubah6j ubhGX property (or the property name if none was assigned) and value is the end result of property replacer operation. Note that value supports all property replacer options, like substrings, case converson and the like. Values are properly json-escaped. However, field names are (currently) not. It is expected that proper field names are configured. The jsonf option cannot be used together with either json or csv options.r(r)}r*(hX property (or the property name if none was assigned) and value is the end result of property replacer operation. Note that value supports all property replacer options, like substrings, case converson and the like. Values are properly json-escaped. However, field names are (currently) not. It is expected that proper field names are configured. The jsonf option cannot be used together with either json or csv options.h#jubeubeh6jubeubh()r+}r,(hX**csv** formats the resulting field (after all modifications) in CSV format as specified in `RFC 4180 `_. Rsyslog will always use double quotes. Note that in order to have full CSV-formatted text, you need to define a proper template. An example is this one: $template csvline,"%syslogtag:::csv%,%msg:::csv%" Most importantly, you need to provide the commas between the fields inside the template. *This feature was introduced in rsyslog 4.1.6.* h#h,h5hh6j{h}r-(h]h ]h]h]h!]uh]r.(j~)r/}r0(hX**csv**r1h#j+h5hh6jh}r2(h]h ]h]h]h!]uh]r3hQ)r4}r5(hj1h}r6(h]h ]h]h]h!]uh#j/h>]r7hGXcsvr8r9}r:(hUh#j4ubah6hYubaubh$)r;}r<(hUh}r=(h]h ]h]h]h!]uh#j+h>]r>hK)r?}r@(hXformats the resulting field (after all modifications) in CSV format as specified in `RFC 4180 `_. Rsyslog will always use double quotes. Note that in order to have full CSV-formatted text, you need to define a proper template. An example is this one: $template csvline,"%syslogtag:::csv%,%msg:::csv%" Most importantly, you need to provide the commas between the fields inside the template. *This feature was introduced in rsyslog 4.1.6.*h#j;h5hh6hNh}rA(h]h ]h]h]h!]uh]rB(hGXTformats the resulting field (after all modifications) in CSV format as specified in rCrD}rE(hXTformats the resulting field (after all modifications) in CSV format as specified in h#j?ubh)rF}rG(hX1`RFC 4180 `_h}rH(UnameXRFC 4180hX#http://www.ietf.org/rfc/rfc4180.txtrIh]h]h]h ]h!]uh#j?h>]rJhGXRFC 4180rKrL}rM(hUh#jFubah6hubh)rN}rO(hX& hKh#j?h6hh}rP(UrefurijIh]rQUrfc-4180rRah]h]h ]h!]rShauh>]ubhGX&. Rsyslog will always use double quotes. Note that in order to have full CSV-formatted text, you need to define a proper template. An example is this one: $template csvline,"%syslogtag:::csv%,%msg:::csv%" Most importantly, you need to provide the commas between the fields inside the template. rTrU}rV(hX&. Rsyslog will always use double quotes. Note that in order to have full CSV-formatted text, you need to define a proper template. An example is this one: $template csvline,"%syslogtag:::csv%,%msg:::csv%" Most importantly, you need to provide the commas between the fields inside the template. h#j?ubj)rW}rX(hX/*This feature was introduced in rsyslog 4.1.6.*h}rY(h]h ]h]h]h!]uh#j?h>]rZhGX-This feature was introduced in rsyslog 4.1.6.r[r\}r](hUh#jWubah6j ubeubah6jubeubh()r^}r_(hX]**drop-last-lf** The last LF in the message (if any), is dropped. Especially useful for PIX. h#h,h5hh6j{h}r`(h]h ]h]h]h!]uh]ra(j~)rb}rc(hX**drop-last-lf**rdh#j^h5hh6jh}re(h]h ]h]h]h!]uh]rfhQ)rg}rh(hjdh}ri(h]h ]h]h]h!]uh#jbh>]rjhGX drop-last-lfrkrl}rm(hUh#jgubah6hYubaubh$)rn}ro(hUh}rp(h]h ]h]h]h!]uh#j^h>]rqhK)rr}rs(hXKThe last LF in the message (if any), is dropped. Especially useful for PIX.rth#jnh5hh6hNh}ru(h]h ]h]h]h!]uh]rvhGXKThe last LF in the message (if any), is dropped. Especially useful for PIX.rwrx}ry(hjth#jrubaubah6jubeubh()rz}r{(hXP**date-utc** convert data to UTC prior to outputing it (available since 8.18.0) h#h,h5hh6j{h}r|(h]h ]h]h]h!]uh]r}(j~)r~}r(hX **date-utc**rh#jzh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#j~h>]rhGXdate-utcrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jzh>]rhK)r}r(hXBconvert data to UTC prior to outputing it (available since 8.18.0)rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXBconvert data to UTC prior to outputing it (available since 8.18.0)rr}r(hjh#jubaubah6jubeubh()r}r(hX$**date-mysql** format as mysql date h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-mysql**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-mysqlrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXformat as mysql daterh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXformat as mysql daterr}r(hjh#jubaubah6jubeubh()r}r(hX)**date-rfc3164** format as RFC 3164 date h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-rfc3164**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-rfc3164rr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXformat as RFC 3164 daterh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXformat as RFC 3164 daterr}r(hjh#jubaubah6jubeubh()r}r(hX**date-rfc3164-buggyday** similar to date-rfc3164, but emulates a common coding error: RFC 3164 demands that a space is written for single-digit days. With this option, a zero is written instead. This format seems to be used by syslog-ng and the date-rfc3164-buggyday option can be used in migration scenarios where otherwise lots of scripts would need to be adjusted. It is recommended *not* to use this option when forwarding to remote hosts - they may treat the date as invalid (especially when parsing strictly according to RFC 3164). *This feature was introduced in rsyslog 4.6.2 and v4 versions above and 5.5.3 and all versions above.* h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-rfc3164-buggyday**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXdate-rfc3164-buggydayrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]r(hK)r}r(hXsimilar to date-rfc3164, but emulates a common coding error: RFC 3164 demands that a space is written for single-digit days. With this option, a zero is written instead. This format seems to be used by syslog-ng and the date-rfc3164-buggyday option can be used in migration scenarios where otherwise lots of scripts would need to be adjusted. It is recommended *not* to use this option when forwarding to remote hosts - they may treat the date as invalid (especially when parsing strictly according to RFC 3164).h#jh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGXisimilar to date-rfc3164, but emulates a common coding error: RFC 3164 demands that a space is written for single-digit days. With this option, a zero is written instead. This format seems to be used by syslog-ng and the date-rfc3164-buggyday option can be used in migration scenarios where otherwise lots of scripts would need to be adjusted. It is recommended rr}r(hXisimilar to date-rfc3164, but emulates a common coding error: RFC 3164 demands that a space is written for single-digit days. With this option, a zero is written instead. This format seems to be used by syslog-ng and the date-rfc3164-buggyday option can be used in migration scenarios where otherwise lots of scripts would need to be adjusted. It is recommended h#jubj)r}r(hX*not*h}r(h]h ]h]h]h!]uh#jh>]rhGXnotrr}r(hUh#jubah6j ubhGX to use this option when forwarding to remote hosts - they may treat the date as invalid (especially when parsing strictly according to RFC 3164).rr}r(hX to use this option when forwarding to remote hosts - they may treat the date as invalid (especially when parsing strictly according to RFC 3164).h#jubeubhK)r}r(hXf*This feature was introduced in rsyslog 4.6.2 and v4 versions above and 5.5.3 and all versions above.*rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rj)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXdThis feature was introduced in rsyslog 4.6.2 and v4 versions above and 5.5.3 and all versions above.rr}r(hUh#jubah6j ubaubeh6jubeubh()r}r(hX)**date-rfc3339** format as RFC 3339 date h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-rfc3339**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r (hjh}r (h]h ]h]h]h!]uh#jh>]r hGX date-rfc3339r r }r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXformat as RFC 3339 daterh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXformat as RFC 3339 daterr}r(hjh#jubaubah6jubeubh()r}r(hXH**date-unixtimestamp** Format as a unix timestamp (seconds since epoch) h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r (hX**date-unixtimestamp**r!h#jh5hh6jh}r"(h]h ]h]h]h!]uh]r#hQ)r$}r%(hj!h}r&(h]h ]h]h]h!]uh#jh>]r'hGXdate-unixtimestampr(r)}r*(hUh#j$ubah6hYubaubh$)r+}r,(hUh}r-(h]h ]h]h]h!]uh#jh>]r.hK)r/}r0(hX0Format as a unix timestamp (seconds since epoch)r1h#j+h5hh6hNh}r2(h]h ]h]h]h!]uh]r3hGX0Format as a unix timestamp (seconds since epoch)r4r5}r6(hj1h#j/ubaubah6jubeubh()r7}r8(hX:**date-year** just the year part (4-digit) of a timestamp h#h,h5hh6j{h}r9(h]h ]h]h]h!]uh]r:(j~)r;}r<(hX **date-year**r=h#j7h5hh6jh}r>(h]h ]h]h]h!]uh]r?hQ)r@}rA(hj=h}rB(h]h ]h]h]h!]uh#j;h>]rChGX date-yearrDrE}rF(hUh#j@ubah6hYubaubh$)rG}rH(hUh}rI(h]h ]h]h]h!]uh#j7h>]rJhK)rK}rL(hX+just the year part (4-digit) of a timestamprMh#jGh5hh6hNh}rN(h]h ]h]h]h!]uh]rOhGX+just the year part (4-digit) of a timestamprPrQ}rR(hjMh#jKubaubah6jubeubh()rS}rT(hX<**date-month** just the month part (2-digit) of a timestamp h#h,h5hh6j{h}rU(h]h ]h]h]h!]uh]rV(j~)rW}rX(hX**date-month**rYh#jSh5hh6jh}rZ(h]h ]h]h]h!]uh]r[hQ)r\}r](hjYh}r^(h]h ]h]h]h!]uh#jWh>]r_hGX date-monthr`ra}rb(hUh#j\ubah6hYubaubh$)rc}rd(hUh}re(h]h ]h]h]h!]uh#jSh>]rfhK)rg}rh(hX,just the month part (2-digit) of a timestamprih#jch5hh6hNh}rj(h]h ]h]h]h!]uh]rkhGX,just the month part (2-digit) of a timestamprlrm}rn(hjih#jgubaubah6jubeubh()ro}rp(hX8**date-day** just the day part (2-digit) of a timestamp h#h,h5hh6j{h}rq(h]h ]h]h]h!]uh]rr(j~)rs}rt(hX **date-day**ruh#joh5hh6jh}rv(h]h ]h]h]h!]uh]rwhQ)rx}ry(hjuh}rz(h]h ]h]h]h!]uh#jsh>]r{hGXdate-dayr|r}}r~(hUh#jxubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#joh>]rhK)r}r(hX*just the day part (2-digit) of a timestamprh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX*just the day part (2-digit) of a timestamprr}r(hjh#jubaubah6jubeubh()r}r(hXI**date-hour** just the hour part (2-digit, 24-hour clock) of a timestamp h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **date-hour**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-hourrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hX:just the hour part (2-digit, 24-hour clock) of a timestamprh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX:just the hour part (2-digit, 24-hour clock) of a timestamprr}r(hjh#jubaubah6jubeubh()r}r(hX>**date-minute** just the minute part (2-digit) of a timestamp h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-minute**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-minuterr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hX-just the minute part (2-digit) of a timestamprh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX-just the minute part (2-digit) of a timestamprr}r(hjh#jubaubah6jubeubh()r}r(hX>**date-second** just the second part (2-digit) of a timestamp h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-second**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-secondrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hX-just the second part (2-digit) of a timestamprh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGX-just the second part (2-digit) of a timestamprr}r(hjh#jubaubah6jubeubh()r}r(hX`**date-subseconds** just the subseconds of a timestamp (always 0 for a low precision timestamp) h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-subseconds**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXdate-subsecondsrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXKjust the subseconds of a timestamp (always 0 for a low precision timestamp)rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXKjust the subseconds of a timestamp (always 0 for a low precision timestamp)rr}r(hjh#jubaubah6jubeubh()r}r(hXP**date-tzoffshour** just the timezone offset hour part (2-digit) of a timestamp h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-tzoffshour**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXdate-tzoffshourrr }r (hUh#jubah6hYubaubh$)r }r (hUh}r (h]h ]h]h]h!]uh#jh>]rhK)r}r(hX;just the timezone offset hour part (2-digit) of a timestamprh#j h5hh6hNh}r(h]h ]h]h]h!]uh]rhGX;just the timezone offset hour part (2-digit) of a timestamprr}r(hjh#jubaubah6jubeubh()r}r(hX**date-tzoffsmin** just the timezone offset minute part (2-digit) of a timestamp. Note that this is usually 0, but there are some time zones that have offsets which are not hourly-granular. If so, this is the minute offset. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-tzoffsmin**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r }r!(hjh}r"(h]h ]h]h]h!]uh#jh>]r#hGXdate-tzoffsminr$r%}r&(hUh#j ubah6hYubaubh$)r'}r((hUh}r)(h]h ]h]h]h!]uh#jh>]r*hK)r+}r,(hXjust the timezone offset minute part (2-digit) of a timestamp. Note that this is usually 0, but there are some time zones that have offsets which are not hourly-granular. If so, this is the minute offset.r-h#j'h5hh6hNh}r.(h]h ]h]h]h!]uh]r/hGXjust the timezone offset minute part (2-digit) of a timestamp. Note that this is usually 0, but there are some time zones that have offsets which are not hourly-granular. If so, this is the minute offset.r0r1}r2(hj-h#j+ubaubah6jubeubh()r3}r4(hX**date-tzoffsdirection** just the timezone offset direction part of a timestamp. This specifies if the offsets needs to be added ("+") or subtracted ("-") to the timestamp in order to get UTC. h#h,h5hh6j{h}r5(h]h ]h]h]h!]uh]r6(j~)r7}r8(hX**date-tzoffsdirection**r9h#j3h5hh6jh}r:(h]h ]h]h]h!]uh]r;hQ)r<}r=(hj9h}r>(h]h ]h]h]h!]uh#j7h>]r?hGXdate-tzoffsdirectionr@rA}rB(hUh#j<ubah6hYubaubh$)rC}rD(hUh}rE(h]h ]h]h]h!]uh#j3h>]rFhK)rG}rH(hXjust the timezone offset direction part of a timestamp. This specifies if the offsets needs to be added ("+") or subtracted ("-") to the timestamp in order to get UTC.rIh#jCh5hh6hNh}rJ(h]h ]h]h]h!]uh]rKhGXjust the timezone offset direction part of a timestamp. This specifies if the offsets needs to be added ("+") or subtracted ("-") to the timestamp in order to get UTC.rLrM}rN(hjIh#jGubaubah6jubeubh()rO}rP(hXV**date-ordinal** returns the ordinal for the given day, e.g. it is 2 for January, 2nd h#h,h5hh6j{h}rQ(h]h ]h]h]h!]uh]rR(j~)rS}rT(hX**date-ordinal**rUh#jOh5hh6jh}rV(h]h ]h]h]h!]uh]rWhQ)rX}rY(hjUh}rZ(h]h ]h]h]h!]uh#jSh>]r[hGX date-ordinalr\r]}r^(hUh#jXubah6hYubaubh$)r_}r`(hUh}ra(h]h ]h]h]h!]uh#jOh>]rbhK)rc}rd(hXDreturns the ordinal for the given day, e.g. it is 2 for January, 2ndreh#j_h5hh6hNh}rf(h]h ]h]h]h!]uh]rghGXDreturns the ordinal for the given day, e.g. it is 2 for January, 2ndrhri}rj(hjeh#jcubaubah6jubeubh()rk}rl(hX&**date-week** returns the week number h#h,h5hh6j{h}rm(h]h ]h]h]h!]uh]rn(j~)ro}rp(hX **date-week**rqh#jkh5hh6jh}rr(h]h ]h]h]h!]uh]rshQ)rt}ru(hjqh}rv(h]h ]h]h]h!]uh#joh>]rwhGX date-weekrxry}rz(hUh#jtubah6hYubaubh$)r{}r|(hUh}r}(h]h ]h]h]h!]uh#jkh>]r~hK)r}r(hXreturns the week numberrh#j{h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXreturns the week numberrr}r(hjh#jubaubah6jubeubh()r}r(hXy**date-wday** just the weekday number of the timstamp. This is a single digit, with 0=Sunday, 1=Monday, ..., 6=Saturday. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **date-wday**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-wdayrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXjjust the weekday number of the timstamp. This is a single digit, with 0=Sunday, 1=Monday, ..., 6=Saturday.rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXjjust the weekday number of the timstamp. This is a single digit, with 0=Sunday, 1=Monday, ..., 6=Saturday.rr}r(hjh#jubaubah6jubeubh()r}r(hXi**date-wdayname** just the abbreviated english name of the weekday (e.g. "Mon", "Sat") of the timestamp. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**date-wdayname**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX date-wdaynamerr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXVjust the abbreviated english name of the weekday (e.g. "Mon", "Sat") of the timestamp.rh#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXVjust the abbreviated english name of the weekday (e.g. "Mon", "Sat") of the timestamp.rr}r(hjh#jubaubah6jubeubh()r}r(hX**escape-cc** replace control characters (ASCII value 127 and values less then 32) with an escape sequence. The sequence is "#" where charval is the 3-digit decimal value of the control character. For example, a tabulator would be replaced by "#009". Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **escape-cc**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGX escape-ccrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXreplace control characters (ASCII value 127 and values less then 32) with an escape sequence. The sequence is "#" where charval is the 3-digit decimal value of the control character. For example, a tabulator would be replaced by "#009". Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off.h#jh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGXreplace control characters (ASCII value 127 and values less then 32) with an escape sequence. The sequence is "#" where charval is the 3-digit decimal value of the control character. For example, a tabulator would be replaced by "#009". Note: using this option requires that rr}r(hXreplace control characters (ASCII value 127 and values less then 32) with an escape sequence. The sequence is "#" where charval is the 3-digit decimal value of the control character. For example, a tabulator would be replaced by "#009". Note: using this option requires that h#jubh)r}r(hXT`$EscapeControlCharactersOnReceive `_h}r(UnameX!$EscapeControlCharactersOnReceivehX-rsconf1_escapecontrolcharactersonreceive.htmlrh]h]h]h ]h!]uh#jh>]rhGX!$EscapeControlCharactersOnReceiverr}r(hUh#jubah6hubh)r}r(hX0 hKh#jh6hh}r(Urefurijh]rU escapecontrolcharactersonreceiverah]h]h ]h!]rhauh>]ubhGX is set to off.rr}r(hX is set to off.h#jubeubah6jubeubh)h()r}r(hX/**drop-cc** drop control characters - the resulting string will neither contain control characters, escape sequences nor any other replacement character like space. Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off. h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **drop-cc**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXdrop-ccrr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hX"drop control characters - the resulting string will neither contain control characters, escape sequences nor any other replacement character like space. Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off.h#jh5hh6hNh}r(h]h ]h]h]h!]uh]r(hGXdrop control characters - the resulting string will neither contain control characters, escape sequences nor any other replacement character like space. Note: using this option requires that rr}r(hXdrop control characters - the resulting string will neither contain control characters, escape sequences nor any other replacement character like space. Note: using this option requires that h#jubh)r}r(hXT`$EscapeControlCharactersOnReceive `_h}r(UnameX!$EscapeControlCharactersOnReceivehX-rsconf1_escapecontrolcharactersonreceive.htmlr h]h]h]h ]h!]uh#jh>]r hGX!$EscapeControlCharactersOnReceiver r }r (hUh#jubah6hubh)r}r(hX0 hKh#jh6hh}r(Urefurij h]rUid2rah]h]rX!$escapecontrolcharactersonreceiverah ]h!]uh>]ubhGX is set to off.rr}r(hX is set to off.h#jubeubah6jubeubh()r}r(hXJ**compressspace** compresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the **FromChar** and **ToChar** positions are **NOT** affected by this option. (available since v8.18.0) h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**compressspace**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]r hQ)r!}r"(hjh}r#(h]h ]h]h]h!]uh#jh>]r$hGX compressspacer%r&}r'(hUh#j!ubah6hYubaubh$)r(}r)(hUh}r*(h]h ]h]h]h!]uh#jh>]r+hK)r,}r-(hX7compresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the **FromChar** and **ToChar** positions are **NOT** affected by this option. (available since v8.18.0)h#j(h5hh6hNh}r.(h]h ]h]h]h!]uh]r/(hGXcompresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the r0r1}r2(hXcompresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the h#j,ubhQ)r3}r4(hX **FromChar**h}r5(h]h ]h]h]h!]uh#j,h>]r6hGXFromCharr7r8}r9(hUh#j3ubah6hYubhGX and r:r;}r<(hX and h#j,ubhQ)r=}r>(hX **ToChar**h}r?(h]h ]h]h]h!]uh#j,h>]r@hGXToCharrArB}rC(hUh#j=ubah6hYubhGX positions are rDrE}rF(hX positions are h#j,ubhQ)rG}rH(hX**NOT**h}rI(h]h ]h]h]h!]uh#j,h>]rJhGXNOTrKrL}rM(hUh#jGubah6hYubhGX3 affected by this option. (available since v8.18.0)rNrO}rP(hX3 affected by this option. (available since v8.18.0)h#j,ubeubah6jubeubh()rQ}rR(hX**sp-if-no-1st-sp** This option looks scary and should probably not be used by a user. For any field given, it returns either a single space character or no character at all. Field content is never returned. A space is returned if (and only if) the first character of the field's content is NOT a space. This option is kind of a hack to solve a problem rooted in RFC 3164: 3164 specifies no delimiter between the syslog tag sequence and the actual message text. Almost all implementation in fact delimit the two by a space. As of RFC 3164, this space is part of the message text itself. This leads to a problem when building the message (e.g. when writing to disk or forwarding). Should a delimiting space be included if the message does not start with one? If not, the tag is immediately followed by another non-space character, which can lead some log parsers to misinterpret what is the tag and what the message. The problem finally surfaced when the klog module was restructured and the tag correctly written. It exists with other message sources, too. The solution was the introduction of this special property replacer option. Now, the default template can contain a conditional space, which exists only if the message does not start with one. While this does not solve all issues, it should work good enough in the far majority of all cases. If you read this text and have no idea of what it is talking about - relax: this is a good indication you will never need this option. Simply forget about it ;) h#h,h5hh6j{h}rS(h]h ]h]h]h!]uh]rT(j~)rU}rV(hX**sp-if-no-1st-sp**rWh#jQh5hh6jh}rX(h]h ]h]h]h!]uh]rYhQ)rZ}r[(hjWh}r\(h]h ]h]h]h!]uh#jUh>]r]hGXsp-if-no-1st-spr^r_}r`(hUh#jZubah6hYubaubh$)ra}rb(hUh}rc(h]h ]h]h]h!]uh#jQh>]rdhK)re}rf(hXThis option looks scary and should probably not be used by a user. For any field given, it returns either a single space character or no character at all. Field content is never returned. A space is returned if (and only if) the first character of the field's content is NOT a space. This option is kind of a hack to solve a problem rooted in RFC 3164: 3164 specifies no delimiter between the syslog tag sequence and the actual message text. Almost all implementation in fact delimit the two by a space. As of RFC 3164, this space is part of the message text itself. This leads to a problem when building the message (e.g. when writing to disk or forwarding). Should a delimiting space be included if the message does not start with one? If not, the tag is immediately followed by another non-space character, which can lead some log parsers to misinterpret what is the tag and what the message. The problem finally surfaced when the klog module was restructured and the tag correctly written. It exists with other message sources, too. The solution was the introduction of this special property replacer option. Now, the default template can contain a conditional space, which exists only if the message does not start with one. While this does not solve all issues, it should work good enough in the far majority of all cases. If you read this text and have no idea of what it is talking about - relax: this is a good indication you will never need this option. Simply forget about it ;)rgh#jah5hh6hNh}rh(h]h ]h]h]h!]uh]rihGXThis option looks scary and should probably not be used by a user. For any field given, it returns either a single space character or no character at all. Field content is never returned. A space is returned if (and only if) the first character of the field's content is NOT a space. This option is kind of a hack to solve a problem rooted in RFC 3164: 3164 specifies no delimiter between the syslog tag sequence and the actual message text. Almost all implementation in fact delimit the two by a space. As of RFC 3164, this space is part of the message text itself. This leads to a problem when building the message (e.g. when writing to disk or forwarding). Should a delimiting space be included if the message does not start with one? If not, the tag is immediately followed by another non-space character, which can lead some log parsers to misinterpret what is the tag and what the message. The problem finally surfaced when the klog module was restructured and the tag correctly written. It exists with other message sources, too. The solution was the introduction of this special property replacer option. Now, the default template can contain a conditional space, which exists only if the message does not start with one. While this does not solve all issues, it should work good enough in the far majority of all cases. If you read this text and have no idea of what it is talking about - relax: this is a good indication you will never need this option. Simply forget about it ;)rjrk}rl(hjgh#jeubaubah6jubeubh()rm}rn(hX**secpath-drop** Drops slashes inside the field (e.g. "a/b" becomes "ab"). Useful for secure pathname generation (with dynafiles). h#h,h5hh6j{h}ro(h]h ]h]h]h!]uh]rp(j~)rq}rr(hX**secpath-drop**rsh#jmh5hh6jh}rt(h]h ]h]h]h!]uh]ruhQ)rv}rw(hjsh}rx(h]h ]h]h]h!]uh#jqh>]ryhGX secpath-droprzr{}r|(hUh#jvubah6hYubaubh$)r}}r~(hUh}r(h]h ]h]h]h!]uh#jmh>]rhK)r}r(hXqDrops slashes inside the field (e.g. "a/b" becomes "ab"). Useful for secure pathname generation (with dynafiles).rh#j}h5hh6hNh}r(h]h ]h]h]h!]uh]rhGXqDrops slashes inside the field (e.g. "a/b" becomes "ab"). Useful for secure pathname generation (with dynafiles).rr}r(hjh#jubaubah6jubeubh()r}r(hX**secpath-replace** Replace slashes inside the field by an underscore. (e.g. "a/b" becomes "a\_b"). Useful for secure pathname generation (with dynafiles). h#h,h5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX**secpath-replace**rh#jh5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXsecpath-replacerr}r(hUh#jubah6hYubaubh$)r}r(hUh}r(h]h ]h]h]h!]uh#jh>]rhK)r}r(hXReplace slashes inside the field by an underscore. (e.g. "a/b" becomes "a\_b"). Useful for secure pathname generation (with dynafiles).h#jh5hh6hNh}r(h]h ]h]h]h!]uh]rhGXReplace slashes inside the field by an underscore. (e.g. "a/b" becomes "a_b"). Useful for secure pathname generation (with dynafiles).rr}r(hXReplace slashes inside the field by an underscore. (e.g. "a/b" becomes "a\_b"). Useful for secure pathname generation (with dynafiles).h#jubaubah6jubeubeubh5hh6j{h}r(h]h ]h]h]h!]uh]r(j~)r}r(hX **space-cc**rh#h)h5hh6jh}r(h]h ]h]h]h!]uh]rhQ)r}r(hjh}r(h]h ]h]h]h!]uh#jh>]rhGXspace-ccrr}r(hUh#jubah6hYubaubh%eubh>]rhK)r}r(hXreplace control characters by spaces Note: using this option requires that `$EscapeControlCharactersOnReceive `_ is set to off.h#h%h5hh6hNh}r(h]h ]h]h]h!]uh]r(hGXKreplace control characters by spaces Note: using this option requires that rr}r(hXKreplace control characters by spaces Note: using this option requires that h#jubh)r}r(hXT`$EscapeControlCharactersOnReceive `_h}r(UnameX!$EscapeControlCharactersOnReceivehX-rsconf1_escapecontrolcharactersonreceive.htmlrh]h]h]h ]h!]uh#jh>]rhGX!$EscapeControlCharactersOnReceiverr}r(hUh#jubah6hubh)r}r(hX0 hKh#jh6hh}r(Urefurijh]rhah]h]rX!$escapecontrolcharactersonreceiverah ]h!]uh>]ubhGX is set to off.rr}r(hX is set to off.h#jubeubah6jubh>]rhK)r}r(hXDDuplicate explicit target name: "$escapecontrolcharactersonreceive".h}r(h]h ]h]h]h!]uh#hh>]rhGXDDuplicate explicit target name: "$escapecontrolcharactersonreceive".rr}r(hUh#jubah6hNubah6Usystem_messagerubh)r}r(hUh}r(h]UlevelKh]h]rjaUsourcehh ]h!]UlineKUtypeh"uh#jh>]rhK)r}r(hXDDuplicate explicit target name: "$escapecontrolcharactersonreceive".h}r(h]h ]h]h]h!]uh#jh>]rhGXDDuplicate explicit target name: "$escapecontrolcharactersonreceive".rr}r(hUh#jubah6hNubah6jubeUcurrent_sourcerNU decorationrNUautofootnote_startrKUnameidsr}r(hjRhhhj(h jUh hkh hh h:h jhjhjuh>]rh3ahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh=hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksr Uentryr U language_coder Uenr U datestampr NU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhDNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorr NUcloak_email_addressesr!Utrim_footnote_reference_spacer"Uenvr#NUdump_pseudo_xmlr$NUexpose_internalsr%NUsectsubtitle_xformr&U source_linkr'NUrfc_referencesr(NUoutput_encodingr)Uutf-8r*U source_urlr+NUinput_encodingr,U utf-8-sigr-U_disable_configr.NU id_prefixr/UU tab_widthr0KUerror_encodingr1UUTF-8r2U_sourcer3hUgettext_compactr4U generatorr5NUdump_internalsr6NU smart_quotesr7U pep_base_urlr8U https://www.python.org/dev/peps/r9Usyntax_highlightr:Ulongr;Uinput_encoding_error_handlerr<jUauto_id_prefixr=Uidr>Udoctitle_xformr?Ustrip_elements_with_classesr@NU _config_filesrA]Ufile_insertion_enabledrBU raw_enabledrCKU dump_settingsrDNubUsymbol_footnote_startrEKUidsrF}rG(j(j$hhjRjNjjhjjhjjhh1jUh/hkhgh:h3jjuUsubstitution_namesrH}rIh6h=h}rJ(h]h]h]Usourcehh ]h!]uU footnotesrK]rLUrefidsrM}rNub.build/.doctrees/configuration/config_param_types.doctree0000664000175000017500000002427713035122641022625 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXconfiguration parameter typesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUconfiguration-parameter-typesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXG/home/rger/proj/rsyslog-doc/source/configuration/config_param_types.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXConfiguration Parameter Typesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XConfiguration Parameter Typesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXConfiguration parameter values have different data types. Unfortunately, the type currently must be guessed from the description (consider contributing to the doc to help improve it). In general, the following types are used:q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XConfiguration parameter values have different data types. Unfortunately, the type currently must be guessed from the description (consider contributing to the doc to help improve it). In general, the following types are used:q:q;}q<(hh6hh4ubaubcdocutils.nodes bullet_list q=)q>}q?(hUhhhhhU bullet_listq@h}qA(UbulletqBX-h!]h ]h]h]h#]uh%Kh&hh]qC(cdocutils.nodes list_item qD)qE}qF(hX)**numbers** The traditional integer format. Numbers may include '.' and ',' for readability. So you can for example specify either "1000" or "1,000" with the same result. Please note that rsyslogd simply *ignores* the punctuation. From it's point of view, "1,,0.0.,.,0" also has the value 1000. hh>hhhU list_itemqGh}qH(h]h]h ]h!]h#]uh%Nh&hh]qI(h3)qJ}qK(hX **numbers**qLhhEhhhh7h}qM(h]h]h ]h!]h#]uh%Kh]qNcdocutils.nodes strong qO)qP}qQ(hhLh}qR(h]h]h ]h!]h#]uhhJh]qSh/XnumbersqTqU}qV(hUhhPubahUstrongqWubaubh3)qX}qY(hXThe traditional integer format. Numbers may include '.' and ',' for readability. So you can for example specify either "1000" or "1,000" with the same result. Please note that rsyslogd simply *ignores* the punctuation. From it's point of view, "1,,0.0.,.,0" also has the value 1000.hhEhhhh7h}qZ(h]h]h ]h!]h#]uh%K h]q[(h/XThe traditional integer format. Numbers may include '.' and ',' for readability. So you can for example specify either "1000" or "1,000" with the same result. Please note that rsyslogd simply q\q]}q^(hXThe traditional integer format. Numbers may include '.' and ',' for readability. So you can for example specify either "1000" or "1,000" with the same result. Please note that rsyslogd simply hhXubcdocutils.nodes emphasis q_)q`}qa(hX *ignores*h}qb(h]h]h ]h!]h#]uhhXh]qch/Xignoresqdqe}qf(hUhh`ubahUemphasisqgubh/XQ the punctuation. From it's point of view, "1,,0.0.,.,0" also has the value 1000.qhqi}qj(hXQ the punctuation. From it's point of view, "1,,0.0.,.,0" also has the value 1000.hhXubeubeubhD)qk}ql(hX**sizes** Used for things like file size, main message queue sizes and the like. These are integers, but support modifier after the number part. For example, 1k means 1024. Supported are k(ilo), m(ega), g(iga), t(era), p(eta) and e(xa). Lower case letters refer to the traditional binary defintion (e.g. 1m equals 1,048,576) whereas upper case letters refer to their new 1000-based definition (e.g 1M equals 1,000,000). hh>hhhhGh}qm(h]h]h ]h!]h#]uh%Nh&hh]qn(h3)qo}qp(hX **sizes**qqhhkhhhh7h}qr(h]h]h ]h!]h#]uh%Kh]qshO)qt}qu(hhqh}qv(h]h]h ]h!]h#]uhhoh]qwh/Xsizesqxqy}qz(hUhhtubahhWubaubh3)q{}q|(hXUsed for things like file size, main message queue sizes and the like. These are integers, but support modifier after the number part. For example, 1k means 1024. Supported are k(ilo), m(ega), g(iga), t(era), p(eta) and e(xa). Lower case letters refer to the traditional binary defintion (e.g. 1m equals 1,048,576) whereas upper case letters refer to their new 1000-based definition (e.g 1M equals 1,000,000).q}hhkhhhh7h}q~(h]h]h ]h!]h#]uh%Kh]qh/XUsed for things like file size, main message queue sizes and the like. These are integers, but support modifier after the number part. For example, 1k means 1024. Supported are k(ilo), m(ega), g(iga), t(era), p(eta) and e(xa). Lower case letters refer to the traditional binary defintion (e.g. 1m equals 1,048,576) whereas upper case letters refer to their new 1000-based definition (e.g 1M equals 1,000,000).qq}q(hh}hh{ubaubeubhD)q}q(hX**complete line** A string consisting of multiple characters. This is relatively seldom used and sometimes looks confusing (rsyslog v7+ has a much better approach at these types of values). hh>hhhhGh}q(h]h]h ]h!]h#]uh%Nh&hh]q(h3)q}q(hX**complete line**qhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]qhO)q}q(hhh}q(h]h]h ]h!]h#]uhhh]qh/X complete lineqq}q(hUhhubahhWubaubh3)q}q(hXA string consisting of multiple characters. This is relatively seldom used and sometimes looks confusing (rsyslog v7+ has a much better approach at these types of values).qhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]qh/XA string consisting of multiple characters. This is relatively seldom used and sometimes looks confusing (rsyslog v7+ has a much better approach at these types of values).qq}q(hhhhubaubeubhD)q}q(hX**single word** This is used when only a single word can be provided. A "single word" is a string without spaces in it. **No** quoting is necessary nor permitted (the quotes would become part of the word). hh>hhhhGh}q(h]h]h ]h!]h#]uh%Nh&hh]q(h3)q}q(hX**single word**qhhhhhh7h}q(h]h]h ]h!]h#]uh%K h]qhO)q}q(hhh}q(h]h]h ]h!]h#]uhhh]qh/X single wordqq}q(hUhhubahhWubaubh3)q}q(hXThis is used when only a single word can be provided. A "single word" is a string without spaces in it. **No** quoting is necessary nor permitted (the quotes would become part of the word).hhhhhh7h}q(h]h]h ]h!]h#]uh%K"h]q(h/XhThis is used when only a single word can be provided. A "single word" is a string without spaces in it. qq}q(hXhThis is used when only a single word can be provided. A "single word" is a string without spaces in it. hhubhO)q}q(hX**No**h}q(h]h]h ]h!]h#]uhhh]qh/XNoqq}q(hUhhubahhWubh/XO quoting is necessary nor permitted (the quotes would become part of the word).qq}q(hXO quoting is necessary nor permitted (the quotes would become part of the word).hhubeubeubhD)q}q(hXG**character** A single (printable) character. Must **not** be quoted. hh>hhhhGh}q(h]h]h ]h!]h#]uh%Nh&hh]q(h3)q}q(hX **character**qhhhhhh7h}q(h]h]h ]h!]h#]uh%K&h]qhO)q}q(hhh}q(h]h]h ]h!]h#]uhhh]qh/X characterqɅq}q(hUhhubahhWubaubh3)q}q(hX7A single (printable) character. Must **not** be quoted.hhhhhh7h}q(h]h]h ]h!]h#]uh%K(h]q(h/X%A single (printable) character. Must qЅq}q(hX%A single (printable) character. Must hhubhO)q}q(hX**not**h}q(h]h]h ]h!]h#]uhhh]qh/Xnotqׅq}q(hUhhubahhWubh/X be quoted.qڅq}q(hX be quoted.hhubeubeubhD)q}q(hXO**boolean** The traditional boolean type, specified as "on" (1) or "off" (0). hh>hhhhGh}q(h]h]h ]h!]h#]uh%Nh&hh]q(h3)q}q(hX **boolean**qhhhhhh7h}q(h]h]h ]h!]h#]uh%K*h]qhO)q}q(hhh}q(h]h]h ]h!]h#]uhhh]qh/Xbooleanqꅁq}q(hUhhubahhWubaubh3)q}q(hXAThe traditional boolean type, specified as "on" (1) or "off" (0).qhhhhhh7h}q(h]h]h ]h!]h#]uh%K,h]qh/XAThe traditional boolean type, specified as "on" (1) or "off" (0).qq}q(hhhhubaubeubeubh3)q}q(hXNote that some other value types are occasionally used. However, the majority of types is one of those listed above. The list is updated as need arises and time permits.qhhhhhh7h}q(h]h]h ]h!]h#]uh%K.h&hh]qh/XNote that some other value types are occasionally used. However, the majority of types is one of those listed above. The list is updated as need arises and time permits.qq}q(hhhhubaubeubahUU transformerqNU footnote_refsq}qUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]r h&hU current_liner NUtransform_messagesr ]r Ureporterr NUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksr Uentryr!U language_coder"Uenr#U datestampr$NU report_levelr%KU _destinationr&NU halt_levelr'KU strip_classesr(Nh,NUerror_encoding_error_handlerr)Ubackslashreplacer*Udebugr+NUembed_stylesheetr,Uoutput_encoding_error_handlerr-Ustrictr.U sectnum_xformr/KUdump_transformsr0NU docinfo_xformr1KUwarning_streamr2NUpep_file_url_templater3Upep-%04dr4Uexit_status_levelr5KUconfigr6NUstrict_visitorr7NUcloak_email_addressesr8Utrim_footnote_reference_spacer9Uenvr:NUdump_pseudo_xmlr;NUexpose_internalsr<NUsectsubtitle_xformr=U source_linkr>NUrfc_referencesr?NUoutput_encodingr@Uutf-8rAU source_urlrBNUinput_encodingrCU utf-8-sigrDU_disable_configrENU id_prefixrFUU tab_widthrGKUerror_encodingrHUUTF-8rIU_sourcerJhUgettext_compactrKU generatorrLNUdump_internalsrMNU smart_quotesrNU pep_base_urlrOU https://www.python.org/dev/peps/rPUsyntax_highlightrQUlongrRUinput_encoding_error_handlerrSj.Uauto_id_prefixrTUidrUUdoctitle_xformrVUstrip_elements_with_classesrWNU _config_filesrX]Ufile_insertion_enabledrYU raw_enabledrZKU dump_settingsr[NubUsymbol_footnote_startr\KUidsr]}r^hhsUsubstitution_namesr_}r`hh&h}ra(h]h!]h ]Usourcehh]h#]uU footnotesrb]rcUrefidsrd}reub.build/.doctrees/configuration/examples.doctree0000664000175000017500000006536013035122641020570 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X templatesqNXselector linesqNXrainer gerhardsqXadisconq X winsyslogq Xexamplesq NXrsyslogq uUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU templatesqhUselector-linesqhUrainer-gerhardsqh Uadisconqh U winsyslogqh Uexamplesqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$X=/home/rger/proj/rsyslog-doc/source/configuration/examples.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0h auUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"XExamplesq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;XExamplesq(h"h7h#h5ubaubcdocutils.nodes paragraph q?)q@}qA(h"XUBelow are example for templates and selector lines. I hope they are self-explanatory.qBh#h h$h%h&U paragraphqCh(}qD(h*]h+]h,]h-]h/]uh1Kh2hh]qEh;XUBelow are example for templates and selector lines. I hope they are self-explanatory.qFqG}qH(h"hBh#h@ubaubh)qI}qJ(h"Uh#h h$h%h&h'h(}qK(h*]h+]h,]h-]qLhah/]qMhauh1Kh2hh]qN(h4)qO}qP(h"X TemplatesqQh#hIh$h%h&h8h(}qR(h*]h+]h,]h-]h/]uh1Kh2hh]qSh;X TemplatesqTqU}qV(h"hQh#hOubaubh?)qW}qX(h"XzPlease note that the samples are split across multiple lines. A template MUST NOT actually be split across multiple lines.qYh#hIh$h%h&hCh(}qZ(h*]h+]h,]h-]h/]uh1K h2hh]q[h;XzPlease note that the samples are split across multiple lines. A template MUST NOT actually be split across multiple lines.q\q]}q^(h"hYh#hWubaubcdocutils.nodes definition_list q_)q`}qa(h"Uh#hIh$h%h&Udefinition_listqbh(}qc(h*]h+]h,]h-]h/]uh1Nh2hh]qd(cdocutils.nodes definition_list_item qe)qf}qg(h"XA template that resembles traditional syslogd file output: $template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\\n" h#h`h$h%h&Udefinition_list_itemqhh(}qi(h*]h+]h,]h-]h/]uh1Kh]qj(cdocutils.nodes term qk)ql}qm(h"X:A template that resembles traditional syslogd file output:qnh#hfh$h%h&Utermqoh(}qp(h*]h+]h,]h-]h/]uh1Kh]qqh;X:A template that resembles traditional syslogd file output:qrqs}qt(h"hnh#hlubaubcdocutils.nodes definition qu)qv}qw(h"Uh(}qx(h*]h+]h,]h-]h/]uh#hfh]qyh?)qz}q{(h"X[$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\\n"h#hvh$h%h&hCh(}q|(h*]h+]h,]h-]h/]uh1Kh]q}h;XZ$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"q~q}q(h"X[$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\\n"h#hzubaubah&U definitionqubeubhe)q}q(h"XA template that tells you a little more about the message: $template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%, %syslogtag%,%msg%\\n" h#h`h$h%h&hhh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(hk)q}q(h"X:A template that tells you a little more about the message:qh#hh$h%h&hoh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X:A template that tells you a little more about the message:qq}q(h"hh#hubaubhu)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"Xf$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%, %syslogtag%,%msg%\\n"h#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;Xe$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%, %syslogtag%,%msg%\n"qq}q(h"Xf$template precise,"%syslogpriority%,%syslogfacility%,%timegenerated%,%HOSTNAME%, %syslogtag%,%msg%\\n"h#hubaubah&hubeubhe)q}q(h"XfA template for RFC 3164 format: $template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%" h#h`h$h%h&hhh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(hk)q}q(h"XA template for RFC 3164 format:qh#hh$h%h&hoh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;XA template for RFC 3164 format:qq}q(h"hh#hubaubhu)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"XE$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"qh#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;XE$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"qq}q(h"hh#hubaubah&hubeubhe)q}q(h"XoA template for the format traditonally used for user messages: $template usermsg," XXXX%syslogtag%%msg%\\n\\r" h#h`h$h%h&hhh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(hk)q}q(h"X>A template for the format traditonally used for user messages:qh#hh$h%h&hoh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X>A template for the format traditonally used for user messages:qq}q(h"hh#hubaubhu)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"X/$template usermsg," XXXX%syslogtag%%msg%\\n\\r"h#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X-$template usermsg," XXXX%syslogtag%%msg%\n\r"qŅq}q(h"X/$template usermsg," XXXX%syslogtag%%msg%\\n\\r"h#hubaubah&hubeubhe)q}q(h"XAnd a template with the traditonal wall-message format: $template wallmsg,"\\r\\n\\7Message from syslogd@%HOSTNAME% at %timegenerated% h#h`h$h%h&hhh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(hk)q}q(h"X7And a template with the traditonal wall-message format:qh#hh$h%h&hoh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X7And a template with the traditonal wall-message format:qхq}q(h"hh#hubaubhu)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"XN$template wallmsg,"\\r\\n\\7Message from syslogd@%HOSTNAME% at %timegenerated%h#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;XK$template wallmsg,"\r\n\7Message from syslogd@%HOSTNAME% at %timegenerated%q܅q}q(h"XN$template wallmsg,"\\r\\n\\7Message from syslogd@%HOSTNAME% at %timegenerated%h#hubaubah&hubeubhe)q}q(h"XA template that can be used for the database write (please note the SQL template option) $template MySQLInsert,"insert iut, message, receivedat values ('%iut%', '%msg:::UPPERCASE%', '%timegenerated:::date-mysql%') into systemevents\\r\\n", SQL h#h`h$h%h&hhh(}q(h*]h+]h,]h-]h/]uh1K!h2hh]q(hk)q}q(h"XXA template that can be used for the database write (please note the SQL template option)qh#hh$h%h&hoh(}q(h*]h+]h,]h-]h/]uh1K!h]qh;XXA template that can be used for the database write (please note the SQL template option)q腁q}q(h"hh#hubaubhu)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"X$template MySQLInsert,"insert iut, message, receivedat values ('%iut%', '%msg:::UPPERCASE%', '%timegenerated:::date-mysql%') into systemevents\\r\\n", SQLh#hh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1Kh]qh;X$template MySQLInsert,"insert iut, message, receivedat values ('%iut%', '%msg:::UPPERCASE%', '%timegenerated:::date-mysql%') into systemevents\r\n", SQLqq}q(h"X$template MySQLInsert,"insert iut, message, receivedat values ('%iut%', '%msg:::UPPERCASE%', '%timegenerated:::date-mysql%') into systemevents\\r\\n", SQLh#hubaubah&hubeubeubh?)q}q(h"XvThe following template emulates `WinSyslog `_ format (it's an `Adiscon`_ format, you do not feel bad if you don't know it ;)). It's interesting to see how it takes different parts out of the date stamps. What happens is that the date stamp is split into the actual date and time and the these two are combined with just a comma in between them.h#hIh$h%h&hCh(}q(h*]h+]h,]h-]h/]uh1K#h2hh]q(h;X The following template emulates qq}q(h"X The following template emulates h#hubcdocutils.nodes reference q)q}q(h"X+`WinSyslog `_h(}r(UnameX WinSyslogUrefurirXhttp://www.winsyslog.com/en/rh-]h,]h*]h+]h/]uh#hh]rh;X WinSyslogrr}r(h"Uh#hubah&U referencerubcdocutils.nodes target r)r }r (h"X U referencedr Kh#hh&Utargetr h(}r (Urefurijh-]rhah,]h*]h+]h/]rh auh]ubh;X format (it's an rr}r(h"X format (it's an h#hubh)r}r(h"X `Adiscon`_UresolvedrKh#hh&jh(}r(UnameXAdisconjXhttp://www.adiscon.com/rh-]h,]h*]h+]h/]uh]rh;XAdisconrr}r(h"Uh#jubaubh;X format, you do not feel bad if you don't know it ;)). It's interesting to see how it takes different parts out of the date stamps. What happens is that the date stamp is split into the actual date and time and the these two are combined with just a comma in between them.rr}r(h"X format, you do not feel bad if you don't know it ;)). It's interesting to see how it takes different parts out of the date stamps. What happens is that the date stamp is split into the actual date and time and the these two are combined with just a comma in between them.h#hubeubcdocutils.nodes literal_block r)r }r!(h"X$template WinSyslogFmt,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%, %timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339%, %timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%, %syslogtag%%msg%\\n"h#hIh$h%h&U literal_blockr"h(}r#(U xml:spacer$Upreserver%h-]h,]h*]h+]h/]uh1K-h2hh]r&h;X$template WinSyslogFmt,"%HOSTNAME%,%timegenerated:1:10:date-rfc3339%, %timegenerated:12:19:date-rfc3339%,%timegenerated:1:10:date-rfc3339%, %timegenerated:12:19:date-rfc3339%,%syslogfacility%,%syslogpriority%, %syslogtag%%msg%\\n"r'r(}r)(h"Uh#j ubaubeubh)r*}r+(h"Uh#h h$h%h&h'h(}r,(h*]h+]h,]h-]r-hah/]r.hauh1K3h2hh]r/(h4)r0}r1(h"XSelector linesr2h#j*h$h%h&h8h(}r3(h*]h+]h,]h-]h/]uh1K3h2hh]r4h;XSelector linesr5r6}r7(h"j2h#j0ubaubj)r8}r9(h"XH# Store critical stuff in critical # *.=crit;kern.none /var/adm/criticalh#j*h$h%h&j"h(}r:(j$j%h-]h,]h*]h+]h/]uh1K7h2hh]r;h;XH# Store critical stuff in critical # *.=crit;kern.none /var/adm/criticalr<r=}r>(h"Uh#j8ubaubh?)r?}r@(h"XqThis will store all messages with the priority crit in the file /var/adm/critical, except for any kernel message.rAh#j*h$h%h&hCh(}rB(h*]h+]h,]h-]h/]uh1K;h2hh]rCh;XqThis will store all messages with the priority crit in the file /var/adm/critical, except for any kernel message.rDrE}rF(h"jAh#j?ubaubj)rG}rH(h"X|# Kernel messages are first, stored in the kernel # file, critical messages and higher ones also go # to another host and to the console. Messages to # the host server.example.net are forwarded in RFC 3164 # format (using the template defined above). # kern.* /var/adm/kernel kern.crit @server.example.net;RFC3164fmt kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-infoh#j*h$h%h&j"h(}rI(j$j%h-]h,]h*]h+]h/]uh1K@h2hh]rJh;X|# Kernel messages are first, stored in the kernel # file, critical messages and higher ones also go # to another host and to the console. Messages to # the host server.example.net are forwarded in RFC 3164 # format (using the template defined above). # kern.* /var/adm/kernel kern.crit @server.example.net;RFC3164fmt kern.crit /dev/console kern.info;kern.!err /var/adm/kernel-inforKrL}rM(h"Uh#jGubaubh?)rN}rO(h"X[The first rule direct any message that has the kernel facility to the file /var/adm/kernel.rPh#j*h$h%h&hCh(}rQ(h*]h+]h,]h-]h/]uh1KKh2hh]rRh;X[The first rule direct any message that has the kernel facility to the file /var/adm/kernel.rSrT}rU(h"jPh#jNubaubh?)rV}rW(h"XUThe second statement directs all kernel messages of the priority crit and higher to the remote host server.example.net. This is useful, because if the host crashes and the disks get irreparable errors you might not be able to read the stored messages. If they're on a remote host, too, you still can try to find out the reason for the crash.rXh#j*h$h%h&hCh(}rY(h*]h+]h,]h-]h/]uh1KNh2hh]rZh;XUThe second statement directs all kernel messages of the priority crit and higher to the remote host server.example.net. This is useful, because if the host crashes and the disks get irreparable errors you might not be able to read the stored messages. If they're on a remote host, too, you still can try to find out the reason for the crash.r[r\}r](h"jXh#jVubaubh?)r^}r_(h"XwThe third rule directs these messages to the actual console, so the person who works on the machine will get them, too.r`h#j*h$h%h&hCh(}ra(h*]h+]h,]h-]h/]uh1KTh2hh]rbh;XwThe third rule directs these messages to the actual console, so the person who works on the machine will get them, too.rcrd}re(h"j`h#j^ubaubh?)rf}rg(h"XThe fourth line tells rsyslogd to save all kernel messages that come with priorities from info up to warning in the file /var/adm/kernel-info. Everything from err and higher is excluded.rhh#j*h$h%h&hCh(}ri(h*]h+]h,]h-]h/]uh1KWh2hh]rjh;XThe fourth line tells rsyslogd to save all kernel messages that come with priorities from info up to warning in the file /var/adm/kernel-info. Everything from err and higher is excluded.rkrl}rm(h"jhh#jfubaubj)rn}ro(h"Xi# The tcp wrapper loggs with mail.info, we display # all the connections on tty12 # mail.=info /dev/tty12h#j*h$h%h&j"h(}rp(j$j%h-]h,]h*]h+]h/]uh1K]h2hh]rqh;Xi# The tcp wrapper loggs with mail.info, we display # all the connections on tty12 # mail.=info /dev/tty12rrrs}rt(h"Uh#jnubaubh?)ru}rv(h"XThis directs all messages that uses mail.info (in source LOG\_MAIL \| LOG\_INFO) to /dev/tty12, the 12th console. For example the tcpwrapper tcpd(8) uses this as it's default.h#j*h$h%h&hCh(}rw(h*]h+]h,]h-]h/]uh1Kbh2hh]rxh;XThis directs all messages that uses mail.info (in source LOG_MAIL | LOG_INFO) to /dev/tty12, the 12th console. For example the tcpwrapper tcpd(8) uses this as it's default.ryrz}r{(h"XThis directs all messages that uses mail.info (in source LOG\_MAIL \| LOG\_INFO) to /dev/tty12, the 12th console. For example the tcpwrapper tcpd(8) uses this as it's default.h#juubaubj)r|}r}(h"XO# Store all mail concerning stuff in a file # mail.\*;mail.!=info /var/adm/mailh#j*h$h%h&j"h(}r~(j$j%h-]h,]h*]h+]h/]uh1Khh2hh]rh;XO# Store all mail concerning stuff in a file # mail.\*;mail.!=info /var/adm/mailrr}r(h"Uh#j|ubaubh?)r}r(h"XThis pattern matches all messages that come with the mail facility, except for the info priority. These will be stored in the file /var/adm/mail.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Klh2hh]rh;XThis pattern matches all messages that come with the mail facility, except for the info priority. These will be stored in the file /var/adm/mail.rr}r(h"jh#jubaubj)r}r(h"XR# Log all mail.info and news.info messages to info # mail,news.=info /var/adm/infoh#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Krh2hh]rh;XR# Log all mail.info and news.info messages to info # mail,news.=info /var/adm/inforr}r(h"Uh#jubaubh?)r}r(h"XzThis will extract all messages that come either with mail.info or with news.info and store them in the file /var/adm/info.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kvh2hh]rh;XzThis will extract all messages that come either with mail.info or with news.info and store them in the file /var/adm/info.rr}r(h"jh#jubaubj)r}r(h"Xa# Log info and notice messages to messages file # *.=info;*.=notice;\ mail.none /var/log/messagesh#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1K{h2hh]rh;Xa# Log info and notice messages to messages file # *.=info;*.=notice;\ mail.none /var/log/messagesrr}r(h"Uh#jubaubh?)r}r(h"XThis lets rsyslogd log all messages that come with either the info or the notice facility into the file /var/log/messages, except for all messages that use the mail facility.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XThis lets rsyslogd log all messages that come with either the info or the notice facility into the file /var/log/messages, except for all messages that use the mail facility.rr}r(h"jh#jubaubj)r}r(h"XQ# Log info messages to messages file # *.=info;\ mail,news.none /var/log/messagesh#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;XQ# Log info messages to messages file # *.=info;\ mail,news.none /var/log/messagesrr}r(h"Uh#jubaubh?)r}r(h"XThis statement causes rsyslogd to log all messages that come with the info priority to the file /var/log/messages. But any message coming either with the mail or the news facility will not be stored.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XThis statement causes rsyslogd to log all messages that come with the info priority to the file /var/log/messages. But any message coming either with the mail or the news facility will not be stored.rr}r(h"jh#jubaubj)r}r(h"XJ# Emergency messages will be displayed to all users # *.=emerg :omusrmsg:*h#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;XJ# Emergency messages will be displayed to all users # *.=emerg :omusrmsg:*rr}r(h"Uh#jubaubh?)r}r(h"XZThis rule tells rsyslogd to write all emergency messages to all currently logged in users.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XZThis rule tells rsyslogd to write all emergency messages to all currently logged in users.rr}r(h"jh#jubaubj)r}r(h"X\# Messages of the priority alert will be directed # to the operator # *.alert root,rgerhardsh#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;X\# Messages of the priority alert will be directed # to the operator # *.alert root,rgerhardsrr}r(h"Uh#jubaubh?)r}r(h"XThis rule directs all messages with a priority of alert or higher to the terminals of the operator, i.e. of the users "root'' and "rgerhards'' if they're logged in.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XThis rule directs all messages with a priority of alert or higher to the terminals of the operator, i.e. of the users "root'' and "rgerhards'' if they're logged in.rr}r(h"jh#jubaubj)r}r(h"X*.* @server.example.neth#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;X*.* @server.example.netrr}r(h"Uh#jubaubh?)r}r(h"XThis rule would redirect all messages to a remote host called server.example.net. This is useful especially in a cluster of machines where all syslog messages will be stored on only one machine.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XThis rule would redirect all messages to a remote host called server.example.net. This is useful especially in a cluster of machines where all syslog messages will be stored on only one machine.rr}r(h"jh#jubaubh?)r}r(h"XIn the format shown above, UDP is used for transmitting the message. The destination port is set to the default auf 514. Rsyslog is also capable of using much more secure and reliable TCP sessions for message forwarding. Also, the destination port can be specified. To select TCP, simply add one additional @ in front of the host name (that is, @host is UPD, @@host is TCP). For example:rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XIn the format shown above, UDP is used for transmitting the message. The destination port is set to the default auf 514. Rsyslog is also capable of using much more secure and reliable TCP sessions for message forwarding. Also, the destination port can be specified. To select TCP, simply add one additional @ in front of the host name (that is, @host is UPD, @@host is TCP). For example:rr}r(h"jh#jubaubj)r}r(h"X*.* @@server.example.neth#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;X*.* @@server.example.netrr}r(h"Uh#jubaubh?)r}r(h"XTo specify the destination port on the remote machine, use a colon followed by the port number after the machine name. The following forwards to port 1514 on server.example.net:rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XTo specify the destination port on the remote machine, use a colon followed by the port number after the machine name. The following forwards to port 1514 on server.example.net:rr}r(h"jh#jubaubj)r}r(h"X*.* @@server.example.net:1514h#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;X*.* @@server.example.net:1514rr}r(h"Uh#jubaubh?)r}r(h"XPThis syntax works both with TCP and UDP based syslog. However, you will probably primarily need it for TCP, as there is no well-accepted port for this transport (it is non-standard). For UDP, you can usually stick with the default auf 514, but might want to modify it for security reasons. If you would like to do that, it's quite easy:rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;XPThis syntax works both with TCP and UDP based syslog. However, you will probably primarily need it for TCP, as there is no well-accepted port for this transport (it is non-standard). For UDP, you can usually stick with the default auf 514, but might want to modify it for security reasons. If you would like to do that, it's quite easy:rr }r (h"jh#jubaubj)r }r (h"XL*.* @server.example.net:1514 *.* >dbhost,dbname,dbuser,dbpassword;dbtemplateh#j*h$h%h&j"h(}r (j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;XL*.* @server.example.net:1514 *.* >dbhost,dbname,dbuser,dbpassword;dbtemplaterr}r(h"Uh#j ubaubh?)r}r(h"X$This rule writes all message to the database "dbname" hosted on "dbhost". The login is done with user "dbuser" and password "dbpassword". The actual table that is updated is specified within the template (which contains the insert statement). The template is called "dbtemplate" in this case.rh#j*h$h%h&hCh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;X$This rule writes all message to the database "dbname" hosted on "dbhost". The login is done with user "dbuser" and password "dbpassword". The actual table that is updated is specified within the template (which contains the insert statement). The template is called "dbtemplate" in this case.rr}r(h"jh#jubaubj)r}r(h"X):msg,contains,"error" @server.example.neth#j*h$h%h&j"h(}r(j$j%h-]h,]h*]h+]h/]uh1Kh2hh]rh;X):msg,contains,"error" @server.example.netrr}r (h"Uh#jubaubh?)r!}r"(h"XThis rule forwards all messages that contain the word "error" in the msg part to the server "errorServer". Forwarding is via UDP. Please note the colon in fronr#h#j*h$h%h&hCh(}r$(h*]h+]h,]h-]h/]uh1Kh2hh]r%h;XThis rule forwards all messages that contain the word "error" in the msg part to the server "errorServer". Forwarding is via UDP. Please note the colon in fronr&r'}r((h"j#h#j!ubaubh?)r)}r*(h"XThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h#j*h$h%h&hCh(}r+(h*]h+]h,]h-]h/]uh1Kh2hh]r,(h;X"This documentation is part of the r-r.}r/(h"X"This documentation is part of the h#j)ubh)r0}r1(h"X$`rsyslog `_h(}r2(Unameh jXhttp://www.rsyslog.com/r3h-]h,]h*]h+]h/]uh#j)h]r4h;Xrsyslogr5r6}r7(h"Uh#j0ubah&jubj)r8}r9(h"X j Kh#j)h&j h(}r:(Urefurij3h-]r;hah,]h*]h+]h/]r<h auh]ubh;X$ project. Copyright © 2008-2014 by r=r>}r?(h"X$ project. Copyright © 2008-2014 by h#j)ubh)r@}rA(h"X3`Rainer Gerhards `_h(}rB(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrCh-]h,]h*]h+]h/]uh#j)h]rDh;XRainer GerhardsrErF}rG(h"Uh#j@ubah&jubj)rH}rI(h"X! j Kh#j)h&j h(}rJ(UrefurijCh-]rKhah,]h*]h+]h/]rLhauh]ubh;X and rMrN}rO(h"X and h#j)ubh)rP}rQ(h"X$`Adiscon `_h(}rR(UnameXAdisconjjh-]h,]h*]h+]h/]uh#j)h]rSh;XAdisconrTrU}rV(h"Uh#jPubah&jubj)rW}rX(h"X j Kh#j)h&j h(}rY(Urefurijh-]rZhah,]h*]h+]h/]r[h auh]ubh;X1. Released under the GNU GPL version 2 or higher.r\r]}r^(h"X1. Released under the GNU GPL version 2 or higher.h#j)ubeubeubeubah"UU transformerr_NU footnote_refsr`}raUrefnamesrb}rcXadiscon]rdjasUsymbol_footnotesre]rfUautofootnote_refsrg]rhUsymbol_footnote_refsri]rjU citationsrk]rlh2hU current_linermNUtransform_messagesrn]roUreporterrpNUid_startrqKU autofootnotesrr]rsU citation_refsrt}ruUindirect_targetsrv]rwUsettingsrx(cdocutils.frontend Values ryorz}r{(Ufootnote_backlinksr|KUrecord_dependenciesr}NU rfc_base_urlr~Uhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh%Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhIhjWhj*hj hh hj8hjHuUsubstitution_namesr}rh&h2h(}r(h*]h-]h,]Usourceh%h+]h/]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/droppriv.doctree0000664000175000017500000003275313035122641020617 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXrainer gerhardsqX rsyslog wikiqXdropping privileges in rsyslogq NXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUrainer-gerhardsqhU rsyslog-wikiqh Udropping-privileges-in-rsyslogqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq X=/home/rger/proj/rsyslog-doc/source/configuration/droppriv.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,h auUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hXDropping privileges in rsyslogq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7XDropping privileges in rsyslogq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hX **Available since:   ** 4.1.1q>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qA(cdocutils.nodes strong qB)qC}qD(hX**Available since:   **h$}qE(h&]h']h(]h)]h+]uhh`_.hhh h!h"h?h$}qv(h&]h']h(]h)]h+]uh-Kh.hh]qw(h7X6There is some additional information available in the qxqy}qz(hX6There is some additional information available in the hhtubcdocutils.nodes reference q{)q|}q}(hXP`rsyslog wiki `_h$}q~(UnameX rsyslog wikiUrefuriqX>http://wiki.rsyslog.com/index.php/Security#Dropping_Privilegesqh)]h(]h&]h']h+]uhhth]qh7X rsyslog wikiqq}q(hUhh|ubah"U referencequbcdocutils.nodes target q)q}q(hXA U referencedqKhhth"Utargetqh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X.q}q(hX.hhtubeubh;)q}q(hX**Configuration Directives**:qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(hB)q}q(hX**Configuration Directives**h$}q(h&]h']h(]h)]h+]uhhh]qh7XConfiguration Directivesqq}q(hUhhubah"hJubh7X:q}q(hX:hhubeubcdocutils.nodes bullet_list q)q}q(hUhhh h!h"U bullet_listqh$}q(UbulletqX-h)]h(]h&]h']h+]uh-Kh.hh]q(cdocutils.nodes list_item q)q}q(hXM**$PrivDropToUser** Name of the user rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToUserID directive. If the user id can be looked up, but can not be set, rsyslog aborts.hhh h!h"U list_itemqh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hXM**$PrivDropToUser** Name of the user rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToUserID directive. If the user id can be looked up, but can not be set, rsyslog aborts.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh]q(hB)q}q(hX**$PrivDropToUser**h$}q(h&]h']h(]h)]h+]uhhh]qh7X$PrivDropToUserqq}q(hUhhubah"hJubh7X: Name of the user rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToUserID directive. If the user id can be looked up, but can not be set, rsyslog aborts.qq}q(hX: Name of the user rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToUserID directive. If the user id can be looked up, but can not be set, rsyslog aborts.hhubeubaubh)q}q(hX**$PrivDropToUserID** Much the same as $PrivDropToUser, except that a numerical user id instead of a name is specified.Thus, privilege drop will always happen. rsyslogd aborts.hhh h!h"hh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX**$PrivDropToUserID** Much the same as $PrivDropToUser, except that a numerical user id instead of a name is specified.Thus, privilege drop will always happen. rsyslogd aborts.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K#h]q(hB)q}q(hX**$PrivDropToUserID**h$}q(h&]h']h(]h)]h+]uhhh]qh7X$PrivDropToUserIDqŅq}q(hUhhubah"hJubh7X Much the same as $PrivDropToUser, except that a numerical user id instead of a name is specified.Thus, privilege drop will always happen. rsyslogd aborts.qȅq}q(hX Much the same as $PrivDropToUser, except that a numerical user id instead of a name is specified.Thus, privilege drop will always happen. rsyslogd aborts.hhubeubaubh)q}q(hX**$PrivDropToGroup** Name of the group rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToGroupID directive. Note that all supplementary groups are removed from the process if $PrivDropToGroup is specified. If the group id can be looked up, but can not be set, rsyslog aborts.hhh h!h"hh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX**$PrivDropToGroup** Name of the group rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToGroupID directive. Note that all supplementary groups are removed from the process if $PrivDropToGroup is specified. If the group id can be looked up, but can not be set, rsyslog aborts.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K'h]q(hB)q}q(hX**$PrivDropToGroup**h$}q(h&]h']h(]h)]h+]uhhh]qh7X$PrivDropToGroupqׅq}q(hUhhubah"hJubh7X Name of the group rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToGroupID directive. Note that all supplementary groups are removed from the process if $PrivDropToGroup is specified. If the group id can be looked up, but can not be set, rsyslog aborts.qڅq}q(hX Name of the group rsyslog should run under after startup. Please note that this user is looked up in the system tables. If the lookup fails, privileges are NOT dropped. Thus it is advisable to use the less convenient $PrivDropToGroupID directive. Note that all supplementary groups are removed from the process if $PrivDropToGroup is specified. If the group id can be looked up, but can not be set, rsyslog aborts.hhubeubaubh)q}q(hX**$PrivDropToGroupID** Much the same as $PrivDropToGroup, except that a numerical group id instead of a name is specified. Thus, privilege drop will always happen. hhh h!h"hh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qh;)q}q(hX**$PrivDropToGroupID** Much the same as $PrivDropToGroup, except that a numerical group id instead of a name is specified. Thus, privilege drop will always happen.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K/h]q(hB)q}q(hX**$PrivDropToGroupID**h$}q(h&]h']h(]h)]h+]uhhh]qh7X$PrivDropToGroupIDq酁q}q(hUhhubah"hJubh7X Much the same as $PrivDropToGroup, except that a numerical group id instead of a name is specified. Thus, privilege drop will always happen.q셁q}q(hX Much the same as $PrivDropToGroup, except that a numerical group id instead of a name is specified. Thus, privilege drop will always happen.hhubeubaubeubh;)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2008 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K4h.hh]q(h7X"This documentation is part of the qq}q(hX"This documentation is part of the hhubh{)q}q(hX$`rsyslog `_h$}q(Unameh hXhttp://www.rsyslog.com/qh)]h(]h&]h']h+]uhhh]qh7Xrsyslogqq}q(hUhhubah"hubh)q}q(hX hKhhh"hh$}r(Urefurihh)]rhah(]h&]h']h+]rh auh]ubh7X project. Copyright © 2008 by rr}r(hX project. Copyright © 2008 by hhubh{)r}r(hX3`Rainer Gerhards `_h$}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerr h)]h(]h&]h']h+]uhhh]r h7XRainer Gerhardsr r }r (hUhjubah"hubh)r}r(hX! hKhhh"hh$}r(Urefurij h)]rhah(]h&]h']h+]rhauh]ubh7X and rr}r(hX and hhubh{)r}r(hX$`Adiscon `_h$}r(UnameXAdisconhXhttp://www.adiscon.com/rh)]h(]h&]h']h+]uhhh]rh7XAdisconrr}r(hUhjubah"hubh)r}r(hX hKhhh"hh$}r (Urefurijh)]r!hah(]h&]h']h+]r"hauh]ubh7X1. Released under the GNU GPL version 3 or higher.r#r$}r%(hX1. Released under the GNU GPL version 3 or higher.hhubeubeubahUU transformerr&NU footnote_refsr'}r(Urefnamesr)}r*Usymbol_footnotesr+]r,Uautofootnote_refsr-]r.Usymbol_footnote_refsr/]r0U citationsr1]r2h.hU current_liner3NUtransform_messagesr4]r5Ureporterr6NUid_startr7KU autofootnotesr8]r9U citation_refsr:}r;Uindirect_targetsr<]r=Usettingsr>(cdocutils.frontend Values r?or@}rA(Ufootnote_backlinksrBKUrecord_dependenciesrCNU rfc_base_urlrDUhttps://tools.ietf.org/html/rEU tracebackrFUpep_referencesrGNUstrip_commentsrHNU toc_backlinksrIUentryrJU language_coderKUenrLU datestamprMNU report_levelrNKU _destinationrONU halt_levelrPKU strip_classesrQNh4NUerror_encoding_error_handlerrRUbackslashreplacerSUdebugrTNUembed_stylesheetrUUoutput_encoding_error_handlerrVUstrictrWU sectnum_xformrXKUdump_transformsrYNU docinfo_xformrZKUwarning_streamr[NUpep_file_url_templater\Upep-%04dr]Uexit_status_levelr^KUconfigr_NUstrict_visitorr`NUcloak_email_addressesraUtrim_footnote_reference_spacerbUenvrcNUdump_pseudo_xmlrdNUexpose_internalsreNUsectsubtitle_xformrfU source_linkrgNUrfc_referencesrhNUoutput_encodingriUutf-8rjU source_urlrkNUinput_encodingrlU utf-8-sigrmU_disable_configrnNU id_prefixroUU tab_widthrpKUerror_encodingrqUUTF-8rrU_sourcersh!Ugettext_compactrtU generatorruNUdump_internalsrvNU smart_quotesrwU pep_base_urlrxU https://www.python.org/dev/peps/ryUsyntax_highlightrzUlongr{Uinput_encoding_error_handlerr|jWUauto_id_prefixr}Uidr~Udoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hjhhhhhhhjuUsubstitution_namesr}rh"h.h$}r(h&]h)]h(]Usourceh!h']h+]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/nomatch.doctree0000664000175000017500000003474413035122643020407 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X7rsyslog online regular expression checker and generatorqXproperty replacer nomatch modeqNXadisconqXrsyslogq Xsummary of nomatch modesq NXinteractive toolq Xrainer gerhardsq uUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU7rsyslog-online-regular-expression-checker-and-generatorqhUproperty-replacer-nomatch-modeqhUadisconqh Ursyslogqh Usummary-of-nomatch-modesqh Uinteractive-toolqh Urainer-gerhardsquUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$X</home/rger/proj/rsyslog-doc/source/configuration/nomatch.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0hauUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"XProperty Replacer nomatch modeq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;XProperty Replacer nomatch modeq(h"h7h#h5ubaubcdocutils.nodes paragraph q?)q@}qA(h"XD**The "nomatch-Mode" specifies which string the property replacer shall return if a regular expression did not find the search string.**. Traditionally, the string "\*\*NO MATCH\*\*" was returned, but many people complained this was almost never useful. Still, this mode is support as "**DFLT**\ " for legacy configurations.h#h h$h%h&U paragraphqBh(}qC(h*]h+]h,]h-]h/]uh1Kh2hh]qD(cdocutils.nodes strong qE)qF}qG(h"X**The "nomatch-Mode" specifies which string the property replacer shall return if a regular expression did not find the search string.**h(}qH(h*]h+]h,]h-]h/]uh#h@h]qIh;XThe "nomatch-Mode" specifies which string the property replacer shall return if a regular expression did not find the search string.qJqK}qL(h"Uh#hFubah&UstrongqMubh;X. Traditionally, the string "**NO MATCH**" was returned, but many people complained this was almost never useful. Still, this mode is support as "qNqO}qP(h"X. Traditionally, the string "\*\*NO MATCH\*\*" was returned, but many people complained this was almost never useful. Still, this mode is support as "h#h@ubhE)qQ}qR(h"X**DFLT**h(}qS(h*]h+]h,]h-]h/]uh#h@h]qTh;XDFLTqUqV}qW(h"Uh#hQubah&hMubh;X" for legacy configurations.qXqY}qZ(h"X\ " for legacy configurations.h#h@ubeubh?)q[}q\(h"XThree additional and potentially useful modes exist: in one (**BLANK**) a blank string is returned. This is probably useful for inserting values into databases where no value shall be inserted if the expression could not be found.h#h h$h%h&hBh(}q](h*]h+]h,]h-]h/]uh1K h2hh]q^(h;X=Three additional and potentially useful modes exist: in one (q_q`}qa(h"X=Three additional and potentially useful modes exist: in one (h#h[ubhE)qb}qc(h"X **BLANK**h(}qd(h*]h+]h,]h-]h/]uh#h[h]qeh;XBLANKqfqg}qh(h"Uh#hbubah&hMubh;X) a blank string is returned. This is probably useful for inserting values into databases where no value shall be inserted if the expression could not be found.qiqj}qk(h"X) a blank string is returned. This is probably useful for inserting values into databases where no value shall be inserted if the expression could not be found.h#h[ubeubh?)ql}qm(h"XA similar mode is "**ZERO**\ " where the string "0" is returned. This is suitable for numerical values. A use case may be that you record a traffic log based on firewall rules and the "bytes transmitted" counter is extracted via a regular expression. If no "bytes transmitted" counter is available in the current message, it is probably a good idea to return an empty string, which the database layer can turn into a zero.h#h h$h%h&hBh(}qn(h*]h+]h,]h-]h/]uh1Kh2hh]qo(h;XA similar mode is "qpqq}qr(h"XA similar mode is "h#hlubhE)qs}qt(h"X**ZERO**h(}qu(h*]h+]h,]h-]h/]uh#hlh]qvh;XZEROqwqx}qy(h"Uh#hsubah&hMubh;X" where the string "0" is returned. This is suitable for numerical values. A use case may be that you record a traffic log based on firewall rules and the "bytes transmitted" counter is extracted via a regular expression. If no "bytes transmitted" counter is available in the current message, it is probably a good idea to return an empty string, which the database layer can turn into a zero.qzq{}q|(h"X\ " where the string "0" is returned. This is suitable for numerical values. A use case may be that you record a traffic log based on firewall rules and the "bytes transmitted" counter is extracted via a regular expression. If no "bytes transmitted" counter is available in the current message, it is probably a good idea to return an empty string, which the database layer can turn into a zero.h#hlubeubh?)q}}q~(h"XThe other mode is "**FIELD**\ ", in which the complete field is returned. This may be useful in cases where absense of a match is considered a failure and the message that triggered it shall be logged.h#h h$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(h;XThe other mode is "qq}q(h"XThe other mode is "h#h}ubhE)q}q(h"X **FIELD**h(}q(h*]h+]h,]h-]h/]uh#h}h]qh;XFIELDqq}q(h"Uh#hubah&hMubh;X", in which the complete field is returned. This may be useful in cases where absense of a match is considered a failure and the message that triggered it shall be logged.qq}q(h"X\ ", in which the complete field is returned. This may be useful in cases where absense of a match is considered a failure and the message that triggered it shall be logged.h#h}ubeubh?)q}q(h"X If in doubt, **it is highly suggested to use the** `rsyslog online regular expression checker and generator `_ **to see these options in action**. With that online tool, you can craft regular expressions based on samples and try out the different modes.h#h h$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh2hh]q(h;X If in doubt, qq}q(h"X If in doubt, h#hubhE)q}q(h"X%**it is highly suggested to use the**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;X!it is highly suggested to use theqq}q(h"Uh#hubah&hMubh;X q}q(h"X h#hubcdocutils.nodes reference q)q}q(h"X^`rsyslog online regular expression checker and generator `_h(}q(UnameX7rsyslog online regular expression checker and generatorUrefuriqX!http://www.rsyslog.com/tool-regexqh-]h,]h*]h+]h/]uh#hh]qh;X7rsyslog online regular expression checker and generatorqq}q(h"Uh#hubah&U referencequbcdocutils.nodes target q)q}q(h"X$ U referencedqKh#hh&Utargetqh(}q(Urefurihh-]qhah,]h*]h+]h/]qhauh]ubh;X q}q(h"X h#hubhE)q}q(h"X"**to see these options in action**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;Xto see these options in actionqq}q(h"Uh#hubah&hMubh;Xl. With that online tool, you can craft regular expressions based on samples and try out the different modes.qq}q(h"Xl. With that online tool, you can craft regular expressions based on samples and try out the different modes.h#hubeubh)q}q(h"Uh#h h$h%h&h'h(}q(h*]h+]h,]h-]qhah/]qh auh1K h2hh]q(h4)q}q(h"XSummary of nomatch Modesqh#hh$h%h&h8h(}q(h*]h+]h,]h-]h/]uh1K h2hh]qh;XSummary of nomatch Modesqȅq}q(h"hh#hubaubcdocutils.nodes table q)q}q(h"Uh#hh$h%h&Utableqh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qcdocutils.nodes tgroup q)q}q(h"Uh(}q(h-]h,]h*]h+]h/]UcolsKuh#hh]q(cdocutils.nodes colspec q)q}q(h"Uh(}q(h-]h,]h*]h+]h/]UcolwidthK uh#hh]h&Ucolspecqubh)q}q(h"Uh(}q(h-]h,]h*]h+]h/]UcolwidthK;uh#hh]h&hubcdocutils.nodes tbody q)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]q(cdocutils.nodes row q)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]q(cdocutils.nodes entry q)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"X**Mode**qh#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1K#h]qhE)q}q(h"hh(}q(h*]h+]h,]h-]h/]uh#hh]qh;XModeqq}q(h"Uh#hubah&hMubaubah&Uentryqubh)q}q(h"Uh(}q(h*]h+]h,]h-]h/]uh#hh]qh?)q}q(h"X **Returned**rh#hh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K#h]rhE)r}r(h"jh(}r(h*]h+]h,]h-]h/]uh#hh]rh;XReturnedrr}r (h"Uh#jubah&hMubaubah&hubeh&Urowr ubh)r }r (h"Uh(}r (h*]h+]h,]h-]h/]uh#hh]r(h)r}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#j h]rh?)r}r(h"XDFLTrh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K%h]rh;XDFLTrr}r(h"jh#jubaubah&hubh)r}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#j h]rh?)r}r (h"X"\*\*NO MATCH\*\*"h#jh$h%h&hBh(}r!(h*]h+]h,]h-]h/]uh1K%h]r"h;X"**NO MATCH**"r#r$}r%(h"X"\*\*NO MATCH\*\*"h#jubaubah&hubeh&j ubh)r&}r'(h"Uh(}r((h*]h+]h,]h-]h/]uh#hh]r)(h)r*}r+(h"Uh(}r,(h*]h+]h,]h-]h/]uh#j&h]r-h?)r.}r/(h"XBLANKr0h#j*h$h%h&hBh(}r1(h*]h+]h,]h-]h/]uh1K'h]r2h;XBLANKr3r4}r5(h"j0h#j.ubaubah&hubh)r6}r7(h"Uh(}r8(h*]h+]h,]h-]h/]uh#j&h]r9h?)r:}r;(h"X"" (empty string)r<h#j6h$h%h&hBh(}r=(h*]h+]h,]h-]h/]uh1K'h]r>h;X"" (empty string)r?r@}rA(h"j<h#j:ubaubah&hubeh&j ubh)rB}rC(h"Uh(}rD(h*]h+]h,]h-]h/]uh#hh]rE(h)rF}rG(h"Uh(}rH(h*]h+]h,]h-]h/]uh#jBh]rIh?)rJ}rK(h"XZEROrLh#jFh$h%h&hBh(}rM(h*]h+]h,]h-]h/]uh1K)h]rNh;XZEROrOrP}rQ(h"jLh#jJubaubah&hubh)rR}rS(h"Uh(}rT(h*]h+]h,]h-]h/]uh#jBh]rUh?)rV}rW(h"X"0"rXh#jRh$h%h&hBh(}rY(h*]h+]h,]h-]h/]uh1K)h]rZh;X"0"r[r\}r](h"jXh#jVubaubah&hubeh&j ubh)r^}r_(h"Uh(}r`(h*]h+]h,]h-]h/]uh#hh]ra(h)rb}rc(h"Uh(}rd(h*]h+]h,]h-]h/]uh#j^h]reh?)rf}rg(h"XFIELDrhh#jbh$h%h&hBh(}ri(h*]h+]h,]h-]h/]uh1K+h]rjh;XFIELDrkrl}rm(h"jhh#jfubaubah&hubh)rn}ro(h"Uh(}rp(h*]h+]h,]h-]h/]uh#j^h]rqh?)rr}rs(h"Xfull content of original fieldrth#jnh$h%h&hBh(}ru(h*]h+]h,]h-]h/]uh1K+h]rvh;Xfull content of original fieldrwrx}ry(h"jth#jrubaubah&hubeh&j ubh)rz}r{(h"Uh(}r|(h*]h+]h,]h-]h/]uh#hh]r}(h)r~}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#jzh]h&hubh)r}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#jzh]rh?)r}r(h"X7`Interactive Tool `_rh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K-h]r(h)r}r(h"jh(}r(UnameXInteractive ToolhX!http://www.rsyslog.com/tool-regexrh-]h,]h*]h+]h/]uh#jh]rh;XInteractive Toolrr}r(h"Uh#jubah&hubh)r}r(h"X$ hKh#jh&hh(}r(Urefurijh-]rhah,]h*]h+]h/]rh auh]ubeubah&hubeh&j ubeh&Utbodyrubeh&Utgrouprubaubh?)r}r(h"XThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h#hh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K0h2hh]r(h;X"This documentation is part of the rr}r(h"X"This documentation is part of the h#jubh)r}r(h"X$`rsyslog `_h(}r(Unameh hXhttp://www.rsyslog.com/rh-]h,]h*]h+]h/]uh#jh]rh;Xrsyslogrr}r(h"Uh#jubah&hubh)r}r(h"X hKh#jh&hh(}r(Urefurijh-]rhah,]h*]h+]h/]rh auh]ubh;X$ project. Copyright © 2008-2014 by rr}r(h"X$ project. Copyright © 2008-2014 by h#jubh)r}r(h"X3`Rainer Gerhards `_h(}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrh-]h,]h*]h+]h/]uh#jh]rh;XRainer Gerhardsrr}r(h"Uh#jubah&hubh)r}r(h"X! hKh#jh&hh(}r(Urefurijh-]rhah,]h*]h+]h/]rh auh]ubh;X and rr}r(h"X and h#jubh)r}r(h"X$`Adiscon `_h(}r(UnameXAdisconhXhttp://www.adiscon.com/rh-]h,]h*]h+]h/]uh#jh]rh;XAdisconrr}r(h"Uh#jubah&hubh)r}r(h"X hKh#jh&hh(}r(Urefurijh-]rhah,]h*]h+]h/]rhauh]ubh;X1. Released under the GNU GPL version 2 or higher.rr}r(h"X1. Released under the GNU GPL version 2 or higher.h#jubeubeubeubah"UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh2hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrhU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorr NUcloak_email_addressesr Utrim_footnote_reference_spacer Uenvr NUdump_pseudo_xmlr NUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh%Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesr U pep_base_urlr!U https://www.python.org/dev/peps/r"Usyntax_highlightr#Ulongr$Uinput_encoding_error_handlerr%jUauto_id_prefixr&Uidr'Udoctitle_xformr(Ustrip_elements_with_classesr)NU _config_filesr*]r+Ufile_insertion_enabledr,U raw_enabledr-KU dump_settingsr.NubUsymbol_footnote_startr/KUidsr0}r1(hjhhhh hjhhhjhjuUsubstitution_namesr2}r3h&h2h(}r4(h*]h-]h,]Usourceh%h+]h/]uU footnotesr5]r6Urefidsr7}r8ub.build/.doctrees/configuration/templates.doctree0000664000175000017500000033031213035122643020742 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xconstant statementqNXrsyslogqXrsyslog parsingqXadisconq Xadding the bom to a messageq Xexamplesq NX@standard template for forwarding to a remote host (rfc3164 mode)q NX1standard template for write to the mysql databaseq NX&standard template for writing to filesqNX legacy formatqNXuse caseqNXrainer gerhardsqX&creating dynamic file names for omfileqNXjsonqXjsonfrqXsee alsoqNXcsvqX templatesqNXjsonfqXstringqNXproperty statementqNX<how to separate log files by host name of the sending deviceqXrfc5424qXhow to bind a templateqXthe template() statementqNX$legacy string-based template samplesqNXpluginq NXlistq!NXsubtreeq"NXreserved template namesq#NXtemplate processingq$NXoptionsq%NXjsonrq&uUsubstitution_defsq'}q(Uparse_messagesq)]q*(cdocutils.nodes system_message q+)q,}q-(U rawsourceq.UUparentq/cdocutils.nodes section q0)q1}q2(h.UU referencedq3Kh/h0)q4}q5(h.Uh/h0)q6}q7(h.Uh/hUsourceq8X>/home/rger/proj/rsyslog-doc/source/configuration/templates.rstq9Utagnameq:Usectionq;U attributesq<}q=(Udupnamesq>]Uclassesq?]Ubackrefsq@]UidsqA]qBU templatesqCaUnamesqD]qEhauUlineqFKUdocumentqGhUchildrenqH]qI(cdocutils.nodes title qJ)qK}qL(h.X TemplatesqMh/h6h8h9h:UtitleqNh<}qO(h>]h?]h@]hA]hD]uhFKhGhhH]qPcdocutils.nodes Text qQX TemplatesqRqS}qT(h.hMh/hKubaubcdocutils.nodes paragraph qU)qV}qW(h.XTemplates are a key feature of rsyslog. They allow to specify any format a user might want. They are also used for dynamic file name generation. Every output in rsyslog uses templates - this holds true for files, user messages and so on. The database writer expects its template to be a proper SQL statement - so this is highly customizable too. You might ask how does all of this work when no templates at all are specified. Good question ;). The answer is simple, though. Templates are compatible with the stock syslogd formats which are hardcoded into rsyslogd. So if no template is specified, we use one of those hardcoded templates. Search for "template\_" in rsconf.c and you will find the hardcoded ones.h/h6h8h9h:U paragraphqXh<}qY(h>]h?]h@]hA]hD]uhFKhGhhH]qZhQXTemplates are a key feature of rsyslog. They allow to specify any format a user might want. They are also used for dynamic file name generation. Every output in rsyslog uses templates - this holds true for files, user messages and so on. The database writer expects its template to be a proper SQL statement - so this is highly customizable too. You might ask how does all of this work when no templates at all are specified. Good question ;). The answer is simple, though. Templates are compatible with the stock syslogd formats which are hardcoded into rsyslogd. So if no template is specified, we use one of those hardcoded templates. Search for "template_" in rsconf.c and you will find the hardcoded ones.q[q\}q](h.XTemplates are a key feature of rsyslog. They allow to specify any format a user might want. They are also used for dynamic file name generation. Every output in rsyslog uses templates - this holds true for files, user messages and so on. The database writer expects its template to be a proper SQL statement - so this is highly customizable too. You might ask how does all of this work when no templates at all are specified. Good question ;). The answer is simple, though. Templates are compatible with the stock syslogd formats which are hardcoded into rsyslogd. So if no template is specified, we use one of those hardcoded templates. Search for "template\_" in rsconf.c and you will find the hardcoded ones.h/hVubaubhU)q^}q_(h.XmTemplates are specified by template() statements. They can also be specified via $template legacy statements.q`h/h6h8h9h:hXh<}qa(h>]h?]h@]hA]hD]uhFKhGhhH]qbhQXmTemplates are specified by template() statements. They can also be specified via $template legacy statements.qcqd}qe(h.h`h/h^ubaubhU)qf}qg(h.X**Note: key elements of templates are rsyslog properties.** See the :doc:`rsyslog properties reference ` for a list of which are available.h/h6h8h9h:hXh<}qh(h>]h?]h@]hA]hD]uhFKhGhhH]qi(cdocutils.nodes strong qj)qk}ql(h.X;**Note: key elements of templates are rsyslog properties.**h<}qm(h>]h?]h@]hA]hD]uh/hfhH]qnhQX7Note: key elements of templates are rsyslog properties.qoqp}qq(h.Uh/hkubah:UstrongqrubhQX See the qsqt}qu(h.X See the h/hfubcsphinx.addnodes pending_xref qv)qw}qx(h.X0:doc:`rsyslog properties reference `qyh/hfh8h9h:U pending_xrefqzh<}q{(UreftypeXdocq|Urefwarnq}U reftargetq~X propertiesU refdomainUhA]h@]U refexplicith>]h?]hD]UrefdocqXconfiguration/templatesquhFKhH]qcdocutils.nodes literal q)q}q(h.hyh<}q(h>]h?]q(Uxrefqh|eh@]hA]hD]uh/hwhH]qhQXrsyslog properties referenceqq}q(h.Uh/hubah:UliteralqubaubhQX# for a list of which are available.qq}q(h.X# for a list of which are available.h/hfubeubh0)q}q(h.Uh/h6h8h9h:h;h<}q(h>]h?]h@]hA]qUtemplate-processingqahD]qh$auhFKhGhhH]q(hJ)q}q(h.XTemplate processingqh/hh8h9h:hNh<}q(h>]h?]h@]hA]hD]uhFKhGhhH]qhQXTemplate processingqq}q(h.hh/hubaubhU)q}q(h.XDue to lack of standarization regarding logs formats, when a template is specified it's supposed to include HEADER, as defined in `RFC5424 `_h/hh8h9h:hXh<}q(h>]h?]h@]hA]hD]uhFKhGhhH]q(hQXDue to lack of standarization regarding logs formats, when a template is specified it's supposed to include HEADER, as defined in qq}q(h.XDue to lack of standarization regarding logs formats, when a template is specified it's supposed to include HEADER, as defined in h/hubcdocutils.nodes reference q)q}q(h.X0`RFC5424 `_h<}q(UnameXRFC5424UrefuriqX#https://tools.ietf.org/html/rfc5424qhA]h@]h>]h?]hD]uh/hhH]qhQXRFC5424qq}q(h.Uh/hubah:U referencequbcdocutils.nodes target q)q}q(h.X& h3Kh/hh:Utargetqh<}q(UrefurihhA]qUrfc5424qah@]h>]h?]hD]qhauhH]ubeubhU)q}q(h.XIt's very important to have this in mind, and also how to understand how `rsyslog parsing `_ worksh/hh8h9h:hXh<}q(h>]h?]h@]hA]hD]uhFKhGhhH]q(hQXIIt's very important to have this in mind, and also how to understand how qq}q(h.XIIt's very important to have this in mind, and also how to understand how h/hubh)q}q(h.XC`rsyslog parsing `_h<}q(UnameXrsyslog parsinghX.http://www.rsyslog.com/doc/syslog_parsing.htmlqhA]h@]h>]h?]hD]uh/hhH]qhQXrsyslog parsingqŅq}q(h.Uh/hubah:hubh)q}q(h.X1 h3Kh/hh:hh<}q(UrefurihhA]qUrsyslog-parsingqah@]h>]h?]hD]qhauhH]ubhQX worksq΅q}q(h.X worksh/hubeubhU)q}q(h.XFor example, if MSG field is set to "this:is a message" and no HOSTNAME, neither TAG are specified, outgoing parser will split the message as:qh/hh8h9h:hXh<}q(h>]h?]h@]hA]hD]uhFKhGhhH]qhQXFor example, if MSG field is set to "this:is a message" and no HOSTNAME, neither TAG are specified, outgoing parser will split the message as:qօq}q(h.hh/hubaubcdocutils.nodes literal_block q)q}q(h.XTAG:this: MSG:is a messageh/hh8h9h:U literal_blockqh<}q(U xml:spaceqUpreserveqhA]h@]h>]h?]hD]uhFK$hGhhH]qhQXTAG:this: MSG:is a messageqᅁq}q(h.Uh/hubaubeubh0)q}q(h.Uh/h6h8h9h:h;h<}q(h>]h?]h@]hA]qUthe-template-statementqahD]qhauhFK)hGhhH]q(hJ)q}q(h.XThe template() statementqh/hh8h9h:hNh<}q(h>]h?]h@]hA]hD]uhFK)hGhhH]qhQXThe template() statementqq}q(h.hh/hubaubhU)q}q(h.XThe template() statement is used to define templates. Note that it is a **static** statement, that means all templates are defined when rsyslog reads the config file. As such, templates are not affected by if-statements or config nesting.h/hh8h9h:hXh<}q(h>]h?]h@]hA]hD]uhFK+hGhhH]q(hQXHThe template() statement is used to define templates. Note that it is a qq}q(h.XHThe template() statement is used to define templates. Note that it is a h/hubhj)q}q(h.X **static**h<}q(h>]h?]h@]hA]hD]uh/hhH]qhQXstaticqq}r(h.Uh/hubah:hrubhQX statement, that means all templates are defined when rsyslog reads the config file. As such, templates are not affected by if-statements or config nesting.rr}r(h.X statement, that means all templates are defined when rsyslog reads the config file. As such, templates are not affected by if-statements or config nesting.h/hubeubhU)r}r(h.X<The basic structure of the template statement is as follows:rh/hh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFK0hGhhH]rhQX<The basic structure of the template statement is as follows:r r }r (h.jh/jubaubh)r }r (h.Xtemplate(parameters)h/hh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFK4hGhhH]rhQXtemplate(parameters)rr}r(h.Uh/j ubaubhU)r}r(h.XfIn addition to this simpler syntax, list templates (to be described below) support an extended syntax:rh/hh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFK6hGhhH]rhQXfIn addition to this simpler syntax, list templates (to be described below) support an extended syntax:rr}r(h.jh/jubaubh)r}r(h.X*template(parameters) { list-descriptions }h/hh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFK;hGhhH]rhQX*template(parameters) { list-descriptions }rr }r!(h.Uh/jubaubhU)r"}r#(h.X#Each template has a parameter **name**, which specifies the template name, and a parameter **type**, which specifies the template type. The name parameter must be unique, and behaviour is unpredictable if it is not. The **type** parameter specifies different template types. Different types simply enable different ways to specify the template content. The template type **does not** affect what an (output) plugin can do with it. So use the type that best fits your needs (from a config writing point of view!). The following types are available:h/hh8h9h:hXh<}r$(h>]h?]h@]hA]hD]uhFK=hGhhH]r%(hQXEach template has a parameter r&r'}r((h.XEach template has a parameter h/j"ubhj)r)}r*(h.X**name**h<}r+(h>]h?]h@]hA]hD]uh/j"hH]r,hQXnamer-r.}r/(h.Uh/j)ubah:hrubhQX5, which specifies the template name, and a parameter r0r1}r2(h.X5, which specifies the template name, and a parameter h/j"ubhj)r3}r4(h.X**type**h<}r5(h>]h?]h@]hA]hD]uh/j"hH]r6hQXtyper7r8}r9(h.Uh/j3ubah:hrubhQXy, which specifies the template type. The name parameter must be unique, and behaviour is unpredictable if it is not. The r:r;}r<(h.Xy, which specifies the template type. The name parameter must be unique, and behaviour is unpredictable if it is not. The h/j"ubhj)r=}r>(h.X**type**h<}r?(h>]h?]h@]hA]hD]uh/j"hH]r@hQXtyperArB}rC(h.Uh/j=ubah:hrubhQX parameter specifies different template types. Different types simply enable different ways to specify the template content. The template type rDrE}rF(h.X parameter specifies different template types. Different types simply enable different ways to specify the template content. The template type h/j"ubhj)rG}rH(h.X **does not**h<}rI(h>]h?]h@]hA]hD]uh/j"hH]rJhQXdoes notrKrL}rM(h.Uh/jGubah:hrubhQX affect what an (output) plugin can do with it. So use the type that best fits your needs (from a config writing point of view!). The following types are available:rNrO}rP(h.X affect what an (output) plugin can do with it. So use the type that best fits your needs (from a config writing point of view!). The following types are available:h/j"ubeubcdocutils.nodes bullet_list rQ)rR}rS(h.Uh/hh8h9h:U bullet_listrTh<}rU(UbulletrVX-hA]h@]h>]h?]hD]uhFKFhGhhH]rW(cdocutils.nodes list_item rX)rY}rZ(h.Xlistr[h/jRh8h9h:U list_itemr\h<}r](h>]h?]h@]hA]hD]uhFNhGhhH]r^hU)r_}r`(h.j[h/jYh8h9h:hXh<}ra(h>]h?]h@]hA]hD]uhFKFhH]rbhQXlistrcrd}re(h.j[h/j_ubaubaubjX)rf}rg(h.Xsubtreerhh/jRh8h9h:j\h<}ri(h>]h?]h@]hA]hD]uhFNhGhhH]rjhU)rk}rl(h.jhh/jfh8h9h:hXh<}rm(h>]h?]h@]hA]hD]uhFKGhH]rnhQXsubtreerorp}rq(h.jhh/jkubaubaubjX)rr}rs(h.Xstringrth/jRh8h9h:j\h<}ru(h>]h?]h@]hA]hD]uhFNhGhhH]rvhU)rw}rx(h.jth/jrh8h9h:hXh<}ry(h>]h?]h@]hA]hD]uhFKHhH]rzhQXstringr{r|}r}(h.jth/jwubaubaubjX)r~}r(h.Xplugin h/jRh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.Xpluginrh/j~h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKIhH]rhQXpluginrr}r(h.jh/jubaubaubeubhU)r}r(h.X&The various types are described below.rh/hh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKKhGhhH]rhQX&The various types are described below.rr}r(h.jh/jubaubh0)r}r(h.Uh/hh8h9h:h;h<}r(h>]h?]h@]hA]rUlistrahD]rh!auhFKNhGhhH]r(hJ)r}r(h.Xlistrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFKNhGhhH]rhQXlistrr}r(h.jh/jubaubhU)r}r(h.XIn this case, the template is generated by a list of constant and variable statements. These follow the template spec in curly braces. This type is also primarily meant for use with structure-aware outputs, like ommongodb. However, it also works perfectly with text-based outputs. We recommend to use this mode if more complex property substitutions need to be done. In that case, the list-based template syntax is much clearer than the simple string-based one.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKPhGhhH]rhQXIn this case, the template is generated by a list of constant and variable statements. These follow the template spec in curly braces. This type is also primarily meant for use with structure-aware outputs, like ommongodb. However, it also works perfectly with text-based outputs. We recommend to use this mode if more complex property substitutions need to be done. In that case, the list-based template syntax is much clearer than the simple string-based one.rr}r(h.jh/jubaubhU)r}r(h.XThe list template contains the template header (with **type="list"**) and is followed by **constant** and **property** statements, given in curly braces to signify the template statement they belong to. As the name says, **constant** statements describe constant text and **property** describes property access. There are many options to **property**, described further below. Most of these options are used to extract only partial property contents or to modify the text obtained (like to change its case to upper or lower case, only).h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKXhGhhH]r(hQX5The list template contains the template header (with rr}r(h.X5The list template contains the template header (with h/jubhj)r}r(h.X**type="list"**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX type="list"rr}r(h.Uh/jubah:hrubhQX) and is followed by rr}r(h.X) and is followed by h/jubhj)r}r(h.X **constant**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXconstantrr}r(h.Uh/jubah:hrubhQX and rr}r(h.X and h/jubhj)r}r(h.X **property**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXpropertyrr}r(h.Uh/jubah:hrubhQXg statements, given in curly braces to signify the template statement they belong to. As the name says, rr}r(h.Xg statements, given in curly braces to signify the template statement they belong to. As the name says, h/jubhj)r}r(h.X **constant**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXconstantrr}r(h.Uh/jubah:hrubhQX' statements describe constant text and rr}r(h.X' statements describe constant text and h/jubhj)r}r(h.X **property**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXpropertyrr}r(h.Uh/jubah:hrubhQX6 describes property access. There are many options to rr}r(h.X6 describes property access. There are many options to h/jubhj)r}r(h.X **property**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXpropertyrr}r(h.Uh/jubah:hrubhQX, described further below. Most of these options are used to extract only partial property contents or to modify the text obtained (like to change its case to upper or lower case, only).rr}r(h.X, described further below. Most of these options are used to extract only partial property contents or to modify the text obtained (like to change its case to upper or lower case, only).h/jubeubhU)r}r(h.X'To grasp the idea, an actual sample is:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKahGhhH]rhQX'To grasp the idea, an actual sample is:rr}r(h.jh/jubaubh)r}r(h.Xtemplate(name="tpl1" type="list") { constant(value="Syslog MSG is: '") property(name="msg") constant(value="', ") property(name="timereported" dateFormat="rfc3339" caseConversion="lower") constant(value="\n") }h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFKehGhhH]rhQXtemplate(name="tpl1" type="list") { constant(value="Syslog MSG is: '") property(name="msg") constant(value="', ") property(name="timereported" dateFormat="rfc3339" caseConversion="lower") constant(value="\n") }rr}r(h.Uh/jubaubhU)r}r(h.XJThis sample is probably primarily targeted at the usual file-based output.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKmhGhhH]rhQXJThis sample is probably primarily targeted at the usual file-based output.rr}r(h.jh/jubaubh0)r}r(h.Uh/jh8h9h:h;h<}r(h>]h?]h@]hA]rUconstant-statementrahD]rhauhFKqhGhhH]r (hJ)r }r (h.Xconstant statementr h/jh8h9h:hNh<}r (h>]h?]h@]hA]hD]uhFKqhGhhH]rhQXconstant statementrr}r(h.j h/j ubaubhU)r}r(h.XThis provides a way to specify constant text. The text is used literally. It is primarily intended for text-based output, so that some constant text can be included. For example, if a complex template is built for file output, one usually needs to finish it by a newline, which can be introduced by a constant statement. Here is an actual sample of that use case from the rsylsog testbench:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKshGhhH]rhQXThis provides a way to specify constant text. The text is used literally. It is primarily intended for text-based output, so that some constant text can be included. For example, if a complex template is built for file output, one usually needs to finish it by a newline, which can be introduced by a constant statement. Here is an actual sample of that use case from the rsylsog testbench:rr}r(h.jh/jubaubh)r}r(h.Xbtemplate(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n") }h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFK|hGhhH]rhQXbtemplate(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n") }rr}r (h.Uh/jubaubhU)r!}r"(h.XGThe following escape sequences are recognized inside the constant text:r#h/jh8h9h:hXh<}r$(h>]h?]h@]hA]hD]uhFKhGhhH]r%hQXGThe following escape sequences are recognized inside the constant text:r&r'}r((h.j#h/j!ubaubjQ)r)}r*(h.Uh/jh8h9h:jTh<}r+(jVX-hA]h@]h>]h?]hD]uhFKhGhhH]r,(jX)r-}r.(h.X\\\\ - single backslashr/h/j)h8h9h:j\h<}r0(h>]h?]h@]hA]hD]uhFNhGhhH]r1hU)r2}r3(h.j/h/j-h8h9h:hXh<}r4(h>]h?]h@]hA]hD]uhFKhH]r5hQX\\ - single backslashr6r7}r8(h.X\\\\ - single backslashh/j2ubaubaubjX)r9}r:(h.X\\n - LFr;h/j)h8h9h:j\h<}r<(h>]h?]h@]hA]hD]uhFNhGhhH]r=hU)r>}r?(h.j;h/j9h8h9h:hXh<}r@(h>]h?]h@]hA]hD]uhFKhH]rAhQX\n - LFrBrC}rD(h.X\\n - LFh/j>ubaubaubjX)rE}rF(h.X4\\ooo - (three octal digits) - represents character with this numerical value (e.g. \\101 equals "A"). Note that three octal digits must be given (in contrast to some languages, where between one and three are valid). While we support octal notation, we recommend to use hex notation as this is better known.h/j)h8h9h:j\h<}rG(h>]h?]h@]hA]hD]uhFNhGhhH]rHhU)rI}rJ(h.X4\\ooo - (three octal digits) - represents character with this numerical value (e.g. \\101 equals "A"). Note that three octal digits must be given (in contrast to some languages, where between one and three are valid). While we support octal notation, we recommend to use hex notation as this is better known.h/jEh8h9h:hXh<}rK(h>]h?]h@]hA]hD]uhFKhH]rLhQX2\ooo - (three octal digits) - represents character with this numerical value (e.g. \101 equals "A"). Note that three octal digits must be given (in contrast to some languages, where between one and three are valid). While we support octal notation, we recommend to use hex notation as this is better known.rMrN}rO(h.X4\\ooo - (three octal digits) - represents character with this numerical value (e.g. \\101 equals "A"). Note that three octal digits must be given (in contrast to some languages, where between one and three are valid). While we support octal notation, we recommend to use hex notation as this is better known.h/jIubaubaubjX)rP}rQ(h.X\\xhh - (where h is a hex digit) - represents character with this numerical value (e.g. \\x41 equals "A"). Note that two hexadecimal digits must be given (in contrast to some languages where one or two are valid).h/j)h8h9h:j\h<}rR(h>]h?]h@]hA]hD]uhFNhGhhH]rShU)rT}rU(h.X\\xhh - (where h is a hex digit) - represents character with this numerical value (e.g. \\x41 equals "A"). Note that two hexadecimal digits must be given (in contrast to some languages where one or two are valid).h/jPh8h9h:hXh<}rV(h>]h?]h@]hA]hD]uhFKhH]rWhQX\xhh - (where h is a hex digit) - represents character with this numerical value (e.g. \x41 equals "A"). Note that two hexadecimal digits must be given (in contrast to some languages where one or two are valid).rXrY}rZ(h.X\\xhh - (where h is a hex digit) - represents character with this numerical value (e.g. \\x41 equals "A"). Note that two hexadecimal digits must be given (in contrast to some languages where one or two are valid).h/jTubaubaubjX)r[}r\(h.X.... some others ... list needs to be extended h/j)h8h9h:j\h<}r](h>]h?]h@]hA]hD]uhFNhGhhH]r^hU)r_}r`(h.X-... some others ... list needs to be extendedrah/j[h8h9h:hXh<}rb(h>]h?]h@]hA]hD]uhFKhH]rchQX-... some others ... list needs to be extendedrdre}rf(h.jah/j_ubaubaubeubhU)rg}rh(h.X|Note: if an unsupported character follows a backslash, this is treated as an error. Behaviour is unpredictable in this case.rih/jh8h9h:hXh<}rj(h>]h?]h@]hA]hD]uhFKhGhhH]rkhQX|Note: if an unsupported character follows a backslash, this is treated as an error. Behaviour is unpredictable in this case.rlrm}rn(h.jih/jgubaubhU)ro}rp(h.X8To aid usage of the same template both for text-based outputs and structured ones, constant text without an "outname" parameter will be ignored when creating the name/value tree for structured outputs. So if you want to supply some constant text e.g. to mongodb, you must include an outname, as can be seen here:rqh/jh8h9h:hXh<}rr(h>]h?]h@]hA]hD]uhFKhGhhH]rshQX8To aid usage of the same template both for text-based outputs and structured ones, constant text without an "outname" parameter will be ignored when creating the name/value tree for structured outputs. So if you want to supply some constant text e.g. to mongodb, you must include an outname, as can be seen here:rtru}rv(h.jqh/joubaubh)rw}rx(h.X|template(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n" outname="IWantThisInMyDB") }h/jh8h9h:hh<}ry(hhhA]h@]h>]h?]hD]uhFKhGhhH]rzhQX|template(name="outfmt" type="list") { property(name="$!usr!msgnum") constant(value="\n" outname="IWantThisInMyDB") }r{r|}r}(h.Uh/jwubaubhU)r~}r(h.X;The "constant" statement supports the following parameters:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQX;The "constant" statement supports the following parameters:rr}r(h.jh/j~ubaubjQ)r}r(h.Uh/jh8h9h:jTh<}r(jVX-hA]h@]h>]h?]hD]uhFKhGhhH]r(jX)r}r(h.X!value - the constant value to userh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.jh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX!value - the constant value to userr}r(h.jh/jubaubaubjX)r}r(h.X5outname - output field name (for structured outputs) h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X4outname - output field name (for structured outputs)rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX4outname - output field name (for structured outputs)rr}r(h.jh/jubaubaubeubeubh0)r}r(h.Uh/jh8h9h:h;h<}r(h>]h?]h@]hA]rUproperty-statementrahD]rhauhFKhGhhH]r(hJ)r}r(h.Xproperty statementrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQXproperty statementrr}r(h.jh/jubaubhU)r}r(h.XThis statement is used to include property text. It can access all properties. Also, options permit to specify picking only part of a property or modifying it. It supports the following parameters:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQXThis statement is used to include property text. It can access all properties. Also, options permit to specify picking only part of a property or modifying it. It supports the following parameters:rr}r(h.jh/jubaubjQ)r}r(h.Uh/jh8h9h:jTh<}r(jVX-hA]h@]h>]h?]hD]uhFKhGhhH]r(jX)r}r(h.X)name - the name of the property to accessrh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.jh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX)name - the name of the property to accessrr}r(h.jh/jubaubaubjX)r}r(h.X4outname - output field name (for structured outputs)rh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.jh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX4outname - output field name (for structured outputs)rr}r(h.jh/jubaubaubjX)r}r(h.XBdateformat - date format to use (only for date-related properties)rh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.jh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXBdateformat - date format to use (only for date-related properties)rr}r(h.jh/jubaubaubjX)r}r(h.Xdate.inUTC - date shall be shown in UTC (please note that this requires a bit more performance due to the necessary conversions) Available since 8.18.0.h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.Xdate.inUTC - date shall be shown in UTC (please note that this requires a bit more performance due to the necessary conversions) Available since 8.18.0.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXdate.inUTC - date shall be shown in UTC (please note that this requires a bit more performance due to the necessary conversions) Available since 8.18.0.rr}r(h.jh/jubaubaubjX)r}r(h.X^caseconversion - permits to convert case of the text. Supported values are "lower" and "upper"h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X^caseconversion - permits to convert case of the text. Supported values are "lower" and "upper"rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX^caseconversion - permits to convert case of the text. Supported values are "lower" and "upper"rr}r(h.jh/jubaubaubjX)r}r(h.Xcontrolcharacters - specifies how to handle control characters. Supported values are "escape", which escapes them, "space", which replaces them by a single space, and "drop", which simply removes them from the string.h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.Xcontrolcharacters - specifies how to handle control characters. Supported values are "escape", which escapes them, "space", which replaces them by a single space, and "drop", which simply removes them from the string.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXcontrolcharacters - specifies how to handle control characters. Supported values are "escape", which escapes them, "space", which replaces them by a single space, and "drop", which simply removes them from the string.rr}r(h.jh/jubaubaubjX)r}r(h.XOsecurepath - used for creating pathnames suitable for use in dynafile templatesh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r }r (h.XOsecurepath - used for creating pathnames suitable for use in dynafile templatesr h/jh8h9h:hXh<}r (h>]h?]h@]hA]hD]uhFKhH]r hQXOsecurepath - used for creating pathnames suitable for use in dynafile templatesrr}r(h.j h/j ubaubaubjX)r}r(h.X;format - specify format on a field basis. Supported values are: - "`csv `_\ " for use when csv-data is generated - "`json `_\ " which formats proper json content (but without a field header) - "`jsonf `_\ " which formats as a complete json field - "`jsonr `_\ " which avoids double escaping the value but makes it safe for a json field - "`jsonfr `_\ " which is the combination of "jsonf" and "jsonr". h/jh8Nh:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]r(hU)r}r(h.X?format - specify format on a field basis. Supported values are:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX?format - specify format on a field basis. Supported values are:rr}r(h.jh/jubaubjQ)r}r(h.Uh<}r(jVX-hA]h@]h>]h?]hD]uh/jhH]r (jX)r!}r"(h.XJ"`csv `_\ " for use when csv-data is generatedh<}r#(h>]h?]h@]hA]hD]uh/jhH]r$hU)r%}r&(h.XJ"`csv `_\ " for use when csv-data is generatedh/j!h8h9h:hXh<}r'(h>]h?]h@]hA]hD]uhFKhH]r((hQX"r)}r*(h.X"h/j%ubh)r+}r,(h.X#`csv `_h<}r-(UnamehhXproperty_replacer.html#csvr.hA]h@]h>]h?]hD]uh/j%hH]r/hQXcsvr0r1}r2(h.Uh/j+ubah:hubh)r3}r4(h.X h3Kh/j%h:hh<}r5(Urefurij.hA]r6Ucsvr7ah@]h>]h?]hD]r8hauhH]ubhQX$" for use when csv-data is generatedr9r:}r;(h.X&\ " for use when csv-data is generatedh/j%ubeubah:j\ubjX)r<}r=(h.Xh"`json `_\ " which formats proper json content (but without a field header)h<}r>(h>]h?]h@]hA]hD]uh/jhH]r?hU)r@}rA(h.Xh"`json `_\ " which formats proper json content (but without a field header)h/j<h8h9h:hXh<}rB(h>]h?]h@]hA]hD]uhFKhH]rC(hQX"rD}rE(h.X"h/j@ubh)rF}rG(h.X%`json `_h<}rH(UnamehhXproperty_replacer.html#jsonrIhA]h@]h>]h?]hD]uh/j@hH]rJhQXjsonrKrL}rM(h.Uh/jFubah:hubh)rN}rO(h.X h3Kh/j@h:hh<}rP(UrefurijIhA]rQUjsonrRah@]h>]h?]hD]rShauhH]ubhQX@" which formats proper json content (but without a field header)rTrU}rV(h.XB\ " which formats proper json content (but without a field header)h/j@ubeubah:j\ubjX)rW}rX(h.XR"`jsonf `_\ " which formats as a complete json fieldh<}rY(h>]h?]h@]hA]hD]uh/jhH]rZhU)r[}r\(h.XR"`jsonf `_\ " which formats as a complete json fieldh/jWh8h9h:hXh<}r](h>]h?]h@]hA]hD]uhFKhH]r^(hQX"r_}r`(h.X"h/j[ubh)ra}rb(h.X'`jsonf `_h<}rc(UnamehhXproperty_replacer.html#jsonfrdhA]h@]h>]h?]hD]uh/j[hH]rehQXjsonfrfrg}rh(h.Uh/jaubah:hubh)ri}rj(h.X h3Kh/j[h:hh<}rk(UrefurijdhA]rlUjsonfrmah@]h>]h?]hD]rnhauhH]ubhQX(" which formats as a complete json fieldrorp}rq(h.X*\ " which formats as a complete json fieldh/j[ubeubah:j\ubjX)rr}rs(h.Xu"`jsonr `_\ " which avoids double escaping the value but makes it safe for a json fieldh<}rt(h>]h?]h@]hA]hD]uh/jhH]ruhU)rv}rw(h.Xu"`jsonr `_\ " which avoids double escaping the value but makes it safe for a json fieldh/jrh8h9h:hXh<}rx(h>]h?]h@]hA]hD]uhFKhH]ry(hQX"rz}r{(h.X"h/jvubh)r|}r}(h.X'`jsonr `_h<}r~(Unameh&hXproperty_replacer.html#jsonrrhA]h@]h>]h?]hD]uh/jvhH]rhQXjsonrrr}r(h.Uh/j|ubah:hubh)r}r(h.X h3Kh/jvh:hh<}r(UrefurijhA]rUjsonrrah@]h>]h?]hD]rh&auhH]ubhQXK" which avoids double escaping the value but makes it safe for a json fieldrr}r(h.XM\ " which avoids double escaping the value but makes it safe for a json fieldh/jvubeubah:j\ubjX)r}r(h.X_"`jsonfr `_\ " which is the combination of "jsonf" and "jsonr". h<}r(h>]h?]h@]hA]hD]uh/jhH]rhU)r}r(h.X^"`jsonfr `_\ " which is the combination of "jsonf" and "jsonr".h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]r(hQX"r}r(h.X"h/jubh)r}r(h.X)`jsonfr `_h<}r(UnamehhXproperty_replacer.html#jsonfrrhA]h@]h>]h?]hD]uh/jhH]rhQXjsonfrrr}r(h.Uh/jubah:hubh)r}r(h.X h3Kh/jh:hh<}r(UrefurijhA]rUjsonfrrah@]h>]h?]hD]rhauhH]ubhQX2" which is the combination of "jsonf" and "jsonr".rr}r(h.X4\ " which is the combination of "jsonf" and "jsonr".h/jubeubah:j\ubeh:jTubeubjX)r}r(h.XVposition.from - obtain substring starting from this position (1 is the first position)h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.XVposition.from - obtain substring starting from this position (1 is the first position)rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXVposition.from - obtain substring starting from this position (1 is the first position)rr}r(h.jh/jubaubaubjX)r}r(h.X2position.to - obtain substring up to this positionrh/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.jh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX2position.to - obtain substring up to this positionrr}r(h.jh/jubaubaubjX)r}r(h.Xposition.relativeToEnd - the from and to position is relative to the end of the string instead of the usual start of string. (available since rsyslog v7.3.10)h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.Xposition.relativeToEnd - the from and to position is relative to the end of the string instead of the usual start of string. (available since rsyslog v7.3.10)rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXposition.relativeToEnd - the from and to position is relative to the end of the string instead of the usual start of string. (available since rsyslog v7.3.10)rr}r(h.jh/jubaubaubjX)r}r(h.Xfixedwidth - changes behaviour of position.to so that it pads the source string with spaces up to the value of position.to if the source string is shorter. "on" or "off" (default) (available since rsyslog v8.13.0)h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.Xfixedwidth - changes behaviour of position.to so that it pads the source string with spaces up to the value of position.to if the source string is shorter. "on" or "off" (default) (available since rsyslog v8.13.0)rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXfixedwidth - changes behaviour of position.to so that it pads the source string with spaces up to the value of position.to if the source string is shorter. "on" or "off" (default) (available since rsyslog v8.13.0)rr}r(h.jh/jubaubaubjX)r}r(h.XVcompressspace - compresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the **position.from** and **position.to** positions are **NOT** affected by this option. (available since v8.18.0).h/jh8Nh:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rcdocutils.nodes definition_list r)r}r(h.Uh<}r(h>]h?]h@]hA]hD]uh/jhH]rcdocutils.nodes definition_list_item r)r}r(h.XRcompressspace - compresses multiple spaces (US-ASCII SP character) inside the string to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the **position.from** and **position.to** positions are **NOT** affected by this option. (available since v8.18.0).h/jh8h9h:Udefinition_list_itemrh<}r(h>]h?]h@]hA]hD]uhFKhH]r(cdocutils.nodes term r)r}r(h.XMcompressspace - compresses multiple spaces (US-ASCII SP character) inside therh/jh8h9h:Utermrh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQXMcompressspace - compresses multiple spaces (US-ASCII SP character) inside therr}r(h.jh/jubaubcdocutils.nodes definition r)r}r(h.Uh<}r(h>]h?]h@]hA]hD]uh/jhH]rhU)r}r(h.Xstring to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the **position.from** and **position.to** positions are **NOT** affected by this option. (available since v8.18.0).h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]r(hQXstring to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the rr}r(h.Xstring to a single one. This compression happens at a very late stage in processing. Most importantly, it happens after substring extraction, so the h/jubhj)r}r(h.X**position.from**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX position.fromrr}r(h.Uh/jubah:hrubhQX and rr}r(h.X and h/jubhj)r}r(h.X**position.to**h<}r (h>]h?]h@]hA]hD]uh/jhH]r hQX position.tor r }r (h.Uh/jubah:hrubhQX positions are rr}r(h.X positions are h/jubhj)r}r(h.X**NOT**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXNOTrr}r(h.Uh/jubah:hrubhQX4 affected by this option. (available since v8.18.0).rr}r(h.X4 affected by this option. (available since v8.18.0).h/jubeubah:U definitionrubeubah:Udefinition_listrubaubjX)r}r(h.X&field.number - obtain this field matchrh/jh8h9h:j\h<}r (h>]h?]h@]hA]hD]uhFNhGhhH]r!hU)r"}r#(h.jh/jh8h9h:hXh<}r$(h>]h?]h@]hA]hD]uhFKhH]r%hQX&field.number - obtain this field matchr&r'}r((h.jh/j"ubaubaubjX)r)}r*(h.XKfield.delimiter - decimal value of delimiter character for field extractionh/jh8h9h:j\h<}r+(h>]h?]h@]hA]hD]uhFNhGhhH]r,hU)r-}r.(h.XKfield.delimiter - decimal value of delimiter character for field extractionr/h/j)h8h9h:hXh<}r0(h>]h?]h@]hA]hD]uhFKhH]r1hQXKfield.delimiter - decimal value of delimiter character for field extractionr2r3}r4(h.j/h/j-ubaubaubjX)r5}r6(h.X$regex.expression - expression to user7h/jh8h9h:j\h<}r8(h>]h?]h@]hA]hD]uhFNhGhhH]r9hU)r:}r;(h.j7h/j5h8h9h:hXh<}r<(h>]h?]h@]hA]hD]uhFKhH]r=hQX$regex.expression - expression to user>r?}r@(h.j7h/j:ubaubaubjX)rA}rB(h.Xregex.type - either ERE or BRErCh/jh8h9h:j\h<}rD(h>]h?]h@]hA]hD]uhFNhGhhH]rEhU)rF}rG(h.jCh/jAh8h9h:hXh<}rH(h>]h?]h@]hA]hD]uhFKhH]rIhQXregex.type - either ERE or BRErJrK}rL(h.jCh/jFubaubaubjX)rM}rN(h.X2regex.nomatchmode - what to do if we have no matchrOh/jh8h9h:j\h<}rP(h>]h?]h@]hA]hD]uhFNhGhhH]rQhU)rR}rS(h.jOh/jMh8h9h:hXh<}rT(h>]h?]h@]hA]hD]uhFKhH]rUhQX2regex.nomatchmode - what to do if we have no matchrVrW}rX(h.jOh/jRubaubaubjX)rY}rZ(h.Xregex.match - match to user[h/jh8h9h:j\h<}r\(h>]h?]h@]hA]hD]uhFNhGhhH]r]hU)r^}r_(h.j[h/jYh8h9h:hXh<}r`(h>]h?]h@]hA]hD]uhFKhH]rahQXregex.match - match to userbrc}rd(h.j[h/j^ubaubaubjX)re}rf(h.X regex.submatch - submatch to usergh/jh8h9h:j\h<}rh(h>]h?]h@]hA]hD]uhFNhGhhH]rihU)rj}rk(h.jgh/jeh8h9h:hXh<}rl(h>]h?]h@]hA]hD]uhFKhH]rmhQX regex.submatch - submatch to usernro}rp(h.jgh/jjubaubaubjX)rq}rr(h.X1droplastlf - drop a trailing LF, if it is presentrsh/jh8h9h:j\h<}rt(h>]h?]h@]hA]hD]uhFNhGhhH]ruhU)rv}rw(h.jsh/jqh8h9h:hXh<}rx(h>]h?]h@]hA]hD]uhFKhH]ryhQX1droplastlf - drop a trailing LF, if it is presentrzr{}r|(h.jsh/jvubaubaubjX)r}}r~(h.X;mandatory - signifies a field as mandatory. If set to "on", this field will always be present in data passed to structured outputs, even if it is empty. If "off" (the default) empty fields will not be passed to structured outputs. This is especially useful for outputs that support dynamic schemas (like ommongodb).h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X;mandatory - signifies a field as mandatory. If set to "on", this field will always be present in data passed to structured outputs, even if it is empty. If "off" (the default) empty fields will not be passed to structured outputs. This is especially useful for outputs that support dynamic schemas (like ommongodb).rh/j}h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX;mandatory - signifies a field as mandatory. If set to "on", this field will always be present in data passed to structured outputs, even if it is empty. If "off" (the default) empty fields will not be passed to structured outputs. This is especially useful for outputs that support dynamic schemas (like ommongodb).rr}r(h.jh/jubaubaubjX)r}r(h.X=spifno1stsp - expert options for RFC3164 template processing h/jh8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X<spifno1stsp - expert options for RFC3164 template processingrh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhH]rhQX<spifno1stsp - expert options for RFC3164 template processingrr}r(h.jh/jubaubaubeubeubeubh0)r}r(h.Uh/hh8h9h:h;h<}r(h>]h?]h@]hA]rUsubtreerahD]rh"auhFKhGhhH]r(hJ)r}r(h.Xsubtreerh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQXsubtreerr}r(h.jh/jubaubhU)r}r(h.XAvailable since rsyslog 7.1.4rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQXAvailable since rsyslog 7.1.4rr}r(h.jh/jubaubhU)r}r(h.XIn this case, the template is generated based on a complete (CEE) subtree. This type of template is most useful for outputs that know how to process hierarchical structure, like ommongodb. With that type, the parameter **subtree** must be specified, which tells which subtree to use. For example template(name="tpl1" type="subtree" subtree="$!") includes all CEE data, while template(name="tpl2" type="subtree" subtree="$!usr!tpl2") includes only the subtree starting at $!usr!tpl2. The core idea when using this type of template is that the actual data is prefabricated via set and unset script statements, and the resulting structure is then used inside the template. This method MUST be used if a complete subtree needs to be placed *directly* into the object's root. With all other template types, only subcontainers can be generated. Note that subtree type can also be used with text-based outputs, like omfile. HOWEVER, you do not have any capability to specify constant text, and as such cannot include line breaks. As a consequence, using this template type for text outputs is usually only useful for debugging or very special cases (e.g. where the text is interpreted by a JSON parser later on).h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]r(hQXIn this case, the template is generated based on a complete (CEE) subtree. This type of template is most useful for outputs that know how to process hierarchical structure, like ommongodb. With that type, the parameter rr}r(h.XIn this case, the template is generated based on a complete (CEE) subtree. This type of template is most useful for outputs that know how to process hierarchical structure, like ommongodb. With that type, the parameter h/jubhj)r}r(h.X **subtree**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXsubtreerr}r(h.Uh/jubah:hrubhQX must be specified, which tells which subtree to use. For example template(name="tpl1" type="subtree" subtree="$!") includes all CEE data, while template(name="tpl2" type="subtree" subtree="$!usr!tpl2") includes only the subtree starting at $!usr!tpl2. The core idea when using this type of template is that the actual data is prefabricated via set and unset script statements, and the resulting structure is then used inside the template. This method MUST be used if a complete subtree needs to be placed rr}r(h.X must be specified, which tells which subtree to use. For example template(name="tpl1" type="subtree" subtree="$!") includes all CEE data, while template(name="tpl2" type="subtree" subtree="$!usr!tpl2") includes only the subtree starting at $!usr!tpl2. The core idea when using this type of template is that the actual data is prefabricated via set and unset script statements, and the resulting structure is then used inside the template. This method MUST be used if a complete subtree needs to be placed h/jubcdocutils.nodes emphasis r)r}r(h.X *directly*h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXdirectlyrr}r(h.Uh/jubah:UemphasisrubhQX into the object's root. With all other template types, only subcontainers can be generated. Note that subtree type can also be used with text-based outputs, like omfile. HOWEVER, you do not have any capability to specify constant text, and as such cannot include line breaks. As a consequence, using this template type for text outputs is usually only useful for debugging or very special cases (e.g. where the text is interpreted by a JSON parser later on).rr}r(h.X into the object's root. With all other template types, only subcontainers can be generated. Note that subtree type can also be used with text-based outputs, like omfile. HOWEVER, you do not have any capability to specify constant text, and as such cannot include line breaks. As a consequence, using this template type for text outputs is usually only useful for debugging or very special cases (e.g. where the text is interpreted by a JSON parser later on).h/jubeubh0)r}r(h.Uh/jh8h9h:h;h<}r(h>]h?]h@]hA]rUuse-caserahD]rhauhFKhGhhH]r(hJ)r}r(h.XUse caserh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFKhGhhH]rhQXUse caserr}r(h.jh/jubaubhU)r}r(h.XyA typical use case is to first create a custom subtree and then include it into the template, like in this small example:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQXyA typical use case is to first create a custom subtree and then include it into the template, like in this small example:rr}r(h.jh/jubaubh)r}r(h.Xset $!usr!tpl2!msg = $msg; set $!usr!tpl2!dataflow = field($msg, 58, 2); template(name="tpl2" type="subtree" subtree="$!usr!tpl2")h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXset $!usr!tpl2!msg = $msg; set $!usr!tpl2!dataflow = field($msg, 58, 2); template(name="tpl2" type="subtree" subtree="$!usr!tpl2")rr}r(h.Uh/jubaubhU)r}r(h.XHere, we assume that $msg contains various fields, and the data from a field is to be extracted and stored - together with the message - as field content.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM hGhhH]rhQXHere, we assume that $msg contains various fields, and the data from a field is to be extracted and stored - together with the message - as field content.rr}r(h.jh/jubaubeubeubh0)r}r(h.Uh3Kh/hh8h9h:h;h<}r(h>]rXstringrah?]h@]hA]rUstringrahD]uhFMhGhhH]r(hJ)r}r(h.Xstringrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQXstringrr}r(h.jh/jubaubhU)r}r(h.XThis closely resembles the legacy template statement. It has a mandatory parameter **string**, which holds the template string to be applied. A template string is a mix of constant text and replacement variables (see property replacer). These variables are taken from message or other dynamic content when the final string to be passed to a plugin is generated. String-based templates are a great way to specify textual content, especially if no complex manipulation to properties is necessary.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]r(hQXSThis closely resembles the legacy template statement. It has a mandatory parameter rr}r(h.XSThis closely resembles the legacy template statement. It has a mandatory parameter h/jubhj)r}r(h.X **string**h<}r(h>]h?]h@]hA]hD]uh/jhH]r hQXstringr r }r (h.Uh/jubah:hrubhQX, which holds the template string to be applied. A template string is a mix of constant text and replacement variables (see property replacer). These variables are taken from message or other dynamic content when the final string to be passed to a plugin is generated. String-based templates are a great way to specify textual content, especially if no complex manipulation to properties is necessary.r r}r(h.X, which holds the template string to be applied. A template string is a mix of constant text and replacement variables (see property replacer). These variables are taken from message or other dynamic content when the final string to be passed to a plugin is generated. String-based templates are a great way to specify textual content, especially if no complex manipulation to properties is necessary.h/jubeubhU)r}r(h.X-This is a sample for a string-based template:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX-This is a sample for a string-based template:rr}r(h.jh/jubaubh)r}r(h.Xtemplate(name="tpl3" type="string" string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" )h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXtemplate(name="tpl3" type="string" string="%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" )rr}r(h.Uh/jubaubhU)r}r (h.XtThe text between percent signs ('%') is interpreted by the rsyslog :doc:`property replacer `. In a nutshell, it contains the property to use as well as options for formatting and further processing. This is very similar to what the ``property`` object in list templates does (it actually is just a different language to express most of the same things).h/jh8h9h:hXh<}r!(h>]h?]h@]hA]hD]uhFM"hGhhH]r"(hQXCThe text between percent signs ('%') is interpreted by the rsyslog r#r$}r%(h.XCThe text between percent signs ('%') is interpreted by the rsyslog h/jubhv)r&}r'(h.X,:doc:`property replacer `r(h/jh8h9h:hzh<}r)(UreftypeXdocr*h}h~Xproperty_replacerU refdomainUhA]h@]U refexplicith>]h?]hD]hhuhFM"hH]r+h)r,}r-(h.j(h<}r.(h>]h?]r/(hj*eh@]hA]hD]uh/j&hH]r0hQXproperty replacerr1r2}r3(h.Uh/j,ubah:hubaubhQX. In a nutshell, it contains the property to use as well as options for formatting and further processing. This is very similar to what the r4r5}r6(h.X. In a nutshell, it contains the property to use as well as options for formatting and further processing. This is very similar to what the h/jubh)r7}r8(h.X ``property``h<}r9(h>]h?]h@]hA]hD]uh/jhH]r:hQXpropertyr;r<}r=(h.Uh/j7ubah:hubhQXm object in list templates does (it actually is just a different language to express most of the same things).r>r?}r@(h.Xm object in list templates does (it actually is just a different language to express most of the same things).h/jubeubhU)rA}rB(h.XEverything outside of the percent signs is constant text. In the above case, we have mostly spaces between the property values. At the end of the string, an escape sequence is used.rCh/jh8h9h:hXh<}rD(h>]h?]h@]hA]hD]uhFM)hGhhH]rEhQXEverything outside of the percent signs is constant text. In the above case, we have mostly spaces between the property values. At the end of the string, an escape sequence is used.rFrG}rH(h.jCh/jAubaubhU)rI}rJ(h.XEscape sequences permit to specify nonprintable characters. They work very similar to escape sequences in C and many other languages. They are initiated by the backslash characters and followed by one or more characters that specify the actual character. For example \\7 is the US-ASCII BEL character and \\n is a newline. The set is similar to what C and perl support, but a bit more limited.h/jh8h9h:hXh<}rK(h>]h?]h@]hA]hD]uhFM-hGhhH]rLhQXEscape sequences permit to specify nonprintable characters. They work very similar to escape sequences in C and many other languages. They are initiated by the backslash characters and followed by one or more characters that specify the actual character. For example \7 is the US-ASCII BEL character and \n is a newline. The set is similar to what C and perl support, but a bit more limited.rMrN}rO(h.XEscape sequences permit to specify nonprintable characters. They work very similar to escape sequences in C and many other languages. They are initiated by the backslash characters and followed by one or more characters that specify the actual character. For example \\7 is the US-ASCII BEL character and \\n is a newline. The set is similar to what C and perl support, but a bit more limited.h/jIubaubeubh0)rP}rQ(h.Uh3Kh/hh8h9h:h;h<}rR(h>]rSXpluginrTah?]h@]hA]rUUpluginrVahD]uhFM5hGhhH]rW(hJ)rX}rY(h.XpluginrZh/jPh8h9h:hNh<}r[(h>]h?]h@]hA]hD]uhFM5hGhhH]r\hQXpluginr]r^}r_(h.jZh/jXubaubhU)r`}ra(h.XqIn this case, the template is generated by a plugin (which is then called a "strgen" or "string generator"). The format is fixed as it is coded. While this is inflexible, it provides superior performance, and is often used for that reason (not that "regular" templates are slow - but in very demanding environments that "last bit" can make a difference). Refer to the plugin's documentation for further details. For this type, the parameter **plugin** must be specified and must contain the name of the plugin as it identifies itself. Note that the plugin must be loaded prior to being used inside a template. Config example:h/jPh8h9h:hXh<}rb(h>]h?]h@]hA]hD]uhFM7hGhhH]rc(hQXIn this case, the template is generated by a plugin (which is then called a "strgen" or "string generator"). The format is fixed as it is coded. While this is inflexible, it provides superior performance, and is often used for that reason (not that "regular" templates are slow - but in very demanding environments that "last bit" can make a difference). Refer to the plugin's documentation for further details. For this type, the parameter rdre}rf(h.XIn this case, the template is generated by a plugin (which is then called a "strgen" or "string generator"). The format is fixed as it is coded. While this is inflexible, it provides superior performance, and is often used for that reason (not that "regular" templates are slow - but in very demanding environments that "last bit" can make a difference). Refer to the plugin's documentation for further details. For this type, the parameter h/j`ubhj)rg}rh(h.X **plugin**h<}ri(h>]h?]h@]hA]hD]uh/j`hH]rjhQXpluginrkrl}rm(h.Uh/jgubah:hrubhQX must be specified and must contain the name of the plugin as it identifies itself. Note that the plugin must be loaded prior to being used inside a template. Config example:rnro}rp(h.X must be specified and must contain the name of the plugin as it identifies itself. Note that the plugin must be loaded prior to being used inside a template. Config example:h/j`ubeubcdocutils.nodes block_quote rq)rr}rs(h.Uh/jPh8h9h:U block_quoterth<}ru(h>]h?]h@]hA]hD]uhFNhGhhH]rvhU)rw}rx(h.X9``template(name="tpl4" type="plugin" plugin="mystrgen")``ryh/jrh8h9h:hXh<}rz(h>]h?]h@]hA]hD]uhFMBhH]r{h)r|}r}(h.jyh<}r~(h>]h?]h@]hA]hD]uh/jwhH]rhQX5template(name="tpl4" type="plugin" plugin="mystrgen")rr}r(h.Uh/j|ubah:hubaubaubeubh0)r}r(h.Uh/hh8h9h:h;h<}r(h>]h?]h@]hA]rUoptionsrahD]rh%auhFMEhGhhH]r(hJ)r}r(h.Xoptionsrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMEhGhhH]rhQXoptionsrr}r(h.jh/jubaubhU)r}r(h.XThe part is optional. It carries options influencing the template as a whole and is a part of the template parameters. See details below. Be sure NOT to mistake template options with property options - the latter ones are processed by the property replacer and apply to a SINGLE property, only (and not the whole template). Template options are case-insensitive. Currently defined are:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMGhGhhH]rhQXThe part is optional. It carries options influencing the template as a whole and is a part of the template parameters. See details below. Be sure NOT to mistake template options with property options - the latter ones are processed by the property replacer and apply to a SINGLE property, only (and not the whole template). Template options are case-insensitive. Currently defined are:rr}r(h.jh/jubaubhU)r}r(h.Xl**option.sql** - format the string suitable for a SQL statement in MySQL format. This will replace single quotes ("'") and the backslash character by their backslash-escaped counterpart ("\\'" and "\\\\") inside each field. Please note that in MySQL configuration, the ``NO_BACKSLASH_ESCAPES`` mode must be turned off for this format to work (this is the default).h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMNhGhhH]r(hj)r}r(h.X**option.sql**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX option.sqlrr}r(h.Uh/jubah:hrubhQX - format the string suitable for a SQL statement in MySQL format. This will replace single quotes ("'") and the backslash character by their backslash-escaped counterpart ("\'" and "\\") inside each field. Please note that in MySQL configuration, the rr}r(h.X - format the string suitable for a SQL statement in MySQL format. This will replace single quotes ("'") and the backslash character by their backslash-escaped counterpart ("\\'" and "\\\\") inside each field. Please note that in MySQL configuration, the h/jubh)r}r(h.X``NO_BACKSLASH_ESCAPES``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXNO_BACKSLASH_ESCAPESrr}r(h.Uh/jubah:hubhQXG mode must be turned off for this format to work (this is the default).rr}r(h.XG mode must be turned off for this format to work (this is the default).h/jubeubhU)r}r(h.X<**option.stdsql** - format the string suitable for a SQL statement that is to be sent to a standards-compliant sql server. This will replace single quotes ("'") by two single quotes ("''") inside each field. You must use stdsql together with MySQL if in MySQL configuration the ``NO_BACKSLASH_ESCAPES`` is turned on.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMUhGhhH]r(hj)r}r(h.X**option.stdsql**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX option.stdsqlrr}r(h.Uh/jubah:hrubhQX - format the string suitable for a SQL statement that is to be sent to a standards-compliant sql server. This will replace single quotes ("'") by two single quotes ("''") inside each field. You must use stdsql together with MySQL if in MySQL configuration the rr}r(h.X - format the string suitable for a SQL statement that is to be sent to a standards-compliant sql server. This will replace single quotes ("'") by two single quotes ("''") inside each field. You must use stdsql together with MySQL if in MySQL configuration the h/jubh)r}r(h.X``NO_BACKSLASH_ESCAPES``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXNO_BACKSLASH_ESCAPESrr}r(h.Uh/jubah:hubhQX is turned on.rr}r(h.X is turned on.h/jubeubhU)r}r(h.X**option.json** - format the string suitable for a json statement. This will replace single quotes ("'") by two single quotes ("''") inside each field.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM[hGhhH]r(hj)r}r(h.X**option.json**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX option.jsonrr}r(h.Uh/jubah:hrubhQX - format the string suitable for a json statement. This will replace single quotes ("'") by two single quotes ("''") inside each field.rr}r(h.X - format the string suitable for a json statement. This will replace single quotes ("'") by two single quotes ("''") inside each field.h/jubeubhU)r}r(h.X**option.casesensitive** - treat property name references as case sensitive. The default is "off", where all property name references are first converted to lowercase during template definition. With this option turned "on", property names are looked up as defined in the template. Use this option if you have JSON (``$!*``), local (``!.*``), or global (``$!\\*``) properties which container uppercase letters. The normal Rsyslog properties are case-insensitive, so this option is not needed for properly referencing those properties.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM_hGhhH]r(hj)r}r(h.X**option.casesensitive**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXoption.casesensitiverr}r(h.Uh/jubah:hrubhQX$ - treat property name references as case sensitive. The default is "off", where all property name references are first converted to lowercase during template definition. With this option turned "on", property names are looked up as defined in the template. Use this option if you have JSON (rr}r(h.X$ - treat property name references as case sensitive. The default is "off", where all property name references are first converted to lowercase during template definition. With this option turned "on", property names are looked up as defined in the template. Use this option if you have JSON (h/jubh)r}r(h.X``$!*``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX$!*rr}r(h.Uh/jubah:hubhQX ), local (rr}r(h.X ), local (h/jubh)r}r(h.X``!.*``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX!.*rr}r(h.Uh/jubah:hubhQX), or global (rr}r(h.X), or global (h/jubh)r}r(h.X ``$!\\*``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX$!\\*rr}r(h.Uh/jubah:hubhQX) properties which container uppercase letters. The normal Rsyslog properties are case-insensitive, so this option is not needed for properly referencing those properties.rr}r(h.X) properties which container uppercase letters. The normal Rsyslog properties are case-insensitive, so this option is not needed for properly referencing those properties.h/jubeubhU)r}r(h.XThe use the options **option.sql**, **option.stdsql**, and **option.json** are mutually exclusive. Using more than one at the same time can cause unpredictable behaviour.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhhGhhH]r(hQXThe use the options rr }r (h.XThe use the options h/jubhj)r }r (h.X**option.sql**h<}r (h>]h?]h@]hA]hD]uh/jhH]rhQX option.sqlrr}r(h.Uh/j ubah:hrubhQX, rr}r(h.X, h/jubhj)r}r(h.X**option.stdsql**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX option.stdsqlrr}r(h.Uh/jubah:hrubhQX, and rr}r(h.X, and h/jubhj)r}r (h.X**option.json**h<}r!(h>]h?]h@]hA]hD]uh/jhH]r"hQX option.jsonr#r$}r%(h.Uh/jubah:hrubhQX` are mutually exclusive. Using more than one at the same time can cause unpredictable behaviour.r&r'}r((h.X` are mutually exclusive. Using more than one at the same time can cause unpredictable behaviour.h/jubeubhU)r)}r*(h.X,Either the **sql** or **stdsql** option **must** be specified when a template is used for writing to a database, otherwise injection might occur. Please note that due to the unfortunate fact that several vendors have violated the sql standard and introduced their own escape methods, it is impossible to have a single option doing all the work.  So you yourself must make sure you are using the right format. **If you choose the wrong one, you are still vulnerable to sql injection.** Please note that the database writer *checks* that the sql option is present in the template. If it is not present, the write database action is disabled. This is to guard you against accidentally forgetting it and then becoming vulnerable to SQL injection. The sql option can also be useful with files - especially if you want to import them into a database on another machine for performance reasons. However, do NOT use it if you do not have a real need for it - among others, it takes some toll on the processing time. Not much, but on a really busy system you might notice it.h/jh8h9h:hXh<}r+(h>]h?]h@]hA]hD]uhFMlhGhhH]r,(hQX Either the r-r.}r/(h.X Either the h/j)ubhj)r0}r1(h.X**sql**h<}r2(h>]h?]h@]hA]hD]uh/j)hH]r3hQXsqlr4r5}r6(h.Uh/j0ubah:hrubhQX or r7r8}r9(h.X or h/j)ubhj)r:}r;(h.X **stdsql**h<}r<(h>]h?]h@]hA]hD]uh/j)hH]r=hQXstdsqlr>r?}r@(h.Uh/j:ubah:hrubhQX  option rArB}rC(h.X  option h/j)ubhj)rD}rE(h.X**must**h<}rF(h>]h?]h@]hA]hD]uh/j)hH]rGhQXmustrHrI}rJ(h.Uh/jDubah:hrubhQXj be specified when a template is used for writing to a database, otherwise injection might occur. Please note that due to the unfortunate fact that several vendors have violated the sql standard and introduced their own escape methods, it is impossible to have a single option doing all the work.  So you yourself must make sure you are using the right format. rKrL}rM(h.Xj be specified when a template is used for writing to a database, otherwise injection might occur. Please note that due to the unfortunate fact that several vendors have violated the sql standard and introduced their own escape methods, it is impossible to have a single option doing all the work.  So you yourself must make sure you are using the right format. h/j)ubhj)rN}rO(h.XK**If you choose the wrong one, you are still vulnerable to sql injection.**h<}rP(h>]h?]h@]hA]hD]uh/j)hH]rQhQXGIf you choose the wrong one, you are still vulnerable to sql injection.rRrS}rT(h.Uh/jNubah:hrubhQX& Please note that the database writer rUrV}rW(h.X& Please note that the database writer h/j)ubj)rX}rY(h.X*checks*h<}rZ(h>]h?]h@]hA]hD]uh/j)hH]r[hQXchecksr\r]}r^(h.Uh/jXubah:jubhQX that the sql option is present in the template. If it is not present, the write database action is disabled. This is to guard you against accidentally forgetting it and then becoming vulnerable to SQL injection. The sql option can also be useful with files - especially if you want to import them into a database on another machine for performance reasons. However, do NOT use it if you do not have a real need for it - among others, it takes some toll on the processing time. Not much, but on a really busy system you might notice it.r_r`}ra(h.X that the sql option is present in the template. If it is not present, the write database action is disabled. This is to guard you against accidentally forgetting it and then becoming vulnerable to SQL injection. The sql option can also be useful with files - especially if you want to import them into a database on another machine for performance reasons. However, do NOT use it if you do not have a real need for it - among others, it takes some toll on the processing time. Not much, but on a really busy system you might notice it.h/j)ubeubhU)rb}rc(h.X~The default template for the write to database action has the sql option set. As we currently support only MySQL and the sql option matches the default MySQL configuration, this is a good choice. However, if you have turned on ``NO_BACKSLASH_ESCAPES`` in your MySQL config, you need to supply a template with the stdsql option. Otherwise you will become vulnerable to SQL injection.h/jh8h9h:hXh<}rd(h>]h?]h@]hA]hD]uhFM}hGhhH]re(hQXThe default template for the write to database action has the sql option set. As we currently support only MySQL and the sql option matches the default MySQL configuration, this is a good choice. However, if you have turned on rfrg}rh(h.XThe default template for the write to database action has the sql option set. As we currently support only MySQL and the sql option matches the default MySQL configuration, this is a good choice. However, if you have turned on h/jbubh)ri}rj(h.X``NO_BACKSLASH_ESCAPES``h<}rk(h>]h?]h@]hA]hD]uh/jbhH]rlhQXNO_BACKSLASH_ESCAPESrmrn}ro(h.Uh/jiubah:hubhQX in your MySQL config, you need to supply a template with the stdsql option. Otherwise you will become vulnerable to SQL injection.rprq}rr(h.X in your MySQL config, you need to supply a template with the stdsql option. Otherwise you will become vulnerable to SQL injection.h/jbubeubh)rs}rt(h.Xhtemplate (name="TraditionalFormat" type="string" string="%timegenerated% %HOSTNAME% %syslogtag%%msg%\\n"h/jh8h9h:hh<}ru(hhhA]h@]h>]h?]hD]uhFMhGhhH]rvhQXhtemplate (name="TraditionalFormat" type="string" string="%timegenerated% %HOSTNAME% %syslogtag%%msg%\\n"rwrx}ry(h.Uh/jsubaubeubh0)rz}r{(h.Uh/hh8h9h:h;h<}r|(h>]h?]h@]hA]r}Uexamplesr~ahD]rh auhFMhGhhH]r(hJ)r}r(h.XExamplesrh/jzh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQXExamplesrr}r(h.jh/jubaubh0)r}r(h.Uh/jzh8h9h:h;h<}r(h>]h?]h@]hA]rU&standard-template-for-writing-to-filesrahD]rhauhFMhGhhH]r(hJ)r}r(h.X&Standard Template for Writing to Filesrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX&Standard Template for Writing to Filesrr}r(h.jh/jubaubh)r}r(h.X>template(name="FileFormat" type="list") { property(name="timestamp" dateFormat="rfc3339") constant(value=" ") property(name="hostname") constant(value=" ") property(name="syslogtag") property(name="msg" spifno1stsp="on" ) property(name="msg" droplastlf="on" ) constant(value="\n") }h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQX>template(name="FileFormat" type="list") { property(name="timestamp" dateFormat="rfc3339") constant(value=" ") property(name="hostname") constant(value=" ") property(name="syslogtag") property(name="msg" spifno1stsp="on" ) property(name="msg" droplastlf="on" ) constant(value="\n") }rr}r(h.Uh/jubaubhU)r}r(h.X/The equivalent string template looks like this:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX/The equivalent string template looks like this:rr}r(h.jh/jubaubh)r}r(h.Xtemplate(name="FileFormat" type="string" string= "%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" )h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXtemplate(name="FileFormat" type="string" string= "%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" )rr}r(h.Uh/jubaubhU)r}r(h.X>Note that the template string itself must be on a single line.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX>Note that the template string itself must be on a single line.rr}r(h.jh/jubaubeubh0)r}r(h.Uh/jzh8h9h:h;h<}r(h>]h?]h@]hA]rU>standard-template-for-forwarding-to-a-remote-host-rfc3164-moderahD]rh auhFMhGhhH]r(hJ)r}r(h.X@Standard Template for Forwarding to a Remote Host (RFC3164 mode)rh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX@Standard Template for Forwarding to a Remote Host (RFC3164 mode)rr}r(h.jh/jubaubh)r}r(h.Xtemplate(name="ForwardFormat" type="list") { constant(value="<") property(name="pri") constant(value=">") property(name="timestamp" dateFormat="rfc3339") constant(value=" ") property(name="hostname") constant(value=" ") property(name="syslogtag" position.from="1" position.to="32") property(name="msg" spifno1stsp="on" ) property(name="msg") }h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXtemplate(name="ForwardFormat" type="list") { constant(value="<") property(name="pri") constant(value=">") property(name="timestamp" dateFormat="rfc3339") constant(value=" ") property(name="hostname") constant(value=" ") property(name="syslogtag" position.from="1" position.to="32") property(name="msg" spifno1stsp="on" ) property(name="msg") }rr}r(h.Uh/jubaubhU)r}r(h.X/The equivalent string template looks like this:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX/The equivalent string template looks like this:rr}r(h.jh/jubaubh)r}r(h.Xtemplate(name="forwardFormat" type="string" string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" )h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXtemplate(name="forwardFormat" type="string" string="<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" )rr}r(h.Uh/jubaubhU)r}r(h.X>Note that the template string itself must be on a single line.rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX>Note that the template string itself must be on a single line.rr}r(h.jh/jubaubeubh0)r}r(h.Uh/jzh8h9h:h;h<}r(h>]h?]h@]hA]rU1standard-template-for-write-to-the-mysql-databaserahD]rh auhFMhGhhH]r(hJ)r}r(h.X1Standard Template for write to the MySQL databaserh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX1Standard Template for write to the MySQL databaserr}r(h.jh/jubaubh)r}r(h.X.template(name="StdSQLformat" type="list" option.sql="on") { constant(value="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)") constant(value=" values ('") property(name="msg") constant(value="', ") property(name="syslogfacility") constant(value=", '") property(name="hostname") constant(value="', ") property(name="syslogpriority") constant(value=", '") property(name="timereported" dateFormat="mysql") constant(value="', '") property(name="timegenerated" dateFormat="mysql") constant(value="', ") property(name="iut") constant(value=", '") property(name="syslogtag") constant(value="')") }h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQX.template(name="StdSQLformat" type="list" option.sql="on") { constant(value="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag)") constant(value=" values ('") property(name="msg") constant(value="', ") property(name="syslogfacility") constant(value=", '") property(name="hostname") constant(value="', ") property(name="syslogpriority") constant(value=", '") property(name="timereported" dateFormat="mysql") constant(value="', '") property(name="timegenerated" dateFormat="mysql") constant(value="', ") property(name="iut") constant(value=", '") property(name="syslogtag") constant(value="')") }rr}r(h.Uh/jubaubhU)r}r(h.X/The equivalent string template looks like this:rh/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX/The equivalent string template looks like this:rr}r(h.jh/jubaubh)r}r(h.Xftemplate(name="stdSQLformat" type="string" option.sql="on" string="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')" )h/jh8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQXftemplate(name="stdSQLformat" type="string" option.sql="on" string="insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')" )rr}r(h.Uh/jubaubhU)r}r (h.X>Note that the template string itself must be on a single line.r h/jh8h9h:hXh<}r (h>]h?]h@]hA]hD]uhFMhGhhH]r hQX>Note that the template string itself must be on a single line.r r}r(h.j h/jubaubeubh0)r}r(h.Uh/jzh8h9h:h;h<}r(h>]h?]h@]hA]rU&creating-dynamic-file-names-for-omfilerahD]rhauhFMhGhhH]r(hJ)r}r(h.X&Creating Dynamic File Names for omfilerh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX&Creating Dynamic File Names for omfilerr}r(h.jh/jubaubhU)r}r (h.XTemplates can be used to generate actions with dynamic file names. For example, if you would like to split syslog messages from different hosts to different files (one per host), you can define the following template:r!h/jh8h9h:hXh<}r"(h>]h?]h@]hA]hD]uhFMhGhhH]r#hQXTemplates can be used to generate actions with dynamic file names. For example, if you would like to split syslog messages from different hosts to different files (one per host), you can define the following template:r$r%}r&(h.j!h/jubaubh)r'}r((h.XOtemplate (name="DynFile" type="string" string="/var/log/system-%HOSTNAME%.log")h/jh8h9h:hh<}r)(hhhA]h@]h>]h?]hD]uhFMhGhhH]r*hQXOtemplate (name="DynFile" type="string" string="/var/log/system-%HOSTNAME%.log")r+r,}r-(h.Uh/j'ubaubhU)r.}r/(h.XLegacy example:r0h/jh8h9h:hXh<}r1(h>]h?]h@]hA]hD]uhFMhGhhH]r2hQXLegacy example:r3r4}r5(h.j0h/j.ubaubh)r6}r7(h.X2$template DynFile,"/var/log/system-%HOSTNAME%.log"h/jh8h9h:hh<}r8(hhhA]h@]h>]h?]hD]uhFMhGhhH]r9hQX2$template DynFile,"/var/log/system-%HOSTNAME%.log"r:r;}r<(h.Uh/j6ubaubhU)r=}r>(h.XxThis template can then be used when defining an action. It will result in something like "/var/log/system-localhost.log"r?h/jh8h9h:hXh<}r@(h>]h?]h@]hA]hD]uhFMhGhhH]rAhQXxThis template can then be used when defining an action. It will result in something like "/var/log/system-localhost.log"rBrC}rD(h.j?h/j=ubaubeubeubeubh4h0)rE}rF(h.Uh/h6h8h9h:h;h<}rG(h>]h?]h@]hA]rHUreserved-template-namesrIahD]rJh#auhFM'hGhhH]rK(hJ)rL}rM(h.XReserved Template NamesrNh/jEh8h9h:hNh<}rO(h>]h?]h@]hA]hD]uhFM'hGhhH]rPhQXReserved Template NamesrQrR}rS(h.jNh/jLubaubhU)rT}rU(h.XTemplate names beginning with "RSYSLOG\_" are reserved for rsyslog use. Do NOT use them if, otherwise you may receive a conflict in the future (and quite unpredictable behaviour). There is a small set of pre-defined templates that you can use without the need to define it:h/jEh8h9h:hXh<}rV(h>]h?]h@]hA]hD]uhFM)hGhhH]rWhQXTemplate names beginning with "RSYSLOG_" are reserved for rsyslog use. Do NOT use them if, otherwise you may receive a conflict in the future (and quite unpredictable behaviour). There is a small set of pre-defined templates that you can use without the need to define it:rXrY}rZ(h.XTemplate names beginning with "RSYSLOG\_" are reserved for rsyslog use. Do NOT use them if, otherwise you may receive a conflict in the future (and quite unpredictable behaviour). There is a small set of pre-defined templates that you can use without the need to define it:h/jTubaubjQ)r[}r\(h.Uh/jEh8h9h:jTh<}r](jVX-hA]h@]h>]h?]hD]uhFM.hGhhH]r^(jX)r_}r`(h.Xj**RSYSLOG\_TraditionalFileFormat** - the "old style" default log file format with low-precision timestampsh/j[h8h9h:j\h<}ra(h>]h?]h@]hA]hD]uhFNhGhhH]rbhU)rc}rd(h.Xj**RSYSLOG\_TraditionalFileFormat** - the "old style" default log file format with low-precision timestampsh/j_h8h9h:hXh<}re(h>]h?]h@]hA]hD]uhFM.hH]rf(hj)rg}rh(h.X"**RSYSLOG\_TraditionalFileFormat**h<}ri(h>]h?]h@]hA]hD]uh/jchH]rjhQXRSYSLOG_TraditionalFileFormatrkrl}rm(h.Uh/jgubah:hrubhQXH - the "old style" default log file format with low-precision timestampsrnro}rp(h.XH - the "old style" default log file format with low-precision timestampsh/jcubeubaubjX)rq}rr(h.X**RSYSLOG\_FileFormat** - a modern-style logfile format similar to TraditionalFileFormat, both with high-precision timestamps and timezone informationh/j[h8h9h:j\h<}rs(h>]h?]h@]hA]hD]uhFNhGhhH]rthU)ru}rv(h.X**RSYSLOG\_FileFormat** - a modern-style logfile format similar to TraditionalFileFormat, both with high-precision timestamps and timezone informationh/jqh8h9h:hXh<}rw(h>]h?]h@]hA]hD]uhFM0hH]rx(hj)ry}rz(h.X**RSYSLOG\_FileFormat**h<}r{(h>]h?]h@]hA]hD]uh/juhH]r|hQXRSYSLOG_FileFormatr}r~}r(h.Uh/jyubah:hrubhQX - a modern-style logfile format similar to TraditionalFileFormat, both with high-precision timestamps and timezone informationrr}r(h.X - a modern-style logfile format similar to TraditionalFileFormat, both with high-precision timestamps and timezone informationh/juubeubaubjX)r}r(h.X**RSYSLOG\_TraditionalForwardFormat** - the traditional forwarding format with low-precision timestamps. Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5.h/j[h8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X**RSYSLOG\_TraditionalForwardFormat** - the traditional forwarding format with low-precision timestamps. Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM3hH]r(hj)r}r(h.X%**RSYSLOG\_TraditionalForwardFormat**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX RSYSLOG_TraditionalForwardFormatrr}r(h.Uh/jubah:hrubhQX - the traditional forwarding format with low-precision timestamps. Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5.rr}r(h.X - the traditional forwarding format with low-precision timestamps. Most useful if you send messages to other syslogd's or rsyslogd below version 3.12.5.h/jubeubaubjX)r}r(h.X**RSYSLOG\_SysklogdFileFormat** - sysklogd compatible log file format. If used with options: ``$SpaceLFOnReceive on``, ``$EscapeControlCharactersOnReceive off``, ``$DropTrailingLFOnReception off``, the log format will conform to sysklogd log format.h/j[h8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X**RSYSLOG\_SysklogdFileFormat** - sysklogd compatible log file format. If used with options: ``$SpaceLFOnReceive on``, ``$EscapeControlCharactersOnReceive off``, ``$DropTrailingLFOnReception off``, the log format will conform to sysklogd log format.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM6hH]r(hj)r}r(h.X**RSYSLOG\_SysklogdFileFormat**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXRSYSLOG_SysklogdFileFormatrr}r(h.Uh/jubah:hrubhQX> - sysklogd compatible log file format. If used with options: rr}r(h.X> - sysklogd compatible log file format. If used with options: h/jubh)r}r(h.X``$SpaceLFOnReceive on``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX$SpaceLFOnReceive onrr}r(h.Uh/jubah:hubhQX, rr}r(h.X, h/jubh)r}r(h.X)``$EscapeControlCharactersOnReceive off``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX%$EscapeControlCharactersOnReceive offrr}r(h.Uh/jubah:hubhQX, rr}r(h.X, h/jubh)r}r(h.X"``$DropTrailingLFOnReception off``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX$DropTrailingLFOnReception offrr}r(h.Uh/jubah:hubhQX5, the log format will conform to sysklogd log format.rr}r(h.X5, the log format will conform to sysklogd log format.h/jubeubaubjX)r}r(h.X**RSYSLOG\_ForwardFormat** - a new high-precision forwarding format very similar to the traditional one, but with high-precision timestamps and timezone information. Recommended to be used when sending messages to rsyslog 3.12.5 or above.h/j[h8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X**RSYSLOG\_ForwardFormat** - a new high-precision forwarding format very similar to the traditional one, but with high-precision timestamps and timezone information. Recommended to be used when sending messages to rsyslog 3.12.5 or above.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM:hH]r(hj)r}r(h.X**RSYSLOG\_ForwardFormat**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXRSYSLOG_ForwardFormatrr}r(h.Uh/jubah:hrubhQX - a new high-precision forwarding format very similar to the traditional one, but with high-precision timestamps and timezone information. Recommended to be used when sending messages to rsyslog 3.12.5 or above.rr}r(h.X - a new high-precision forwarding format very similar to the traditional one, but with high-precision timestamps and timezone information. Recommended to be used when sending messages to rsyslog 3.12.5 or above.h/jubeubaubjX)r}r(h.X**RSYSLOG\_SyslogProtocol23Format** - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed to become the new syslog standard RFC. This format includes several improvements. The rsyslog message parser understands this format, so you can use it together with all relatively recent versions of rsyslog. Other syslogd's may get hopelessly confused if receiving that format, so check before you use it. Note that the format is unlikely to change when the final RFC comes out, but this may happen.h/j[h8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X**RSYSLOG\_SyslogProtocol23Format** - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed to become the new syslog standard RFC. This format includes several improvements. The rsyslog message parser understands this format, so you can use it together with all relatively recent versions of rsyslog. Other syslogd's may get hopelessly confused if receiving that format, so check before you use it. Note that the format is unlikely to change when the final RFC comes out, but this may happen.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM>hH]r(hj)r}r(h.X#**RSYSLOG\_SyslogProtocol23Format**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXRSYSLOG_SyslogProtocol23Formatrr}r(h.Uh/jubah:hrubhQX - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed to become the new syslog standard RFC. This format includes several improvements. The rsyslog message parser understands this format, so you can use it together with all relatively recent versions of rsyslog. Other syslogd's may get hopelessly confused if receiving that format, so check before you use it. Note that the format is unlikely to change when the final RFC comes out, but this may happen.rr}r(h.X - the format specified in IETF's internet-draft ietf-syslog-protocol-23, which is assumed to become the new syslog standard RFC. This format includes several improvements. The rsyslog message parser understands this format, so you can use it together with all relatively recent versions of rsyslog. Other syslogd's may get hopelessly confused if receiving that format, so check before you use it. Note that the format is unlikely to change when the final RFC comes out, but this may happen.h/jubeubaubjX)r}r(h.X**RSYSLOG\_DebugFormat** - a special format used for troubleshooting property problems. This format is meant to be written to a log file. Do **not** use for production or remote forwarding. h/j[h8h9h:j\h<}r(h>]h?]h@]hA]hD]uhFNhGhhH]rhU)r}r(h.X**RSYSLOG\_DebugFormat** - a special format used for troubleshooting property problems. This format is meant to be written to a log file. Do **not** use for production or remote forwarding.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMFhH]r(hj)r}r(h.X**RSYSLOG\_DebugFormat**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXRSYSLOG_DebugFormatrr}r(h.Uh/jubah:hrubhQXu - a special format used for troubleshooting property problems. This format is meant to be written to a log file. Do rr}r(h.Xu - a special format used for troubleshooting property problems. This format is meant to be written to a log file. Do h/jubhj)r}r(h.X**not**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXnotrr}r(h.Uh/jubah:hrubhQX) use for production or remote forwarding.rr}r(h.X) use for production or remote forwarding.h/jubeubaubeubh0)r}r(h.Uh/jEh8h9h:h;h<}r(h>]h?]h@]hA]rU$legacy-string-based-template-samplesr ahD]r hauhFMNhGhhH]r (hJ)r }r (h.X$Legacy String-based Template Samplesrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMNhGhhH]rhQX$Legacy String-based Template Samplesrr}r(h.jh/j ubaubhU)r}r(h.X'This section provides some default templates in legacy format, as used in rsyslog previous to version 6. Note that this format is still supported, so there is no hard need to upgrade existing configurations. However, it is strongly recommended that the legacy constructs are not used when crafting new templates. Note that each $template statement is on a **single** line, but probably broken across several lines for display purposes by your browsers. Lines are separated by empty lines. Keep in mind, that line breaks are important in legacy format.h/jh8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMPhGhhH]r(hQXdThis section provides some default templates in legacy format, as used in rsyslog previous to version 6. Note that this format is still supported, so there is no hard need to upgrade existing configurations. However, it is strongly recommended that the legacy constructs are not used when crafting new templates. Note that each $template statement is on a rr}r(h.XdThis section provides some default templates in legacy format, as used in rsyslog previous to version 6. Note that this format is still supported, so there is no hard need to upgrade existing configurations. However, it is strongly recommended that the legacy constructs are not used when crafting new templates. Note that each $template statement is on a h/jubhj)r}r(h.X **single**h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQXsinglerr }r!(h.Uh/jubah:hrubhQX line, but probably broken across several lines for display purposes by your browsers. Lines are separated by empty lines. Keep in mind, that line breaks are important in legacy format.r"r#}r$(h.X line, but probably broken across several lines for display purposes by your browsers. Lines are separated by empty lines. Keep in mind, that line breaks are important in legacy format.h/jubeubh)r%}r&(h.X$template FileFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template TraditionalFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" $template TraditionalForwardFormat,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" $template StdSQLFormat,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL``h/jh8h9h:hh<}r'(hhhA]h@]h>]h?]hD]uhFM[hGhhH]r(hQX$template FileFormat,"%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template TraditionalFileFormat,"%TIMESTAMP% %HOSTNAME% %syslogtag%%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n" $template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3339% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" $template TraditionalForwardFormat,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%" $template StdSQLFormat,"insert into SystemEvents (Message, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')",SQL``r)r*}r+(h.Uh/j%ubaubeubeubh0)r,}r-(h.Uh/h6h8h9h:h;h<}r.(h>]h?]h@]hA]r/Usee-alsor0ahD]r1hauhFMbhGhhH]r2(hJ)r3}r4(h.XSee Alsor5h/j,h8h9h:hNh<}r6(h>]h?]h@]hA]hD]uhFMbhGhhH]r7hQXSee Alsor8r9}r:(h.j5h/j3ubaubjQ)r;}r<(h.Uh/j,h8h9h:jTh<}r=(jVX-hA]h@]h>]h?]hD]uhFMdhGhhH]r>(jX)r?}r@(h.XJ`How to bind a template `_h/j;h8h9h:j\h<}rA(h>]h?]h@]hA]hD]uhFNhGhhH]rBhU)rC}rD(h.XJ`How to bind a template `_rEh/j?h8h9h:hXh<}rF(h>]h?]h@]hA]hD]uhFMdhH]rG(h)rH}rI(h.jEh<}rJ(UnameXHow to bind a templatehX.http://www.rsyslog.com/how-to-bind-a-template/rKhA]h@]h>]h?]hD]uh/jChH]rLhQXHow to bind a templaterMrN}rO(h.Uh/jHubah:hubh)rP}rQ(h.X1 h3Kh/jCh:hh<}rR(UrefurijKhA]rSUhow-to-bind-a-templaterTah@]h>]h?]hD]rUhauhH]ubeubaubjX)rV}rW(h.XT`Adding the BOM to a message `_h/j;h8h9h:j\h<}rX(h>]h?]h@]hA]hD]uhFNhGhhH]rYhU)rZ}r[(h.XT`Adding the BOM to a message `_r\h/jVh8h9h:hXh<}r](h>]h?]h@]hA]hD]uhFMfhH]r^(h)r_}r`(h.j\h<}ra(UnameXAdding the BOM to a messagehX3http://www.rsyslog.com/adding-the-bom-to-a-message/rbhA]h@]h>]h?]hD]uh/jZhH]rchQXAdding the BOM to a messagerdre}rf(h.Uh/j_ubah:hubh)rg}rh(h.X6 h3Kh/jZh:hh<}ri(UrefurijbhA]rjUadding-the-bom-to-a-messagerkah@]h>]h?]hD]rlh auhH]ubeubaubjX)rm}rn(h.Xe`How to separate log files by host name of the sending device `_ h/j;h8h9h:j\h<}ro(h>]h?]h@]hA]hD]uhFNhGhhH]rphU)rq}rr(h.Xc`How to separate log files by host name of the sending device `_rsh/jmh8h9h:hXh<}rt(h>]h?]h@]hA]hD]uhFMhhH]ru(h)rv}rw(h.jsh<}rx(UnameX<How to separate log files by host name of the sending devicehX!http://www.rsyslog.com/article60/ryhA]h@]h>]h?]hD]uh/jqhH]rzhQX<How to separate log files by host name of the sending devicer{r|}r}(h.Uh/jvubah:hubh)r~}r(h.X$ h3Kh/jqh:hh<}r(UrefurijyhA]rU]h?]hD]rhauhH]ubeubaubeubhU)r}r(h.XThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h/j,h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMlhGhhH]r(hQX"This documentation is part of the rr}r(h.X"This documentation is part of the h/jubh)r}r(h.X$`rsyslog `_h<}r(UnamehhXhttp://www.rsyslog.com/rhA]h@]h>]h?]hD]uh/jhH]rhQXrsyslogrr}r(h.Uh/jubah:hubh)r}r(h.X h3Kh/jh:hh<}r(UrefurijhA]rUrsyslograh@]h>]h?]hD]rhauhH]ubhQX$ project. Copyright © 2008-2014 by rr}r(h.X$ project. Copyright © 2008-2014 by h/jubh)r}r(h.X3`Rainer Gerhards `_h<}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrhA]h@]h>]h?]hD]uh/jhH]rhQXRainer Gerhardsrr}r(h.Uh/jubah:hubh)r}r(h.X! h3Kh/jh:hh<}r(UrefurijhA]rUrainer-gerhardsrah@]h>]h?]hD]rhauhH]ubhQX and rr}r(h.X and h/jubh)r}r(h.X$`Adiscon `_h<}r(UnameXAdisconhXhttp://www.adiscon.com/rhA]h@]h>]h?]hD]uh/jhH]rhQXAdisconrr}r(h.Uh/jubah:hubh)r}r(h.X h3Kh/jh:hh<}r(UrefurijhA]rUadisconrah@]h>]h?]hD]rh auhH]ubhQX1. Released under the GNU GPL version 2 or higher.rr}r(h.X1. Released under the GNU GPL version 2 or higher.h/jubeubeubeubh8h9h:h;h<}r(h>]h?]h@]hA]rU legacy-formatrahD]rhauhFMhGhhH]r(hJ)r}r(h.X legacy formatrh/h4h8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQX legacy formatrr}r(h.jh/jubaubhU)r}r(h.XkIn pre v6-versions of rsyslog, you need to use the ``$template`` statement to configure templates. They provide the equivalent to string- and plugin-based templates. The legacy syntax continuous to work in v7, however we recommend to avoid legacy format for newly written config files. Legacy and current config statements can coexist within the same config file.h/h4h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]r(hQX3In pre v6-versions of rsyslog, you need to use the rr}r(h.X3In pre v6-versions of rsyslog, you need to use the h/jubh)r}r(h.X ``$template``h<}r(h>]h?]h@]hA]hD]uh/jhH]rhQX $templaterr}r(h.Uh/jubah:hubhQX+ statement to configure templates. They provide the equivalent to string- and plugin-based templates. The legacy syntax continuous to work in v7, however we recommend to avoid legacy format for newly written config files. Legacy and current config statements can coexist within the same config file.rr}r(h.X+ statement to configure templates. They provide the equivalent to string- and plugin-based templates. The legacy syntax continuous to work in v7, however we recommend to avoid legacy format for newly written config files. Legacy and current config statements can coexist within the same config file.h/jubeubhU)r}r(h.XThe general format isrh/h4h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQXThe general format isrr}r(h.jh/jubaubh)r}r(h.X$template name,param[,options]h/h4h8h9h:hh<}r(hhhA]h@]h>]h?]hD]uhFMhGhhH]rhQX$template name,param[,options]rr}r(h.Uh/jubaubhU)r}r(h.Xwhere "name" is the template name and "param" is a single parameter that specifies template content. The optional "options" part is used to set template options.rh/h4h8h9h:hXh<}r(h>]h?]h@]hA]hD]uhFM hGhhH]rhQXwhere "name" is the template name and "param" is a single parameter that specifies template content. The optional "options" part is used to set template options.rr}r(h.jh/jubaubh1h0)r}r(h.Uh3Kh/h4h8h9h:h;h<}r(h>]rjTah?]h@]hA]rUid2rahD]uhFMhGhhH]r(hJ)r}r(h.Xpluginrh/jh8h9h:hNh<}r(h>]h?]h@]hA]hD]uhFMhGhhH]rhQXpluginrr }r (h.jh/jubaubhU)r }r (h.XThis is equivalent to the "plugin"-type template directive. Here, the parameter is the plugin name, with an equal sign prepended. An example is:r h/jh8h9h:hXh<}r (h>]h?]h@]hA]hD]uhFMhGhhH]r hQXThis is equivalent to the "plugin"-type template directive. Here, the parameter is the plugin name, with an equal sign prepended. An example is:r r }r (h.j h/j ubaubh)r }r (h.X$template plugintpl,=mypluginh/jh8h9h:hh<}r (hhhA]h@]h>]h?]hD]uhFM$hGhhH]r hQX$template plugintpl,=mypluginr r }r (h.Uh/j ubaubeubeubh8h9h:h;h<}r (h>]r jah?]h@]hA]r Uid1r ahD]uhFMhGhhH]r (hJ)r }r (h.Xstringr h/h1h8h9h:hNh<}r (h>]h?]h@]hA]hD]uhFMhGhhH]r hQXstringr r }r (h.j h/j ubaubhU)r }r (h.XyThe parameter is the same string that with the current-style format you specify in the **string** parameter, for example:h/h1h8h9h:hXh<}r (h>]h?]h@]hA]hD]uhFMhGhhH]r! (hQXWThe parameter is the same string that with the current-style format you specify in the r" r# }r$ (h.XWThe parameter is the same string that with the current-style format you specify in the h/j ubhj)r% }r& (h.X **string**h<}r' (h>]h?]h@]hA]hD]uh/j hH]r( hQXstringr) r* }r+ (h.Uh/j% ubah:hrubhQX parameter, for example:r, r- }r. (h.X parameter, for example:h/j ubeubh)r/ }r0 (h.X+$template strtpl,"PRI: %pri%, MSG: %msg%\n"h/h1h8h9h:hh<}r1 (hhhA]h@]h>]h?]hD]uhFMhGhhH]r2 hQX+$template strtpl,"PRI: %pri%, MSG: %msg%\n"r3 r4 }r5 (h.Uh/j/ ubaubhU)r6 }r7 (h.XNote that list templates are not available in legacy format, so you need to use complex property replacer constructs to do complex things.r8 h/h1h8h9h:hXh<}r9 (h>]h?]h@]hA]hD]uhFMhGhhH]r: hQXNote that list templates are not available in legacy format, so you need to use complex property replacer constructs to do complex things.r; r< }r= (h.j8 h/j6 ubaubeubh8h9h:Usystem_messager> h<}r? (h>]UlevelKhA]h@]r@ j aUsourceh9h?]hD]UlineMUtypeUINFOrA uhFMhGhhH]rB hU)rC }rD (h.X)Duplicate implicit target name: "string".h<}rE (h>]h?]h@]hA]hD]uh/h,hH]rF hQX)Duplicate implicit target name: "string".rG rH }rI (h.Uh/jC ubah:hXubaubh+)rJ }rK (h.Uh/jh8h9h:j> h<}rL (h>]UlevelKhA]h@]rM jaUsourceh9h?]hD]UlineMUtypejA uhFMhGhhH]rN hU)rO }rP (h.X)Duplicate implicit target name: "plugin".h<}rQ (h>]h?]h@]hA]hD]uh/jJ hH]rR hQX)Duplicate implicit target name: "plugin".rS rT }rU (h.Uh/jO ubah:hXubaubeUcurrent_sourcerV NU decorationrW NUautofootnote_startrX KUnameidsrY }rZ (hjhjhhh jh jkh j~h jh jhjhjhjhjhjhjRhjhj0hj7hhChjmhNhjhjhhhjThhhj h Nh!jh"jh#jIh$hh%jh&juhH]r[ h6ah.UU transformerr\ NU footnote_refsr] }r^ Urefnamesr_ }r` Usymbol_footnotesra ]rb Uautofootnote_refsrc ]rd Usymbol_footnote_refsre ]rf U citationsrg ]rh hGhU current_lineri NUtransform_messagesrj ]rk Ureporterrl NUid_startrm KU autofootnotesrn ]ro U citation_refsrp }rq Uindirect_targetsrr ]rs Usettingsrt (cdocutils.frontend Values ru orv }rw (Ufootnote_backlinksrx KUrecord_dependenciesry NU rfc_base_urlrz Uhttps://tools.ietf.org/html/r{ U tracebackr| Upep_referencesr} NUstrip_commentsr~ NU toc_backlinksr Uentryr U language_coder Uenr U datestampr NU report_levelr KU _destinationr NU halt_levelr KU strip_classesr NhNNUerror_encoding_error_handlerr Ubackslashreplacer Udebugr NUembed_stylesheetr Uoutput_encoding_error_handlerr Ustrictr U sectnum_xformr KUdump_transformsr NU docinfo_xformr KUwarning_streamr NUpep_file_url_templater Upep-%04dr Uexit_status_levelr KUconfigr NUstrict_visitorr NUcloak_email_addressesr Utrim_footnote_reference_spacer Uenvr NUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesr NUoutput_encodingr Uutf-8r U source_urlr NUinput_encodingr U utf-8-sigr U_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingr UUTF-8r U_sourcer h9Ugettext_compactr U generatorr NUdump_internalsr NU smart_quotesr U pep_base_urlr U https://www.python.org/dev/peps/r Usyntax_highlightr Ulongr Uinput_encoding_error_handlerr j Uauto_id_prefixr Uidr Udoctitle_xformr Ustrip_elements_with_classesr NU _config_filesr ]Ufile_insertion_enabledr U raw_enabledr KU dump_settingsr NubUsymbol_footnote_startr KUidsr }r (hhj0j,jjj~jzjjjkjghhjjhhj h1jRjNjIjEjjjh4j7j3hCh6jmjijjjjjjj jhhjTjPjjjjjVjPjjjjjjjjjj~jjjjjjjjuUsubstitution_namesr }r h:hGh<}r (h>]hA]h@]Usourceh9h?]hD]uU footnotesr ]r Urefidsr }r ub.build/.doctrees/configuration/ruleset/0000775000175000017500000000000013035122643017056 5ustar rgerrgerbuild/.doctrees/configuration/ruleset/rsconf1_rulesetparser.doctree0000664000175000017500000005473513035122643024776 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xmessage parsersqXrainer gerhardsqXadisconqX+adiscon's professional services for rsyslogq Xrsyslogq X pmlastmsgq X$rulesetparserq NX omrulesetq uUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUmessage-parsersqhUrainer-gerhardsqhUadisconqh U+adiscon-s-professional-services-for-rsyslogqh Ursyslogqh U pmlastmsgqh U rulesetparserqh U omrulesetquUchildrenq]q cdocutils.nodes section q!)q"}q#(U rawsourceq$UUparentq%hUsourceq&XR/home/rger/proj/rsyslog-doc/source/configuration/ruleset/rsconf1_rulesetparser.rstq'Utagnameq(Usectionq)U attributesq*}q+(Udupnamesq,]Uclassesq-]Ubackrefsq.]Uidsq/]q0haUnamesq1]q2h auUlineq3KUdocumentq4hh]q5(cdocutils.nodes title q6)q7}q8(h$X$RulesetParserq9h%h"h&h'h(Utitleq:h*}q;(h,]h-]h.]h/]h1]uh3Kh4hh]qq?}q@(h$h9h%h7ubaubcdocutils.nodes paragraph qA)qB}qC(h$X2**Type:** ruleset-specific configuration directiveqDh%h"h&h'h(U paragraphqEh*}qF(h,]h-]h.]h/]h1]uh3Kh4hh]qG(cdocutils.nodes strong qH)qI}qJ(h$X **Type:**h*}qK(h,]h-]h.]h/]h1]uh%hBh]qLh=XType:qMqN}qO(h$Uh%hIubah(UstrongqPubh=X) ruleset-specific configuration directiveqQqR}qS(h$X) ruleset-specific configuration directiveh%hBubeubhA)qT}qU(h$X**Parameter Values:** stringqVh%h"h&h'h(hEh*}qW(h,]h-]h.]h/]h1]uh3Kh4hh]qX(hH)qY}qZ(h$X**Parameter Values:**h*}q[(h,]h-]h.]h/]h1]uh%hTh]q\h=XParameter Values:q]q^}q_(h$Uh%hYubah(hPubh=X stringq`qa}qb(h$X stringh%hTubeubhA)qc}qd(h$X**Available since:** 5.3.4+qeh%h"h&h'h(hEh*}qf(h,]h-]h.]h/]h1]uh3Kh4hh]qg(hH)qh}qi(h$X**Available since:**h*}qj(h,]h-]h.]h/]h1]uh%hch]qkh=XAvailable since:qlqm}qn(h$Uh%hhubah(hPubh=X 5.3.4+qoqp}qq(h$X 5.3.4+h%hcubeubhA)qr}qs(h$X8**Default:** rsyslog.rfc5424 followed by rsyslog.rfc5425qth%h"h&h'h(hEh*}qu(h,]h-]h.]h/]h1]uh3K h4hh]qv(hH)qw}qx(h$X **Default:**h*}qy(h,]h-]h.]h/]h1]uh%hrh]qzh=XDefault:q{q|}q}(h$Uh%hwubah(hPubh=X, rsyslog.rfc5424 followed by rsyslog.rfc5425q~q}q(h$X, rsyslog.rfc5424 followed by rsyslog.rfc5425h%hrubeubhA)q}q(h$X**Description:**qh%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K h4hh]qhH)q}q(h$hh*}q(h,]h-]h.]h/]h1]uh%hh]qh=X Description:qq}q(h$Uh%hubah(hPubaubhA)q}q(h$XJThis directive permits to specify which `message parsers `_ should be used for the ruleset in question. It no ruleset is explicitely specified, the default ruleset is used. Message parsers are contained in (loadable) parser modules with the most common cases (RFC3164 and RFC5424) being build-in into rsyslogd.h%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]q(h=X(This directive permits to specify which qq}q(h$X(This directive permits to specify which h%hubcdocutils.nodes reference q)q}q(h$X'`message parsers `_h*}q(UnameXmessage parsersUrefuriqXmessageparser.htmlqh/]h.]h,]h-]h1]uh%hh]qh=Xmessage parsersqq}q(h$Uh%hubah(U referencequbcdocutils.nodes target q)q}q(h$X U referencedqKh%hh(Utargetqh*}q(Urefurihh/]qhah.]h,]h-]h1]qhauh]ubh=X should be used for the ruleset in question. It no ruleset is explicitely specified, the default ruleset is used. Message parsers are contained in (loadable) parser modules with the most common cases (RFC3164 and RFC5424) being build-in into rsyslogd.qq}q(h$X should be used for the ruleset in question. It no ruleset is explicitely specified, the default ruleset is used. Message parsers are contained in (loadable) parser modules with the most common cases (RFC3164 and RFC5424) being build-in into rsyslogd.h%hubeubhA)q}q(h$XWhen this directive is specified the first time for a ruleset, it will not only add the parser to the ruleset's parser chain, it will also wipe out the default parser chain. So if you need to have them in addition to the custom parser, you need to specify those as well.qh%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=XWhen this directive is specified the first time for a ruleset, it will not only add the parser to the ruleset's parser chain, it will also wipe out the default parser chain. So if you need to have them in addition to the custom parser, you need to specify those as well.qq}q(h$hh%hubaubhA)q}q(h$XOrder of directives is important. Parsers are tried one after another, in the order they are specified inside the config. As soon as a parser is able to parse the message, it will do so and no other parsers will be executed. If no matching parser can be found, the message will be discarded and a warning message be issued (but only for the first 1,000 instances of this problem, to prevent message generation loops).qh%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3Kh4hh]qh=XOrder of directives is important. Parsers are tried one after another, in the order they are specified inside the config. As soon as a parser is able to parse the message, it will do so and no other parsers will be executed. If no matching parser can be found, the message will be discarded and a warning message be issued (but only for the first 1,000 instances of this problem, to prevent message generation loops).qq}q(h$hh%hubaubhA)q}q(h$XNote that the rfc3164 parser will **always** be able to parse a message - it may just not be the format that you like. This has two important implications: 1) always place that parser at the END of the parser list, or the other parsers after it will never be tried and 2) if you would like to make sure no message is lost, placing the rfc3164 parser at the end of the parser list ensures that.h%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K!h4hh]q(h=X"Note that the rfc3164 parser will qq}q(h$X"Note that the rfc3164 parser will h%hubhH)q}q(h$X **always**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=XalwaysqŅq}q(h$Uh%hubah(hPubh=X] be able to parse a message - it may just not be the format that you like. This has two important implications: 1) always place that parser at the END of the parser list, or the other parsers after it will never be tried and 2) if you would like to make sure no message is lost, placing the rfc3164 parser at the end of the parser list ensures that.qȅq}q(h$X] be able to parse a message - it may just not be the format that you like. This has two important implications: 1) always place that parser at the END of the parser list, or the other parsers after it will never be tried and 2) if you would like to make sure no message is lost, placing the rfc3164 parser at the end of the parser list ensures that.h%hubeubhA)q}q(h$XMultiple parser modules are very useful if you have various devices that emit messages that are malformed in various ways. The route to take then isqh%h"h&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K(h4hh]qh=XMultiple parser modules are very useful if you have various devices that emit messages that are malformed in various ways. The route to take then isqЅq}q(h$hh%hubaubcdocutils.nodes bullet_list q)q}q(h$Uh%h"h&h'h(U bullet_listqh*}q(UbulletqX-h/]h.]h,]h-]h1]uh3K,h4hh]q(cdocutils.nodes list_item q)q}q(h$Xmake sure you find a custom parser for that device; if there is no one, you may consider writing one yourself (it is not that hard) or getting one written as part of `Adiscon's professional services for rsyslog `_.h%hh&h'h(U list_itemqh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$Xmake sure you find a custom parser for that device; if there is no one, you may consider writing one yourself (it is not that hard) or getting one written as part of `Adiscon's professional services for rsyslog `_.h%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K,h]q(h=Xmake sure you find a custom parser for that device; if there is no one, you may consider writing one yourself (it is not that hard) or getting one written as part of q䅁q}q(h$Xmake sure you find a custom parser for that device; if there is no one, you may consider writing one yourself (it is not that hard) or getting one written as part of h%hubh)q}q(h$X]`Adiscon's professional services for rsyslog `_h*}q(UnameX+Adiscon's professional services for rsysloghX,http://www.rsyslog.com/professional-servicesqh/]h.]h,]h-]h1]uh%hh]qh=X+Adiscon's professional services for rsyslogq셁q}q(h$Uh%hubah(hubh)q}q(h$X/ hKh%hh(hh*}q(Urefurihh/]qhah.]h,]h-]h1]qh auh]ubh=X.q}q(h$X.h%hubeubaubh)q}q(h$X%load your custom parsers via $ModLoadqh%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$hh%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K0h]qh=X%load your custom parsers via $ModLoadqr}r(h$hh%hubaubaubh)r}r(h$XJcreate a ruleset for each malformed format; assign the custom parser to ith%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XJcreate a ruleset for each malformed format; assign the custom parser to itrh%jh&h'h(hEh*}r (h,]h-]h.]h/]h1]uh3K1h]r h=XJcreate a ruleset for each malformed format; assign the custom parser to itr r }r (h$jh%jubaubaubh)r}r(h$XTcreate a specific listening port for all devices that emit the same malformed formath%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XTcreate a specific listening port for all devices that emit the same malformed formatrh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3K3h]rh=XTcreate a specific listening port for all devices that emit the same malformed formatrr}r(h$jh%jubaubaubh)r}r(h$X:bind the listener to the ruleset with the required parser h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X9bind the listener to the ruleset with the required parserr h%jh&h'h(hEh*}r!(h,]h-]h.]h/]h1]uh3K5h]r"h=X9bind the listener to the ruleset with the required parserr#r$}r%(h$j h%jubaubaubeubhA)r&}r'(h$XNote that it may be cumbersome to add all rules to all rulesets. To avoid this, you can either use $Include or `omruleset `_ (what probably provides the best solution).h%h"h&h'h(hEh*}r((h,]h-]h.]h/]h1]uh3K7h4hh]r)(h=XoNote that it may be cumbersome to add all rules to all rulesets. To avoid this, you can either use $Include or r*r+}r,(h$XoNote that it may be cumbersome to add all rules to all rulesets. To avoid this, you can either use $Include or h%j&ubh)r-}r.(h$X`omruleset `_h*}r/(Unameh hXomruleset.htmlr0h/]h.]h,]h-]h1]uh%j&h]r1h=X omrulesetr2r3}r4(h$Uh%j-ubah(hubh)r5}r6(h$X hKh%j&h(hh*}r7(Urefurij0h/]r8hah.]h,]h-]h1]r9h auh]ubh=X, (what probably provides the best solution).r:r;}r<(h$X, (what probably provides the best solution).h%j&ubeubhA)r=}r>(h$XMore information about rulesets in general can be found in :doc:`multi-ruleset support in rsyslog <../../concepts/multi_ruleset>`.h%h"h&h'h(hEh*}r?(h,]h-]h.]h/]h1]uh3K;h4hh]r@(h=X;More information about rulesets in general can be found in rArB}rC(h$X;More information about rulesets in general can be found in h%j=ubcsphinx.addnodes pending_xref rD)rE}rF(h$XF:doc:`multi-ruleset support in rsyslog <../../concepts/multi_ruleset>`rGh%j=h&h'h(U pending_xrefrHh*}rI(UreftypeXdocrJUrefwarnrKU reftargetrLX../../concepts/multi_rulesetU refdomainUh/]h.]U refexplicith,]h-]h1]UrefdocrMX+configuration/ruleset/rsconf1_rulesetparserrNuh3K;h]rOcdocutils.nodes literal rP)rQ}rR(h$jGh*}rS(h,]h-]rT(UxrefrUjJeh.]h/]h1]uh%jEh]rVh=X multi-ruleset support in rsyslogrWrX}rY(h$Uh%jQubah(UliteralrZubaubh=X.r[}r\(h$X.h%j=ubeubhA)r]}r^(h$X **Caveats:**r_h%h"h&h'h(hEh*}r`(h,]h-]h.]h/]h1]uh3K>h4hh]rahH)rb}rc(h$j_h*}rd(h,]h-]h.]h/]h1]uh%j]h]reh=XCaveats:rfrg}rh(h$Uh%jbubah(hPubaubhA)ri}rj(h$Xcurrently none knownrkh%h"h&h'h(hEh*}rl(h,]h-]h.]h/]h1]uh3K@h4hh]rmh=Xcurrently none knownrnro}rp(h$jkh%jiubaubhA)rq}rr(h$X **Example:**rsh%h"h&h'h(hEh*}rt(h,]h-]h.]h/]h1]uh3KBh4hh]ruhH)rv}rw(h$jsh*}rx(h,]h-]h.]h/]h1]uh%jqh]ryh=XExample:rzr{}r|(h$Uh%jvubah(hPubaubhA)r}}r~(h$XThis example assumes there are two devices emiting malformed messages via UDP. We have two custom parsers for them, named "device1.parser" and "device2.parser". In addition to that, we have a number of other devices sending wellformed messages, also via UDP.rh%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KDh4hh]rh=XThis example assumes there are two devices emiting malformed messages via UDP. We have two custom parsers for them, named "device1.parser" and "device2.parser". In addition to that, we have a number of other devices sending wellformed messages, also via UDP.rr}r(h$jh%j}ubaubhA)r}r(h$XThe solution is to listen for data from the two devices on two special ports (10514 and 10515 in this example), create a ruleset for each and assign the custom parsers to them. The rest of the messages are received via port 514 using the regular parsers. Processing shall be equal for all messages. So we simply forward the malformed messages to the regular queue once they are parsed (keep in mind that a message is never again parsed once any parser properly processed it).rh%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KIh4hh]rh=XThe solution is to listen for data from the two devices on two special ports (10514 and 10515 in this example), create a ruleset for each and assign the custom parsers to them. The rest of the messages are received via port 514 using the regular parsers. Processing shall be equal for all messages. So we simply forward the malformed messages to the regular queue once they are parsed (keep in mind that a message is never again parsed once any parser properly processed it).rr}r(h$jh%jubaubcdocutils.nodes literal_block r)r}r(h$X$ModLoad imudp $ModLoad pmdevice1 # load parser "device1.parser" for device 1 $ModLoad pmdevice2 # load parser "device2.parser" for device 2 # define ruleset for the first device sending malformed data $Ruleset maldev1 $RulesetCreateMainQueue on # create ruleset-specific queue $RulesetParser "device1.parser" # note: this deactivates the default parsers # forward all messages to default ruleset: $ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset \*.\* :omruleset: # define ruleset for the second device sending malformed data $Ruleset maldev2 $RulesetCreateMainQueue on # create ruleset-specific queue $RulesetParser "device2.parser" # note: this deactivates the default parsers # forward all messages to default ruleset: $ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset \*.\* :omruleset: # switch back to default ruleset $Ruleset RSYSLOG\_DefaultRuleset \*.\* /path/to/file auth.info @authlogger.example.net # whatever else you usually do... # now define the inputs and bind them to the rulesets # first the default listener (utilizing the default ruleset) $UDPServerRun 514 # now the one with the parser for device type 1: $InputUDPServerBindRuleset maldev1 $UDPServerRun 10514 # and finally the one for device type 2: $InputUDPServerBindRuleset maldev2 $UDPServerRun 10515h%h"h&h'h(U literal_blockrh*}r(U xml:spacerUpreserverh/]h.]h,]h-]h1]uh3KSh4hh]rh=X$ModLoad imudp $ModLoad pmdevice1 # load parser "device1.parser" for device 1 $ModLoad pmdevice2 # load parser "device2.parser" for device 2 # define ruleset for the first device sending malformed data $Ruleset maldev1 $RulesetCreateMainQueue on # create ruleset-specific queue $RulesetParser "device1.parser" # note: this deactivates the default parsers # forward all messages to default ruleset: $ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset \*.\* :omruleset: # define ruleset for the second device sending malformed data $Ruleset maldev2 $RulesetCreateMainQueue on # create ruleset-specific queue $RulesetParser "device2.parser" # note: this deactivates the default parsers # forward all messages to default ruleset: $ActionOmrulesetRulesetName RSYSLOG\_DefaultRuleset \*.\* :omruleset: # switch back to default ruleset $Ruleset RSYSLOG\_DefaultRuleset \*.\* /path/to/file auth.info @authlogger.example.net # whatever else you usually do... # now define the inputs and bind them to the rulesets # first the default listener (utilizing the default ruleset) $UDPServerRun 514 # now the one with the parser for device type 1: $InputUDPServerBindRuleset maldev1 $UDPServerRun 10514 # and finally the one for device type 2: $InputUDPServerBindRuleset maldev2 $UDPServerRun 10515rr}r(h$Uh%jubaubhA)r}r(h$XFor an example of how multiple parser can be chained (and an actual use case), please see the example section on the `pmlastmsg `_ parser module.h%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kxh4hh]r(h=XuFor an example of how multiple parser can be chained (and an actual use case), please see the example section on the rr}r(h$XuFor an example of how multiple parser can be chained (and an actual use case), please see the example section on the h%jubh)r}r(h$X`pmlastmsg `_h*}r(Unameh hXpmlastmsg.htmlrh/]h.]h,]h-]h1]uh%jh]rh=X pmlastmsgrr}r(h$Uh%jubah(hubh)r}r(h$X hKh%jh(hh*}r(Urefurijh/]rhah.]h,]h-]h1]rh auh]ubh=X parser module.rr}r(h$X parser module.h%jubeubhA)r}r(h$XNote the positions of the directives. With the current config language, **sequence of statements is very important**. This is ugly, but unfortunately the way it currently works.h%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3K|h4hh]r(h=XHNote the positions of the directives. With the current config language, rr}r(h$XHNote the positions of the directives. With the current config language, h%jubhH)r}r(h$X,**sequence of statements is very important**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X(sequence of statements is very importantrr}r(h$Uh%jubah(hPubh=X=. This is ugly, but unfortunately the way it currently works.rr}r(h$X=. This is ugly, but unfortunately the way it currently works.h%jubeubhA)r}r(h$XOThis documentation is part of the `rsyslog `_ project.h%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh4hh]r(h=X"This documentation is part of the rr}r(h$X"This documentation is part of the h%jubh)r}r(h$X$`rsyslog `_h*}r(Unameh hXhttp://www.rsyslog.com/rh/]h.]h,]h-]h1]uh%jh]rh=Xrsyslogrr}r(h$Uh%jubah(hubh)r}r(h$X hKh%jh(hh*}r(Urefurijh/]rhah.]h,]h-]h1]rh auh]ubh=X project.rr}r(h$X project.h%jubeubhA)r}r(h$XCopyright © 2009 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h%h"h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh4hh]r(h=XCopyright © 2009 by rr}r(h$XCopyright © 2009 by h%jubh)r}r(h$X3`Rainer Gerhards `_h*}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrh/]h.]h,]h-]h1]uh%jh]rh=XRainer Gerhardsrr}r(h$Uh%jubah(hubh)r}r(h$X! hKh%jh(hh*}r(Urefurijh/]rhah.]h,]h-]h1]rhauh]ubh=X and rr}r(h$X and h%jubh)r}r(h$X$`Adiscon `_h*}r(UnameXAdisconhXhttp://www.adiscon.com/rh/]h.]h,]h-]h1]uh%jh]rh=XAdisconrr}r(h$Uh%jubah(hubh)r}r(h$X hKh%jh(hh*}r(Urefurijh/]rhah.]h,]h-]h1]rhauh]ubh=X1. Released under the GNU GPL version 2 or higher.rr}r(h$X1. Released under the GNU GPL version 2 or higher.h%jubeubeubah$UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr ]r h4hU current_liner NUtransform_messagesr ]r UreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsr NU toc_backlinksr!Uentryr"U language_coder#Uenr$U datestampr%NU report_levelr&KU _destinationr'NU halt_levelr(KU strip_classesr)Nh:NUerror_encoding_error_handlerr*Ubackslashreplacer+Udebugr,NUembed_stylesheetr-Uoutput_encoding_error_handlerr.Ustrictr/U sectnum_xformr0KUdump_transformsr1NU docinfo_xformr2KUwarning_streamr3NUpep_file_url_templater4Upep-%04dr5Uexit_status_levelr6KUconfigr7NUstrict_visitorr8NUcloak_email_addressesr9Utrim_footnote_reference_spacer:Uenvr;NUdump_pseudo_xmlr<NUexpose_internalsr=NUsectsubtitle_xformr>U source_linkr?NUrfc_referencesr@NUoutput_encodingrAUutf-8rBU source_urlrCNUinput_encodingrDU utf-8-sigrEU_disable_configrFNU id_prefixrGUU tab_widthrHKUerror_encodingrIUUTF-8rJU_sourcerKh'Ugettext_compactrLU generatorrMNUdump_internalsrNNU smart_quotesrOU pep_base_urlrPU https://www.python.org/dev/peps/rQUsyntax_highlightrRUlongrSUinput_encoding_error_handlerrTj/Uauto_id_prefixrUUidrVUdoctitle_xformrWUstrip_elements_with_classesrXNU _config_filesrY]Ufile_insertion_enabledrZU raw_enabledr[KU dump_settingsr\NubUsymbol_footnote_startr]KUidsr^}r_(hhhh"hjhjhhhjhj5hjuUsubstitution_namesr`}rah(h4h*}rb(h,]h/]h.]Usourceh'h-]h1]uU footnotesrc]rdUrefidsre}rfub.build/.doctrees/configuration/ruleset/rsconf1_rulesetcreatemainqueue.doctree0000664000175000017500000003641713035122643026654 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$rulesetcreatemainqueueqNX multi-ruleset support in rsyslogqXrainer gerhardsqXadisconq Xrsyslogq X$rsyslog.conf configuration directiveq uUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrulesetcreatemainqueueqhU multi-ruleset-support-in-rsyslogqhUrainer-gerhardsqh Uadisconqh Ursyslogqh U$rsyslog-conf-configuration-directivequUchildrenq]q(cdocutils.nodes paragraph q)q}q(U rawsourceq XB`rsyslog.conf configuration directive `_q!Uparentq"hUsourceq#X[/home/rger/proj/rsyslog-doc/source/configuration/ruleset/rsconf1_rulesetcreatemainqueue.rstq$Utagnameq%U paragraphq&U attributesq'}q((Udupnamesq)]Uclassesq*]Ubackrefsq+]Uidsq,]Unamesq-]uUlineq.KUdocumentq/hh]q0(cdocutils.nodes reference q1)q2}q3(h h!h'}q4(UnameX$rsyslog.conf configuration directiveUrefuriq5Xrsyslog_conf_global.htmlq6h,]h+]h)]h*]h-]uh"hh]q7cdocutils.nodes Text q8X$rsyslog.conf configuration directiveq9q:}q;(h Uh"h2ubah%U referenceq}q?(h X U referencedq@Kh"hh%UtargetqAh'}qB(Urefurih6h,]qChah+]h)]h*]h-]qDh auh]ubeubcdocutils.nodes section qE)qF}qG(h Uh"hh#h$h%UsectionqHh'}qI(h)]h*]h+]h,]qJhah-]qKhauh.Kh/hh]qL(cdocutils.nodes title qM)qN}qO(h X$RulesetCreateMainQueueqPh"hFh#h$h%UtitleqQh'}qR(h)]h*]h+]h,]h-]uh.Kh/hh]qSh8X$RulesetCreateMainQueueqTqU}qV(h hPh"hNubaubh)qW}qX(h X2**Type:** ruleset-specific configuration directiveqYh"hFh#h$h%h&h'}qZ(h)]h*]h+]h,]h-]uh.Kh/hh]q[(cdocutils.nodes strong q\)q]}q^(h X **Type:**h'}q_(h)]h*]h+]h,]h-]uh"hWh]q`h8XType:qaqb}qc(h Uh"h]ubah%Ustrongqdubh8X) ruleset-specific configuration directiveqeqf}qg(h X) ruleset-specific configuration directiveh"hWubeubh)qh}qi(h X.**Parameter Values:** boolean (on/off, yes/no)qjh"hFh#h$h%h&h'}qk(h)]h*]h+]h,]h-]uh.Kh/hh]ql(h\)qm}qn(h X**Parameter Values:**h'}qo(h)]h*]h+]h,]h-]uh"hhh]qph8XParameter Values:qqqr}qs(h Uh"hmubah%hdubh8X boolean (on/off, yes/no)qtqu}qv(h X boolean (on/off, yes/no)h"hhubeubh)qw}qx(h X**Available since:** 5.3.5+qyh"hFh#h$h%h&h'}qz(h)]h*]h+]h,]h-]uh.K h/hh]q{(h\)q|}q}(h X**Available since:**h'}q~(h)]h*]h+]h,]h-]uh"hwh]qh8XAvailable since:qq}q(h Uh"h|ubah%hdubh8X 5.3.5+qq}q(h X 5.3.5+h"hwubeubh)q}q(h X**Default:** offqh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K h/hh]q(h\)q}q(h X **Default:**h'}q(h)]h*]h+]h,]h-]uh"hh]qh8XDefault:qq}q(h Uh"hubah%hdubh8X offqq}q(h X offh"hubeubh)q}q(h X**Description:**qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh\)q}q(h hh'}q(h)]h*]h+]h,]h-]uh"hh]qh8X Description:qq}q(h Uh"hubah%hdubaubh)q}q(h XJRulesets may use their own "main" message queue for message submission. Specifying this directive, **inside a ruleset definition**, turns this on. This is both a performance enhancement and also permits different rulesets (and thus different inputs within the same rsyslogd instance) to use different types of main message queues.h"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]q(h8XcRulesets may use their own "main" message queue for message submission. Specifying this directive, qq}q(h XcRulesets may use their own "main" message queue for message submission. Specifying this directive, h"hubh\)q}q(h X**inside a ruleset definition**h'}q(h)]h*]h+]h,]h-]uh"hh]qh8Xinside a ruleset definitionqq}q(h Uh"hubah%hdubh8X, turns this on. This is both a performance enhancement and also permits different rulesets (and thus different inputs within the same rsyslogd instance) to use different types of main message queues.qq}q(h X, turns this on. This is both a performance enhancement and also permits different rulesets (and thus different inputs within the same rsyslogd instance) to use different types of main message queues.h"hubeubh)q}q(h XThe ruleset queue is created with the parameters that are specified for the main message queue at the time the directive is given. If different queue configurations are desired, different main message queue directives must be used **in front of** the $RulesetCreateMainQueue directive. Note that this directive may only be given once per ruleset. If multiple statements are specified, only the first is used and for the others error messages are emitted.h"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]q(h8XThe ruleset queue is created with the parameters that are specified for the main message queue at the time the directive is given. If different queue configurations are desired, different main message queue directives must be used qq}q(h XThe ruleset queue is created with the parameters that are specified for the main message queue at the time the directive is given. If different queue configurations are desired, different main message queue directives must be used h"hubh\)q}q(h X**in front of**h'}q(h)]h*]h+]h,]h-]uh"hh]qh8X in front ofqq}q(h Uh"hubah%hdubh8X the $RulesetCreateMainQueue directive. Note that this directive may only be given once per ruleset. If multiple statements are specified, only the first is used and for the others error messages are emitted.qq}q(h X the $RulesetCreateMainQueue directive. Note that this directive may only be given once per ruleset. If multiple statements are specified, only the first is used and for the others error messages are emitted.h"hubeubh)q}q(h XxNote that the final set of ruleset configuration directives specifies the parameters for the default main message queue.qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh8XxNote that the final set of ruleset configuration directives specifies the parameters for the default main message queue.qȅq}q(h hh"hubaubh)q}q(h XxTo learn more about this feature, please be sure to read about `multi-ruleset support in rsyslog `_.h"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K!h/hh]q(h8X?To learn more about this feature, please be sure to read about qυq}q(h X?To learn more about this feature, please be sure to read about h"hubh1)q}q(h X8`multi-ruleset support in rsyslog `_h'}q(UnameX multi-ruleset support in rsyslogh5Xmulti_ruleset.htmlqh,]h+]h)]h*]h-]uh"hh]qh8X multi-ruleset support in rsyslogqׅq}q(h Uh"hubah%hh@Kh"hh%hAh'}q(Urefurihh,]qhah+]h)]h*]h-]qhauh]ubh8X.q}q(h X.h"hubeubh)q}q(h X **Caveats:**qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K$h/hh]qh\)q}q(h hh'}q(h)]h*]h+]h,]h-]uh"hh]qh8XCaveats:qꅁq}q(h Uh"hubah%hdubaubh)q}q(h XThe configuration statement "$RulesetCreateMainQueue off" has no effect at all. The capability to specify this is an artifact of the legacy configuration language.qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K&h/hh]qh8XThe configuration statement "$RulesetCreateMainQueue off" has no effect at all. The capability to specify this is an artifact of the legacy configuration language.qq}q(h hh"hubaubh)q}q(h X **Example:**qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K*h/hh]qh\)q}q(h hh'}q(h)]h*]h+]h,]h-]uh"hh]qh8XExample:qq}r(h Uh"hubah%hdubaubh)r}r(h X2This example sets up a tcp server with three listeners. Each of these three listener is bound to a specific ruleset. As a performance optimization, the rulesets all receive their own private queue. The result is that received messages can be independently processed. With only a single main message queue, we would have some lock contention between the messages. This does not happen here. Note that in this example, we use different processing. Of course, all messages could also have been processed in the same way ($IncludeConfig may be useful in that case!).rh"hFh#h$h%h&h'}r(h)]h*]h+]h,]h-]uh.K,h/hh]rh8X2This example sets up a tcp server with three listeners. Each of these three listener is bound to a specific ruleset. As a performance optimization, the rulesets all receive their own private queue. The result is that received messages can be independently processed. With only a single main message queue, we would have some lock contention between the messages. This does not happen here. Note that in this example, we use different processing. Of course, all messages could also have been processed in the same way ($IncludeConfig may be useful in that case!).rr}r(h jh"jubaubcdocutils.nodes literal_block r )r }r (h XB$ModLoad imtcp # at first, this is a copy of the unmodified rsyslog.conf #define rulesets first $RuleSet remote10514 $RulesetCreateMainQueue on # create ruleset-specific queue *.* /var/log/remote10514 $RuleSet remote10515 $RulesetCreateMainQueue on # create ruleset-specific queue *.* /var/log/remote10515 $RuleSet remote10516 $RulesetCreateMainQueue on # create ruleset-specific queue mail.* /var/log/mail10516 & ~ # note that the discard-action will prevent this messag from # being written to the remote10516 file - as usual... *.* /var/log/remote10516 # and now define listeners bound to the relevant ruleset $InputTCPServerBindRuleset remote10514 $InputTCPServerRun 10514 $InputTCPServerBindRuleset remote10515 $InputTCPServerRun 10515 $InputTCPServerBindRuleset remote10516 $InputTCPServerRun 10516h"hFh#h$h%U literal_blockr h'}r (U xml:spacerUpreserverh,]h+]h)]h*]h-]uh.K8h/hh]rh8XB$ModLoad imtcp # at first, this is a copy of the unmodified rsyslog.conf #define rulesets first $RuleSet remote10514 $RulesetCreateMainQueue on # create ruleset-specific queue *.* /var/log/remote10514 $RuleSet remote10515 $RulesetCreateMainQueue on # create ruleset-specific queue *.* /var/log/remote10515 $RuleSet remote10516 $RulesetCreateMainQueue on # create ruleset-specific queue mail.* /var/log/mail10516 & ~ # note that the discard-action will prevent this messag from # being written to the remote10516 file - as usual... *.* /var/log/remote10516 # and now define listeners bound to the relevant ruleset $InputTCPServerBindRuleset remote10514 $InputTCPServerRun 10514 $InputTCPServerBindRuleset remote10515 $InputTCPServerRun 10515 $InputTCPServerBindRuleset remote10516 $InputTCPServerRun 10516rr}r(h Uh"j ubaubh)r}r(h X+Note the positions of the directives. With the legacy language, position is very important. It is highly suggested to use the *ruleset()* object in RainerScript config language if you intend to use ruleset queues. The configuration is much more straightforward in that language and less error-prone.h"hFh#h$h%h&h'}r(h)]h*]h+]h,]h-]uh.KVh/hh]r(h8X~Note the positions of the directives. With the legacy language, position is very important. It is highly suggested to use the rr}r(h X~Note the positions of the directives. With the legacy language, position is very important. It is highly suggested to use the h"jubcdocutils.nodes emphasis r)r}r(h X *ruleset()*h'}r(h)]h*]h+]h,]h-]uh"jh]rh8X ruleset()r r!}r"(h Uh"jubah%Uemphasisr#ubh8X object in RainerScript config language if you intend to use ruleset queues. The configuration is much more straightforward in that language and less error-prone.r$r%}r&(h X object in RainerScript config language if you intend to use ruleset queues. The configuration is much more straightforward in that language and less error-prone.h"jubeubh)r'}r((h XThis documentation is part of the `rsyslog `_ project. Copyright © 2009-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h"hFh#h$h%h&h'}r)(h)]h*]h+]h,]h-]uh.K\h/hh]r*(h8X"This documentation is part of the r+r,}r-(h X"This documentation is part of the h"j'ubh1)r.}r/(h X$`rsyslog `_h'}r0(Unameh h5Xhttp://www.rsyslog.com/r1h,]h+]h)]h*]h-]uh"j'h]r2h8Xrsyslogr3r4}r5(h Uh"j.ubah%hh@Kh"j'h%hAh'}r8(Urefurij1h,]r9hah+]h)]h*]h-]r:h auh]ubh8X$ project. Copyright © 2009-2014 by r;r<}r=(h X$ project. Copyright © 2009-2014 by h"j'ubh1)r>}r?(h X3`Rainer Gerhards `_h'}r@(UnameXRainer Gerhardsh5Xhttp://www.gerhards.net/rainerrAh,]h+]h)]h*]h-]uh"j'h]rBh8XRainer GerhardsrCrD}rE(h Uh"j>ubah%hh@Kh"j'h%hAh'}rH(UrefurijAh,]rIhah+]h)]h*]h-]rJhauh]ubh8X and rKrL}rM(h X and h"j'ubh1)rN}rO(h X$`Adiscon `_h'}rP(UnameXAdisconh5Xhttp://www.adiscon.com/rQh,]h+]h)]h*]h-]uh"j'h]rRh8XAdisconrSrT}rU(h Uh"jNubah%hh@Kh"j'h%hAh'}rX(UrefurijQh,]rYhah+]h)]h*]h-]rZh auh]ubh8X1. Released under the GNU GPL version 2 or higher.r[r\}r](h X1. Released under the GNU GPL version 2 or higher.h"j'ubeubeubeh UU transformerr^NU footnote_refsr_}r`Urefnamesra}rbUsymbol_footnotesrc]rdUautofootnote_refsre]rfUsymbol_footnote_refsrg]rhU citationsri]rjh/hU current_linerkNUtransform_messagesrl]rmUreporterrnNUid_startroKU autofootnotesrp]rqU citation_refsrr}rsUindirect_targetsrt]ruUsettingsrv(cdocutils.frontend Values rworx}ry(Ufootnote_backlinksrzKUrecord_dependenciesr{NU rfc_base_urlr|Uhttps://tools.ietf.org/html/r}U tracebackr~Upep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhQNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh$Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hh>hhFhhhjVhj6hjFuUsubstitution_namesr}rh%h/h'}r(h)]h,]h+]Usourceh$h*]h-]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/ruleset/index.doctree0000664000175000017500000001623613035122643021544 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX0ruleset-specific legacy configuration statementsqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU0ruleset-specific-legacy-configuration-statementsqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXB/home/rger/proj/rsyslog-doc/source/configuration/ruleset/index.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX0Ruleset-Specific Legacy Configuration Statementsq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X0Ruleset-Specific Legacy Configuration Statementsq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX4These statements can be used to set ruleset parameters. To set these parameters, first use *$Ruleset*, **then** use the other configuration directives. Please keep in mind that each ruleset has a *main* queue. To specify parameter for these ruleset (main) queues, use the main queue configuration directives.hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(h/X[These statements can be used to set ruleset parameters. To set these parameters, first use q9q:}q;(hX[These statements can be used to set ruleset parameters. To set these parameters, first use hh4ubcdocutils.nodes emphasis q<)q=}q>(hX *$Ruleset*h}q?(h]h]h ]h!]h#]uhh4h]q@h/X$RulesetqAqB}qC(hUhh=ubahUemphasisqDubh/X, qEqF}qG(hX, hh4ubcdocutils.nodes strong qH)qI}qJ(hX**then**h}qK(h]h]h ]h!]h#]uhh4h]qLh/XthenqMqN}qO(hUhhIubahUstrongqPubh/XU use the other configuration directives. Please keep in mind that each ruleset has a qQqR}qS(hXU use the other configuration directives. Please keep in mind that each ruleset has a hh4ubh<)qT}qU(hX*main*h}qV(h]h]h ]h!]h#]uhh4h]qWh/XmainqXqY}qZ(hUhhTubahhDubh/Xj queue. To specify parameter for these ruleset (main) queues, use the main queue configuration directives.q[q\}q](hXj queue. To specify parameter for these ruleset (main) queues, use the main queue configuration directives.hh4ubeubcdocutils.nodes compound q^)q_}q`(hUhhhhhUcompoundqah}qb(h]h]qcUtoctree-wrapperqdah ]h!]h#]uh%Nh&hh]qecsphinx.addnodes toctree qf)qg}qh(hUhh_hhhUtoctreeqih}qj(UnumberedqkKU includehiddenqlhXconfiguration/ruleset/indexqmUcaptionqnNUglobqoh!]h ]U titlesonlyqph]h]h#]Uentriesqq]qr(NX4configuration/ruleset/rsconf1_rulesetcreatemainqueueqsqtNX+configuration/ruleset/rsconf1_rulesetparserquqveUhiddenqwU includefilesqx]qy(hshueUmaxdepthqzJuh%K h]ubaubcdocutils.nodes bullet_list q{)q|}q}(hUhhhhhU bullet_listq~h}q(UbulletqX-h!]h ]h]h]h#]uh%Kh&hh]qcdocutils.nodes list_item q)q}q(hX**$Ruleset** *name* - starts a new ruleset or switches back to one already defined. All following actions belong to that new rule set. the *name* does not yet exist, it is created. To switch back to rsyslog's default ruleset, specify "RSYSLOG\_DefaultRuleset") as the name. All following actions belong to that new rule set. It is advised to also read our paper on :doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`.hh|hhhU list_itemqh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hX**$Ruleset** *name* - starts a new ruleset or switches back to one already defined. All following actions belong to that new rule set. the *name* does not yet exist, it is created. To switch back to rsyslog's default ruleset, specify "RSYSLOG\_DefaultRuleset") as the name. All following actions belong to that new rule set. It is advised to also read our paper on :doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`.hhhhhh6h}q(h]h]h ]h!]h#]uh%Kh]q(hH)q}q(hX **$Ruleset**h}q(h]h]h ]h!]h#]uhhh]qh/X$Rulesetqq}q(hUhhubahhPubh/X q}q(hX hhubh<)q}q(hX*name*h}q(h]h]h ]h!]h#]uhhh]qh/Xnameqq}q(hUhhubahhDubh/Xx - starts a new ruleset or switches back to one already defined. All following actions belong to that new rule set. the qq}q(hXx - starts a new ruleset or switches back to one already defined. All following actions belong to that new rule set. the hhubh<)q}q(hX*name*h}q(h]h]h ]h!]h#]uhhh]qh/Xnameqq}q(hUhhubahhDubh/X does not yet exist, it is created. To switch back to rsyslog's default ruleset, specify "RSYSLOG_DefaultRuleset") as the name. All following actions belong to that new rule set. It is advised to also read our paper on qq}q(hX does not yet exist, it is created. To switch back to rsyslog's default ruleset, specify "RSYSLOG\_DefaultRuleset") as the name. All following actions belong to that new rule set. It is advised to also read our paper on hhubcsphinx.addnodes pending_xref q)q}q(hXI:doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`qhhhhhU pending_xrefqh}q(UreftypeXdocqUrefwarnqU reftargetqX../../concepts/multi_rulesetU refdomainUh!]h ]U refexplicith]h]h#]Urefdocqhmuh%Kh]qcdocutils.nodes literal q)q}q(hhh}q(h]h]q(Uxrefqheh ]h!]h#]uhhh]qh/X#using multiple rule sets in rsyslogqq}q(hUhhubahUliteralqubaubh/X.q}q(hX.hhubeubaubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingr UUTF-8r U_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startr KUidsr!}r"hhsUsubstitution_namesr#}r$hh&h}r%(h]h!]h ]Usourcehh]h#]uU footnotesr&]r'Urefidsr(}r)ub.build/.doctrees/configuration/basic_structure.doctree0000664000175000017500000012506113035122641022146 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XinputsqNX*quick overview of message flow and objectsqNXflow control statementsqNXoutputsq NXrsyslog modulesq Xcommentsq NXdata manipulation statementsq NXconfiguration fileq NXstatement typesqNXrulesets and rulesqNXbasic structureqNXprocessing orderqNX"recommended use of statement typesqNXprocessing principlesqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUinputsqhU*quick-overview-of-message-flow-and-objectsqhUflow-control-statementsqh Uoutputsq h Ursyslog-modulesq!h Ucommentsq"h Udata-manipulation-statementsq#h Uconfiguration-fileq$hUstatement-typesq%hUrulesets-and-rulesq&hUbasic-structureq'hUprocessing-orderq(hU"recommended-use-of-statement-typesq)hUprocessing-principlesq*uUchildrenq+]q,cdocutils.nodes section q-)q.}q/(U rawsourceq0UUparentq1hUsourceq2XD/home/rger/proj/rsyslog-doc/source/configuration/basic_structure.rstq3Utagnameq4Usectionq5U attributesq6}q7(Udupnamesq8]Uclassesq9]Ubackrefsq:]Uidsq;]qhauUlineq?KUdocumentq@hh+]qA(cdocutils.nodes title qB)qC}qD(h0XBasic StructureqEh1h.h2h3h4UtitleqFh6}qG(h8]h9]h:]h;]h=]uh?Kh@hh+]qHcdocutils.nodes Text qIXBasic StructureqJqK}qL(h0hEh1hCubaubcdocutils.nodes paragraph qM)qN}qO(h0XThis section describes how rsyslog configuration basically works. Think of rsyslog as a big logging and event processing toolset. It can be considered a framework with some basic processing that is fixed in the way data flows, but is highly customizable in the details of this message flow. During configuration, this customization is done by defining and customizing the rsyslog objects.qPh1h.h2h3h4U paragraphqQh6}qR(h8]h9]h:]h;]h=]uh?Kh@hh+]qShIXThis section describes how rsyslog configuration basically works. Think of rsyslog as a big logging and event processing toolset. It can be considered a framework with some basic processing that is fixed in the way data flows, but is highly customizable in the details of this message flow. During configuration, this customization is done by defining and customizing the rsyslog objects.qTqU}qV(h0hPh1hNubaubh-)qW}qX(h0Uh1h.h2h3h4h5h6}qY(h8]h9]h:]h;]qZhah=]q[hauh?K h@hh+]q\(hB)q]}q^(h0X*Quick overview of message flow and objectsq_h1hWh2h3h4hFh6}q`(h8]h9]h:]h;]h=]uh?K h@hh+]qahIX*Quick overview of message flow and objectsqbqc}qd(h0h_h1h]ubaubhM)qe}qf(h0X+Messages enter rsyslog with the help of input modules. Then, they are passed to ruleset, where rules are conditionally applied. When a rule matches, the message is transferred to an action, which then does something to the message, e.g. writes it to a file, database or forwards it to a remote host.qgh1hWh2h3h4hQh6}qh(h8]h9]h:]h;]h=]uh?K h@hh+]qihIX+Messages enter rsyslog with the help of input modules. Then, they are passed to ruleset, where rules are conditionally applied. When a rule matches, the message is transferred to an action, which then does something to the message, e.g. writes it to a file, database or forwards it to a remote host.qjqk}ql(h0hgh1heubaubeubh-)qm}qn(h0Uh1h.h2h3h4h5h6}qo(h8]h9]h:]h;]qph*ah=]qqhauh?Kh@hh+]qr(hB)qs}qt(h0XProcessing Principlesquh1hmh2h3h4hFh6}qv(h8]h9]h:]h;]h=]uh?Kh@hh+]qwhIXProcessing Principlesqxqy}qz(h0huh1hsubaubcdocutils.nodes bullet_list q{)q|}q}(h0Uh1hmh2h3h4U bullet_listq~h6}q(UbulletqX-h;]h:]h8]h9]h=]uh?Kh@hh+]q(cdocutils.nodes list_item q)q}q(h0Xuinputs submit received messages to rulesets * if the ruleset is not specifically bound, the default ruleset is used h1h|h2Nh4U list_itemqh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]q(hM)q}q(h0X+inputs submit received messages to rulesetsqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh+]qhIX+inputs submit received messages to rulesetsqq}q(h0hh1hubaubh{)q}q(h0Uh6}q(hX*h;]h:]h8]h9]h=]uh1hh+]qh)q}q(h0XFif the ruleset is not specifically bound, the default ruleset is used h6}q(h8]h9]h:]h;]h=]uh1hh+]qhM)q}q(h0XEif the ruleset is not specifically bound, the default ruleset is usedqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh+]qhIXEif the ruleset is not specifically bound, the default ruleset is usedqq}q(h0hh1hubaubah4hubah4h~ubeubh)q}q(h0X:by default, there is one ruleset (RSYSLOG_DefaultRuleset) h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0X9by default, there is one ruleset (RSYSLOG_DefaultRuleset)qh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh+]qhIX9by default, there is one ruleset (RSYSLOG_DefaultRuleset)qq}q(h0hh1hubaubaubh)q}q(h0X(additional rulesets can be user-defined h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0X'additional rulesets can be user-definedqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh+]qhIX'additional rulesets can be user-definedqq}q(h0hh1hubaubaubh)q}q(h0Xeach ruleset contains zero or many rules * while it is permitted to have zero rules inside a ruleset, this obviously makes no sense h1h|h2Nh4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]q(hM)q}q(h0X(each ruleset contains zero or many rulesqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?Kh+]qhIX(each ruleset contains zero or many rulesqq}q(h0hh1hubaubh{)q}q(h0Uh6}q(hX*h;]h:]h8]h9]h=]uh1hh+]qh)q}q(h0XYwhile it is permitted to have zero rules inside a ruleset, this obviously makes no sense h6}q(h8]h9]h:]h;]h=]uh1hh+]qhM)q}q(h0XXwhile it is permitted to have zero rules inside a ruleset, this obviously makes no senseqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K h+]qhIXXwhile it is permitted to have zero rules inside a ruleset, this obviously makes no senseqхq}q(h0hh1hubaubah4hubah4h~ubeubh)q}q(h0X/a rule consists of a filter and an action list h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0X.a rule consists of a filter and an action listqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K#h+]qhIX.a rule consists of a filter and an action listq݅q}q(h0hh1hubaubaubh)q}q(h0XEfilters provide yes/no decisions and thus control-of-flow capability h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0XDfilters provide yes/no decisions and thus control-of-flow capabilityqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K%h+]qhIXDfilters provide yes/no decisions and thus control-of-flow capabilityq酁q}q(h0hh1hubaubaubh)q}q(h0Xif a filter "matches" (filter says "yes"), the corresponding action list is executed. If it does not match, nothing special happens h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0Xif a filter "matches" (filter says "yes"), the corresponding action list is executed. If it does not match, nothing special happensqh1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K'h+]qhIXif a filter "matches" (filter says "yes"), the corresponding action list is executed. If it does not match, nothing special happensqq}q(h0hh1hubaubaubh)q}q(h0Xrules are evaluated in sequence from the first to the last rule **inside** the given ruleset. No rules from unrelated rulesets are ever executed. h1h|h2h3h4hh6}q(h8]h9]h:]h;]h=]uh?Nh@hh+]qhM)q}q(h0Xrules are evaluated in sequence from the first to the last rule **inside** the given ruleset. No rules from unrelated rulesets are ever executed.h1hh2h3h4hQh6}q(h8]h9]h:]h;]h=]uh?K+h+]q(hIX@rules are evaluated in sequence from the first to the last rule rr}r(h0X@rules are evaluated in sequence from the first to the last rule h1hubcdocutils.nodes strong r)r}r(h0X **inside**h6}r(h8]h9]h:]h;]h=]uh1hh+]rhIXinsiderr }r (h0Uh1jubah4Ustrongr ubhIXG the given ruleset. No rules from unrelated rulesets are ever executed.r r }r(h0XG the given ruleset. No rules from unrelated rulesets are ever executed.h1hubeubaubh)r}r(h0Xlall rules are **always** fully evaluated, no matter if a filter matches or not (so we do **not** stop at the first match). If message processing shall stop, the "discard" action (represented by the tilde character or the stop command) must explicitly be executed. If discard is executed, message processing immediately stops, without evaluating any further rules. h1h|h2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0Xkall rules are **always** fully evaluated, no matter if a filter matches or not (so we do **not** stop at the first match). If message processing shall stop, the "discard" action (represented by the tilde character or the stop command) must explicitly be executed. If discard is executed, message processing immediately stops, without evaluating any further rules.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?K/h+]r(hIXall rules are rr}r(h0Xall rules are h1jubj)r}r(h0X **always**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXalwaysrr}r (h0Uh1jubah4j ubhIXA fully evaluated, no matter if a filter matches or not (so we do r!r"}r#(h0XA fully evaluated, no matter if a filter matches or not (so we do h1jubj)r$}r%(h0X**not**h6}r&(h8]h9]h:]h;]h=]uh1jh+]r'hIXnotr(r)}r*(h0Uh1j$ubah4j ubhIX  stop at the first match). If message processing shall stop, the "discard" action (represented by the tilde character or the stop command) must explicitly be executed. If discard is executed, message processing immediately stops, without evaluating any further rules.r+r,}r-(h0X  stop at the first match). If message processing shall stop, the "discard" action (represented by the tilde character or the stop command) must explicitly be executed. If discard is executed, message processing immediately stops, without evaluating any further rules.h1jubeubaubh)r.}r/(h0X,an action list contains one or many actions h1h|h2h3h4hh6}r0(h8]h9]h:]h;]h=]uh?Nh@hh+]r1hM)r2}r3(h0X+an action list contains one or many actionsr4h1j.h2h3h4hQh6}r5(h8]h9]h:]h;]h=]uh?K5h+]r6hIX+an action list contains one or many actionsr7r8}r9(h0j4h1j2ubaubaubh)r:}r;(h0X6inside an action list no further filters are possible h1h|h2h3h4hh6}r<(h8]h9]h:]h;]h=]uh?Nh@hh+]r=hM)r>}r?(h0X5inside an action list no further filters are possibler@h1j:h2h3h4hQh6}rA(h8]h9]h:]h;]h=]uh?K7h+]rBhIX5inside an action list no further filters are possiblerCrD}rE(h0j@h1j>ubaubaubh)rF}rG(h0Xto have more than one action inside a list, the ampersand character must be placed in the position of the filter, and this must immediately follow the previous action h1h|h2h3h4hh6}rH(h8]h9]h:]h;]h=]uh?Nh@hh+]rIhM)rJ}rK(h0Xto have more than one action inside a list, the ampersand character must be placed in the position of the filter, and this must immediately follow the previous actionrLh1jFh2h3h4hQh6}rM(h8]h9]h:]h;]h=]uh?K9h+]rNhIXto have more than one action inside a list, the ampersand character must be placed in the position of the filter, and this must immediately follow the previous actionrOrP}rQ(h0jLh1jJubaubaubh)rR}rS(h0Xactions consist of the action call itself (e.g. ":omusrmsg:") as well as all action-defining configuration statements ($Action... directives) h1h|h2h3h4hh6}rT(h8]h9]h:]h;]h=]uh?Nh@hh+]rUhM)rV}rW(h0Xactions consist of the action call itself (e.g. ":omusrmsg:") as well as all action-defining configuration statements ($Action... directives)rXh1jRh2h3h4hQh6}rY(h8]h9]h:]h;]h=]uh?K=h+]rZhIXactions consist of the action call itself (e.g. ":omusrmsg:") as well as all action-defining configuration statements ($Action... directives)r[r\}r](h0jXh1jVubaubaubh)r^}r_(h0Xif legacy format is used (see below), $Action... directives **must** be specified in front of the action they are intended to configure h1h|h2h3h4hh6}r`(h8]h9]h:]h;]h=]uh?Nh@hh+]rahM)rb}rc(h0Xif legacy format is used (see below), $Action... directives **must** be specified in front of the action they are intended to configureh1j^h2h3h4hQh6}rd(h8]h9]h:]h;]h=]uh?K@h+]re(hIX<if legacy format is used (see below), $Action... directives rfrg}rh(h0X<if legacy format is used (see below), $Action... directives h1jbubj)ri}rj(h0X**must**h6}rk(h8]h9]h:]h;]h=]uh1jbh+]rlhIXmustrmrn}ro(h0Uh1jiubah4j ubhIXC be specified in front of the action they are intended to configurerprq}rr(h0XC be specified in front of the action they are intended to configureh1jbubeubaubh)rs}rt(h0Xsome config directives automatically refer to their previous values after being applied, others not. See the respective doc for details. Be warned that this is currently not always properly documented. h1h|h2h3h4hh6}ru(h8]h9]h:]h;]h=]uh?Nh@hh+]rvhM)rw}rx(h0Xsome config directives automatically refer to their previous values after being applied, others not. See the respective doc for details. Be warned that this is currently not always properly documented.ryh1jsh2h3h4hQh6}rz(h8]h9]h:]h;]h=]uh?KCh+]r{hIXsome config directives automatically refer to their previous values after being applied, others not. See the respective doc for details. Be warned that this is currently not always properly documented.r|r}}r~(h0jyh1jwubaubaubh)r}r(h0Xin general, rsyslog v5 is heavily outdated and its native config language is a pain. The rsyslog project strongly recommends using at least version 7, where these problems are solved and configuration is much easier. h1h|h2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0Xin general, rsyslog v5 is heavily outdated and its native config language is a pain. The rsyslog project strongly recommends using at least version 7, where these problems are solved and configuration is much easier.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KGh+]rhIXin general, rsyslog v5 is heavily outdated and its native config language is a pain. The rsyslog project strongly recommends using at least version 7, where these problems are solved and configuration is much easier.rr}r(h0jh1jubaubaubh)r}r(h0Xplegacy configuration statements (those starting with $) do **not** affect RainerScript objects (e.g. actions). h1h|h2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0Xnlegacy configuration statements (those starting with $) do **not** affect RainerScript objects (e.g. actions).h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KKh+]r(hIX;legacy configuration statements (those starting with $) do rr}r(h0X;legacy configuration statements (those starting with $) do h1jubj)r}r(h0X**not**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXnotrr}r(h0Uh1jubah4j ubhIX, affect RainerScript objects (e.g. actions).rr}r(h0X, affect RainerScript objects (e.g. actions).h1jubeubaubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh$ah=]rh auh?KPh@hh+]r(hB)r}r(h0XConfiguration Filerh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?KPh@hh+]rhIXConfiguration Filerr}r(h0jh1jubaubhM)r}r(h0XUpon startup, rsyslog reads its configuration from the ``rsyslog.conf`` file by default. This file may contain references to include other config files.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KQh@hh+]r(hIX7Upon startup, rsyslog reads its configuration from the rr}r(h0X7Upon startup, rsyslog reads its configuration from the h1jubcdocutils.nodes literal r)r}r(h0X``rsyslog.conf``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX rsyslog.confrr}r(h0Uh1jubah4UliteralrubhIXQ file by default. This file may contain references to include other config files.rr}r(h0XQ file by default. This file may contain references to include other config files.h1jubeubhM)r}r(h0XA different "root" configuration file can be specified via the ``-f `` rsyslogd command line option. This is usually done within some init script or similar facility.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?KUh@hh+]r(hIX?A different "root" configuration file can be specified via the rr}r(h0X?A different "root" configuration file can be specified via the h1jubj)r}r(h0X ``-f ``h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX -f rr}r(h0Uh1jubah4jubhIX` rsyslogd command line option. This is usually done within some init script or similar facility.rr}r(h0X` rsyslogd command line option. This is usually done within some init script or similar facility.h1jubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh%ah=]rhauh?KZh@hh+]r(hB)r}r(h0XStatement Typesrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?KZh@hh+]rhIXStatement Typesrr}r(h0jh1jubaubhM)r}r(h0XPRsyslog supports three different types of configuration statements concurrently:rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?K[h@hh+]rhIXPRsyslog supports three different types of configuration statements concurrently:rr}r(h0jh1jubaubh{)r}r(h0Uh1jh2h3h4h~h6}r(hX-h;]h:]h8]h9]h=]uh?K^h@hh+]r(h)r}r(h0X **sysklogd** - this is the plain old format, taught everywhere and still pretty useful for simple use cases. Note that some very few constructs are no longer supported because they are incompatible with newer features. These are mentioned in the compatibility docs.h1jh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X **sysklogd** - this is the plain old format, taught everywhere and still pretty useful for simple use cases. Note that some very few constructs are no longer supported because they are incompatible with newer features. These are mentioned in the compatibility docs.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?K^h+]r(j)r}r(h0X **sysklogd**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXsysklogdrr}r(h0Uh1jubah4j ubhIX - this is the plain old format, taught everywhere and still pretty useful for simple use cases. Note that some very few constructs are no longer supported because they are incompatible with newer features. These are mentioned in the compatibility docs.rr}r(h0X - this is the plain old format, taught everywhere and still pretty useful for simple use cases. Note that some very few constructs are no longer supported because they are incompatible with newer features. These are mentioned in the compatibility docs.h1jubeubaubh)r}r(h0X**legacy rsyslog** - these are statements that begin with a dollar sign. They set some configuration parameters and modify e.g. the way actions operate. This is the only format supported in pre-v6 versions of rsyslog. It is still fully supported in v6 and above. Note that some plugins and features may still only be available through legacy format (because plugins need to be explicitly upgraded to use the new style format, and this hasn't happened to all plugins).h1jh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X**legacy rsyslog** - these are statements that begin with a dollar sign. They set some configuration parameters and modify e.g. the way actions operate. This is the only format supported in pre-v6 versions of rsyslog. It is still fully supported in v6 and above. Note that some plugins and features may still only be available through legacy format (because plugins need to be explicitly upgraded to use the new style format, and this hasn't happened to all plugins).h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kbh+]r(j)r}r(h0X**legacy rsyslog**h6}r(h8]h9]h:]h;]h=]uh1jh+]r hIXlegacy rsyslogr r }r (h0Uh1jubah4j ubhIX - these are statements that begin with a dollar sign. They set some configuration parameters and modify e.g. the way actions operate. This is the only format supported in pre-v6 versions of rsyslog. It is still fully supported in v6 and above. Note that some plugins and features may still only be available through legacy format (because plugins need to be explicitly upgraded to use the new style format, and this hasn't happened to all plugins).r r}r(h0X - these are statements that begin with a dollar sign. They set some configuration parameters and modify e.g. the way actions operate. This is the only format supported in pre-v6 versions of rsyslog. It is still fully supported in v6 and above. Note that some plugins and features may still only be available through legacy format (because plugins need to be explicitly upgraded to use the new style format, and this hasn't happened to all plugins).h1jubeubaubh)r}r(h0X**RainerScript** - the new style format. This is the best and most precise format to be used for more complex cases. The rest of this page assumes RainerScript based rsyslog.conf. h1jh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X**RainerScript** - the new style format. This is the best and most precise format to be used for more complex cases. The rest of this page assumes RainerScript based rsyslog.conf.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kih+]r(j)r}r(h0X**RainerScript**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX RainerScriptrr}r(h0Uh1jubah4j ubhIX - the new style format. This is the best and most precise format to be used for more complex cases. The rest of this page assumes RainerScript based rsyslog.conf.rr }r!(h0X - the new style format. This is the best and most precise format to be used for more complex cases. The rest of this page assumes RainerScript based rsyslog.conf.h1jubeubaubeubhM)r"}r#(h0XThe rsyslog.conf files consists of statements. For old style (sysklogd & legacy rsyslog), lines do matter. For new style (RainerScript) line spacing is irrelevant. Most importantly, this means with new style actions and all other objects can split across lines as users want to.r$h1jh2h3h4hQh6}r%(h8]h9]h:]h;]h=]uh?Kmh@hh+]r&hIXThe rsyslog.conf files consists of statements. For old style (sysklogd & legacy rsyslog), lines do matter. For new style (RainerScript) line spacing is irrelevant. Most importantly, this means with new style actions and all other objects can split across lines as users want to.r'r(}r)(h0j$h1j"ubaubh-)r*}r+(h0Uh1jh2h3h4h5h6}r,(h8]h9]h:]h;]r-h)ah=]r.hauh?Ksh@hh+]r/(hB)r0}r1(h0X"Recommended use of Statement Typesr2h1j*h2h3h4hFh6}r3(h8]h9]h:]h;]h=]uh?Ksh@hh+]r4hIX"Recommended use of Statement Typesr5r6}r7(h0j2h1j0ubaubhM)r8}r9(h0X!In general it is recommended to use RainerScript type statements, as these provide clean and easy to read control-of-flow as well as no doubt about which parameters are active. They also have no side-effects with include files, which can be a major obstacle with legacy rsyslog statements.r:h1j*h2h3h4hQh6}r;(h8]h9]h:]h;]h=]uh?Kuh@hh+]r<hIX!In general it is recommended to use RainerScript type statements, as these provide clean and easy to read control-of-flow as well as no doubt about which parameters are active. They also have no side-effects with include files, which can be a major obstacle with legacy rsyslog statements.r=r>}r?(h0j:h1j8ubaubhM)r@}rA(h0XFor very simple things sysklogd statement types are still suggested, especially if the full config consists of such simple things. The classical sample is writing to files (or forwarding) via priority. In sysklogd, this looks like:rBh1j*h2h3h4hQh6}rC(h8]h9]h:]h;]h=]uh?K{h@hh+]rDhIXFor very simple things sysklogd statement types are still suggested, especially if the full config consists of such simple things. The classical sample is writing to files (or forwarding) via priority. In sysklogd, this looks like:rErF}rG(h0jBh1j@ubaubcdocutils.nodes literal_block rH)rI}rJ(h0X8mail.info /var/log/mail.log mail.err @server.example.neth1j*h2h3h4U literal_blockrKh6}rL(U xml:spacerMUpreserverNh;]h:]h8]h9]h=]uh?Kh@hh+]rOhIX8mail.info /var/log/mail.log mail.err @server.example.netrPrQ}rR(h0Uh1jIubaubhM)rS}rT(h0XThis is hard to beat in simplicity, still being taught in courses and a lot of people know this syntax. It is perfectly fine to use these constructs even in newly written config files.rUh1j*h2h3h4hQh6}rV(h8]h9]h:]h;]h=]uh?Kh@hh+]rWhIXThis is hard to beat in simplicity, still being taught in courses and a lot of people know this syntax. It is perfectly fine to use these constructs even in newly written config files.rXrY}rZ(h0jUh1jSubaubhM)r[}r\(h0XJ**As a rule of thumb, RainerScript config statements should be used when**r]h1j*h2h3h4hQh6}r^(h8]h9]h:]h;]h=]uh?Kh@hh+]r_j)r`}ra(h0j]h6}rb(h8]h9]h:]h;]h=]uh1j[h+]rchIXFAs a rule of thumb, RainerScript config statements should be used whenrdre}rf(h0Uh1j`ubah4j ubaubh{)rg}rh(h0Uh1j*h2h3h4h~h6}ri(hX-h;]h:]h8]h9]h=]uh?Kh@hh+]rj(h)rk}rl(h0XXconfiguration parameters are required (e.g. the ``Action...`` type of legacy statements)h1jgh2h3h4hh6}rm(h8]h9]h:]h;]h=]uh?Nh@hh+]rnhM)ro}rp(h0XXconfiguration parameters are required (e.g. the ``Action...`` type of legacy statements)h1jkh2h3h4hQh6}rq(h8]h9]h:]h;]h=]uh?Kh+]rr(hIX0configuration parameters are required (e.g. the rsrt}ru(h0X0configuration parameters are required (e.g. the h1joubj)rv}rw(h0X ``Action...``h6}rx(h8]h9]h:]h;]h=]uh1joh+]ryhIX Action...rzr{}r|(h0Uh1jvubah4jubhIX type of legacy statements)r}r~}r(h0X type of legacy statements)h1joubeubaubh)r}r(h0Xpmore elaborate control-of-flow is required (e.g. when multiple actions must be nested under the same condition) h1jgh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0Xomore elaborate control-of-flow is required (e.g. when multiple actions must be nested under the same condition)rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]rhIXomore elaborate control-of-flow is required (e.g. when multiple actions must be nested under the same condition)rr}r(h0jh1jubaubaubeubhM)r}r(h0XIt is usually **not** recommended to use rsyslog legacy config format (those directives starting with a dollar sign). However, a few settings and modules have not yet been converted to RainerScript. In those cases, the legacy syntax must be used.h1j*h2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXIt is usually rr}r(h0XIt is usually h1jubj)r}r(h0X**not**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXnotrr}r(h0Uh1jubah4j ubhIX recommended to use rsyslog legacy config format (those directives starting with a dollar sign). However, a few settings and modules have not yet been converted to RainerScript. In those cases, the legacy syntax must be used.rr}r(h0X recommended to use rsyslog legacy config format (those directives starting with a dollar sign). However, a few settings and modules have not yet been converted to RainerScript. In those cases, the legacy syntax must be used.h1jubeubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh"ah=]rh auh?Kh@hh+]r(hB)r}r(h0XCommentsrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXCommentsrr}r(h0jh1jubaubhM)r}r(h0X There are two types of comments:rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIX There are two types of comments:rr}r(h0jh1jubaubh{)r}r(h0Uh1jh2h3h4h~h6}r(hX-h;]h:]h8]h9]h=]uh?Kh@hh+]r(h)r}r(h0XJ**#-Comments** - start with a hash sign (#) and run to the end of the lineh1jh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0XJ**#-Comments** - start with a hash sign (#) and run to the end of the lineh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]r(j)r}r(h0X**#-Comments**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIX #-Commentsrr}r(h0Uh1jubah4j ubhIX< - start with a hash sign (#) and run to the end of the linerr}r(h0X< - start with a hash sign (#) and run to the end of the lineh1jubeubaubh)r}r(h0X**C-style Comments** - start with /\* and end with \*/, just like in the C programming language. They can be used to comment out multiple lines at once. Comment nesting is not supported, but #-Comments can be contained inside a C-style comment. h1jh2h3h4hh6}r(h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X**C-style Comments** - start with /\* and end with \*/, just like in the C programming language. They can be used to comment out multiple lines at once. Comment nesting is not supported, but #-Comments can be contained inside a C-style comment.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]r(j)r}r(h0X**C-style Comments**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXC-style Commentsrr}r(h0Uh1jubah4j ubhIX - start with /* and end with */, just like in the C programming language. They can be used to comment out multiple lines at once. Comment nesting is not supported, but #-Comments can be contained inside a C-style comment.rr}r(h0X - start with /\* and end with \*/, just like in the C programming language. They can be used to comment out multiple lines at once. Comment nesting is not supported, but #-Comments can be contained inside a C-style comment.h1jubeubaubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh(ah=]rhauh?Kh@hh+]r(hB)r}r(h0XProcessing Orderrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXProcessing Orderrr}r(h0jh1jubaubhM)r}r(h0XDirectives are processed from the top of rsyslog.conf to the bottom. Order matters. For example, if you stop processing of a message, obviously all statements after the stop statement are never evaluated.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXDirectives are processed from the top of rsyslog.conf to the bottom. Order matters. For example, if you stop processing of a message, obviously all statements after the stop statement are never evaluated.rr}r(h0jh1jubaubh-)r}r(h0Uh1jh2h3h4h5h6}r(h8]h9]h:]h;]rhah=]rhauh?Kh@hh+]r(hB)r}r(h0XFlow Control Statementsrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXFlow Control Statementsrr}r(h0jh1jubaubhM)r}r(h0XFlow control is provided by:rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXFlow control is provided by:rr}r(h0jh1jubaubh{)r}r(h0Uh1jh2h3h4h~h6}r (hX-h;]h:]h8]h9]h=]uh?Kh@hh+]r (h)r }r (h0X?:doc:`Control Structures <../rainerscript/control_structures>` h1jh2h3h4hh6}r (h8]h9]h:]h;]h=]uh?Nh@hh+]rhM)r}r(h0X>:doc:`Control Structures <../rainerscript/control_structures>`rh1j h2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh+]rcsphinx.addnodes pending_xref r)r}r(h0jh1jh2h3h4U pending_xrefrh6}r(UreftypeXdocrUrefwarnrU reftargetrX"../rainerscript/control_structuresU refdomainUh;]h:]U refexplicith8]h9]h=]UrefdocrXconfiguration/basic_structureruh?Kh+]rj)r}r (h0jh6}r!(h8]h9]r"(Uxrefr#jeh:]h;]h=]uh1jh+]r$hIXControl Structuresr%r&}r'(h0Uh1jubah4jubaubaubaubh)r(}r)(h0X$:doc:`Filter Conditions ` h1jh2h3h4hh6}r*(h8]h9]h:]h;]h=]uh?Nh@hh+]r+hM)r,}r-(h0X":doc:`Filter Conditions `r.h1j(h2h3h4hQh6}r/(h8]h9]h:]h;]h=]uh?Kh+]r0j)r1}r2(h0j.h1j,h2h3h4jh6}r3(UreftypeXdocr4jjXfiltersU refdomainUh;]h:]U refexplicith8]h9]h=]jjuh?Kh+]r5j)r6}r7(h0j.h6}r8(h8]h9]r9(j#j4eh:]h;]h=]uh1j1h+]r:hIXFilter Conditionsr;r<}r=(h0Uh1j6ubah4jubaubaubaubeubeubh-)r>}r?(h0Uh1jh2h3h4h5h6}r@(h8]h9]h:]h;]rAh#ah=]rBh auh?Kh@hh+]rC(hB)rD}rE(h0XData Manipulation StatementsrFh1j>h2h3h4hFh6}rG(h8]h9]h:]h;]h=]uh?Kh@hh+]rHhIXData Manipulation StatementsrIrJ}rK(h0jFh1jDubaubhM)rL}rM(h0XData manipulation is achieved by **set**, **unset** and **reset** statements which are :doc:`documented here in detail <../rainerscript/variable_property_types>`.h1j>h2h3h4hQh6}rN(h8]h9]h:]h;]h=]uh?Kh@hh+]rO(hIX!Data manipulation is achieved by rPrQ}rR(h0X!Data manipulation is achieved by h1jLubj)rS}rT(h0X**set**h6}rU(h8]h9]h:]h;]h=]uh1jLh+]rVhIXsetrWrX}rY(h0Uh1jSubah4j ubhIX, rZr[}r\(h0X, h1jLubj)r]}r^(h0X **unset**h6}r_(h8]h9]h:]h;]h=]uh1jLh+]r`hIXunsetrarb}rc(h0Uh1j]ubah4j ubhIX and rdre}rf(h0X and h1jLubj)rg}rh(h0X **reset**h6}ri(h8]h9]h:]h;]h=]uh1jLh+]rjhIXresetrkrl}rm(h0Uh1jgubah4j ubhIX statements which are rnro}rp(h0X statements which are h1jLubj)rq}rr(h0XJ:doc:`documented here in detail <../rainerscript/variable_property_types>`rsh1jLh2h3h4jh6}rt(UreftypeXdocrujjX'../rainerscript/variable_property_typesU refdomainUh;]h:]U refexplicith8]h9]h=]jjuh?Kh+]rvj)rw}rx(h0jsh6}ry(h8]h9]rz(j#jueh:]h;]h=]uh1jqh+]r{hIXdocumented here in detailr|r}}r~(h0Uh1jwubah4jubaubhIX.r}r(h0X.h1jLubeubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rhah=]rhauh?Kh@hh+]r(hB)r}r(h0XInputsrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXInputsrr}r(h0jh1jubaubhM)r}r(h0XEvery input requires an input module to be loaded and a listener defined for it. Full details can be found inside the `rsyslog modules `_ documentation. Once loaded, inputs are defined via the **input()** object.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXvEvery input requires an input module to be loaded and a listener defined for it. Full details can be found inside the rr}r(h0XvEvery input requires an input module to be loaded and a listener defined for it. Full details can be found inside the h1jubcdocutils.nodes reference r)r}r(h0X.`rsyslog modules `_h6}r(UnameXrsyslog modulesUrefurirXrsyslog_conf_modules.htmlrh;]h:]h8]h9]h=]uh1jh+]rhIXrsyslog modulesrr}r(h0Uh1jubah4U referencerubcdocutils.nodes target r)r}r(h0X U referencedrKh1jh4Utargetrh6}r(Urefurijh;]rh!ah:]h8]h9]h=]rh auh+]ubhIX8 documentation. Once loaded, inputs are defined via the rr}r(h0X8 documentation. Once loaded, inputs are defined via the h1jubj)r}r(h0X **input()**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXinput()rr}r(h0Uh1jubah4j ubhIX object.rr}r(h0X object.h1jubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh ah=]rh auh?Kh@hh+]r(hB)r}r(h0XOutputsrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXOutputsrr}r(h0jh1jubaubhM)r}r(h0XOutputs are also called "actions". A small set of actions is pre-loaded (like the output file writer, which is used in almost every rsyslog.conf), others must be loaded just like inputs.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXOutputs are also called "actions". A small set of actions is pre-loaded (like the output file writer, which is used in almost every rsyslog.conf), others must be loaded just like inputs.rr}r(h0jh1jubaubhM)r}r(h0XAn action is invoked via the **action(type="type" ...)** object. Type is mandatory and must contain the name of the plugin to be called (e.g. "omfile" or "ommongodb"). Other parameters may be present. Their type and use depends on the output plugin in question.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIXAn action is invoked via the rr}r(h0XAn action is invoked via the h1jubj)r}r(h0X**action(type="type" ...)**h6}r(h8]h9]h:]h;]h=]uh1jh+]rhIXaction(type="type" ...)rr}r(h0Uh1jubah4j ubhIX object. Type is mandatory and must contain the name of the plugin to be called (e.g. "omfile" or "ommongodb"). Other parameters may be present. Their type and use depends on the output plugin in question.rr}r(h0X object. Type is mandatory and must contain the name of the plugin to be called (e.g. "omfile" or "ommongodb"). Other parameters may be present. Their type and use depends on the output plugin in question.h1jubeubeubh-)r}r(h0Uh1h.h2h3h4h5h6}r(h8]h9]h:]h;]rh&ah=]rhauh?Kh@hh+]r(hB)r}r(h0XRulesets and Rulesrh1jh2h3h4hFh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXRulesets and Rulesrr}r(h0jh1jubaubhM)r}r(h0XRulesets and rules form the basis of rsyslog processing. In short, a rule is a way how rsyslog shall process a specific message. Usually, there is a type of filter (if-statement) in front of the rule. Complex nesting of rules is possible, much like in a programming language.rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXRulesets and rules form the basis of rsyslog processing. In short, a rule is a way how rsyslog shall process a specific message. Usually, there is a type of filter (if-statement) in front of the rule. Complex nesting of rules is possible, much like in a programming language.rr}r(h0jh1jubaubhM)r}r(h0XmRulesets are containers for rules. A single ruleset can contain many rules. In the programming language analogy, one may think of a ruleset like being a program. A ruleset can be "bound" (assigned) to a specific input. In the analogy, this means that when a message comes in via that input, the "program" (ruleset) bound to it will be executed (but not any other!).rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIXmRulesets are containers for rules. A single ruleset can contain many rules. In the programming language analogy, one may think of a ruleset like being a program. A ruleset can be "bound" (assigned) to a specific input. In the analogy, this means that when a message comes in via that input, the "program" (ruleset) bound to it will be executed (but not any other!).rr}r(h0jh1jubaubhM)r}r(h0XbThere is detailed documentation available for :doc:`rsyslog rulesets <../concepts/multi_ruleset>`.h1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]r(hIX.There is detailed documentation available for rr}r(h0X.There is detailed documentation available for h1jubj)r}r(h0X3:doc:`rsyslog rulesets <../concepts/multi_ruleset>`rh1jh2h3h4jh6}r(UreftypeXdocrjjX../concepts/multi_rulesetU refdomainUh;]h:]U refexplicith8]h9]h=]jjuh?Kh+]rj)r}r (h0jh6}r (h8]h9]r (j#jeh:]h;]h=]uh1jh+]r hIXrsyslog rulesetsr r}r(h0Uh1jubah4jubaubhIX.r}r(h0X.h1jubeubhM)r}r(h0X5For quick reference, rulesets are defined as follows:rh1jh2h3h4hQh6}r(h8]h9]h:]h;]h=]uh?Kh@hh+]rhIX5For quick reference, rulesets are defined as follows:rr}r(h0jh1jubaubjH)r}r(h0Xruleset(name="rulesetname") { action(type="omfile" file="/path/to/file") action(type="..." ...) /* and so on... */ }h1jh2h3h4jKh6}r(jMjNh;]h:]h8]h9]h=]uh?Kh@hh+]rhIXruleset(name="rulesetname") { action(type="omfile" file="/path/to/file") action(type="..." ...) /* and so on... */ }rr}r (h0Uh1jubaubeubeubah0UU transformerr!NU footnote_refsr"}r#Urefnamesr$}r%Usymbol_footnotesr&]r'Uautofootnote_refsr(]r)Usymbol_footnote_refsr*]r+U citationsr,]r-h@hU current_liner.NUtransform_messagesr/]r0Ureporterr1NUid_startr2KU autofootnotesr3]r4U citation_refsr5}r6Uindirect_targetsr7]r8Usettingsr9(cdocutils.frontend Values r:or;}r<(Ufootnote_backlinksr=KUrecord_dependenciesr>NU rfc_base_urlr?Uhttps://tools.ietf.org/html/r@U tracebackrAUpep_referencesrBNUstrip_commentsrCNU toc_backlinksrDUentryrEU language_coderFUenrGU datestamprHNU report_levelrIKU _destinationrJNU halt_levelrKKU strip_classesrLNhFNUerror_encoding_error_handlerrMUbackslashreplacerNUdebugrONUembed_stylesheetrPUoutput_encoding_error_handlerrQUstrictrRU sectnum_xformrSKUdump_transformsrTNU docinfo_xformrUKUwarning_streamrVNUpep_file_url_templaterWUpep-%04drXUexit_status_levelrYKUconfigrZNUstrict_visitorr[NUcloak_email_addressesr\Utrim_footnote_reference_spacer]Uenvr^NUdump_pseudo_xmlr_NUexpose_internalsr`NUsectsubtitle_xformraU source_linkrbNUrfc_referencesrcNUoutput_encodingrdUutf-8reU source_urlrfNUinput_encodingrgU utf-8-sigrhU_disable_configriNU id_prefixrjUU tab_widthrkKUerror_encodingrlUUTF-8rmU_sourcernh3Ugettext_compactroU generatorrpNUdump_internalsrqNU smart_quotesrrU pep_base_urlrsU https://www.python.org/dev/peps/rtUsyntax_highlightruUlongrvUinput_encoding_error_handlerrwjRUauto_id_prefixrxUidryUdoctitle_xformrzUstrip_elements_with_classesr{NU _config_filesr|]r}Ufile_insertion_enabledr~U raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hjh%jh)j*h&jh'h.h!jh$jh"jhjhhWh(jh jh*hmh#j>uUsubstitution_namesr}rh4h@h6}r(h8]h;]h:]Usourceh3h9]h=]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/parser.doctree0000664000175000017500000004132613035122643020244 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XsamplesqNXrainer gerhardsqXparserqNX cfgobj_inputq Xadisconq Xgeneral parser parametersq NXrsyslogq uUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUsamplesqhUrainer-gerhardsqhUparserqh U cfgobj-inputqh Uadisconqh Ugeneral-parser-parametersqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$X;/home/rger/proj/rsyslog-doc/source/configuration/parser.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0hauUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"XParserq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;XParserq(h"h7h#h5ubaubcsphinx.addnodes index q?)q@}qA(h"Uh#h h$h%h&UindexqBh(}qC(h-]h,]h*]h+]h/]UentriesqD]qE(UsingleqFXparserUindex-0qGUmainqHtqIaUinlineqJuh1Kh2hh]ubcdocutils.nodes target qK)qL}qM(h"Uh#h h$h%h&UtargetqNh(}qO(h-]h,]h*]h+]h/]UrefidqPhGuh1Kh2hh]ubhK)qQ}qR(h"X.. _cfgobj_input:h#h h$h%Uexpect_referenced_by_nameqS}h&hNh(}qT(h-]h,]h*]h+]h/]hPhuh1Kh2hUexpect_referenced_by_idqU}qVhGhLsh]ubcdocutils.nodes paragraph qW)qX}qY(h"XThe ``parser`` object, as its name suggests, describes message parsers. Message parsers have a standard parser name, which can be used by simply loading the parser module. Only when specific parameters need to be set the parser object is needed.h#h h$h%hS}qZh hQsh&U paragraphq[h(}q\(h*]h+]h,]h-]q](hhGeh/]q^h auh1Kh2hhU}q_(hGhLhhQuh]q`(h;XThe qaqb}qc(h"XThe h#hXubcdocutils.nodes literal qd)qe}qf(h"X ``parser``h(}qg(h*]h+]h,]h-]h/]uh#hXh]qhh;Xparserqiqj}qk(h"Uh#heubah&Uliteralqlubh;X object, as its name suggests, describes message parsers. Message parsers have a standard parser name, which can be used by simply loading the parser module. Only when specific parameters need to be set the parser object is needed.qmqn}qo(h"X object, as its name suggests, describes message parsers. Message parsers have a standard parser name, which can be used by simply loading the parser module. Only when specific parameters need to be set the parser object is needed.h#hXubeubhW)qp}qq(h"XIn that case, it is used to define a new parser name (aka "parser definition") which configures this name to use the parser module with set parameters. This is important as the ruleset() object does not support to set parser parameters. Instead, if parameters are needed, a proper parser name must be defined using the parser() object. A parser name defined via the parser() object can be used whereever a parser name can occur.qrh#h h$h%h&h[h(}qs(h*]h+]h,]h-]h/]uh1K h2hh]qth;XIn that case, it is used to define a new parser name (aka "parser definition") which configures this name to use the parser module with set parameters. This is important as the ruleset() object does not support to set parser parameters. Instead, if parameters are needed, a proper parser name must be defined using the parser() object. A parser name defined via the parser() object can be used whereever a parser name can occur.quqv}qw(h"hrh#hpubaubhW)qx}qy(h"XNote that not all message parser modules are supported in the parser() object. The reason is that many do not have any user-selectable parameters and as such, there is no point in issuing a parser() object for them.qzh#h h$h%h&h[h(}q{(h*]h+]h,]h-]h/]uh1Kh2hh]q|h;XNote that not all message parser modules are supported in the parser() object. The reason is that many do not have any user-selectable parameters and as such, there is no point in issuing a parser() object for them.q}q~}q(h"hzh#hxubaubhW)q}q(h"X+The parser object has different parameters:qh#h h$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1Kh2hh]qh;X+The parser object has different parameters:qq}q(h"hh#hubaubcdocutils.nodes bullet_list q)q}q(h"Uh#h h$h%h&U bullet_listqh(}q(UbulletqX-h-]h,]h*]h+]h/]uh1Kh2hh]q(cdocutils.nodes list_item q)q}q(h"Xgthose that apply to all parser and are generally available for all of them. These are documented below.h#hh$h%h&U list_itemqh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qhW)q}q(h"Xgthose that apply to all parser and are generally available for all of them. These are documented below.qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1Kh]qh;Xgthose that apply to all parser and are generally available for all of them. These are documented below.qq}q(h"hh#hubaubaubh)q}q(h"Xparser-specific parameters. These are specific to a certain parser module. They are documented by the :doc:`parser module ` in question. h#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qhW)q}q(h"Xparser-specific parameters. These are specific to a certain parser module. They are documented by the :doc:`parser module ` in question.h#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1Kh]q(h;Xfparser-specific parameters. These are specific to a certain parser module. They are documented by the qq}q(h"Xfparser-specific parameters. These are specific to a certain parser module. They are documented by the h#hubcsphinx.addnodes pending_xref q)q}q(h"X):doc:`parser module `qh#hh$h%h&U pending_xrefqh(}q(UreftypeXdocqUrefwarnqU reftargetqXmodules/idx_parserU refdomainUh-]h,]U refexplicith*]h+]h/]UrefdocqXconfiguration/parserquh1Kh]qhd)q}q(h"hh(}q(h*]h+]q(Uxrefqheh,]h-]h/]uh#hh]qh;X parser moduleqq}q(h"Uh#hubah&hlubaubh;X in question.qq}q(h"X in question.h#hubeubaubeubh)q}q(h"Uh#h h$h%h&h'h(}q(h*]h+]h,]h-]qhah/]qh auh1K"h2hh]q(h4)q}q(h"XGeneral Parser Parametersqh#hh$h%h&h8h(}q(h*]h+]h,]h-]h/]uh1K"h2hh]qh;XGeneral Parser Parametersq˅q}q(h"hh#hubaubh?)q}q(h"Uh#hh$h%h&hBh(}q(h-]h,]h*]h+]h/]Uentries]uh1Nh2hh]ubcsphinx.addnodes desc q)q}q(h"Uh#hh$h%h&Udescqh(}q(Unoindexq։UdomainqXpyh-]h,]h*]h+]h/]UobjtypeqXfunctionqUdesctypeqhuh1Nh2hh]q(csphinx.addnodes desc_signature q)q}q(h"Xname qh#hh$h%h&Udesc_signatureqh(}q(h-]h,]h*]h+]h/]Ufirstquh1K,h2hh]qcsphinx.addnodes desc_name q)q}q(h"hh#hh$h%h&U desc_nameqh(}q(h*]h+]h,]h-]h/]uh1K,h2hh]qh;Xname qꅁq}q(h"Uh#hubaubaubcsphinx.addnodes desc_content q)q}q(h"Uh#hh$h%h&U desc_contentqh(}q(h*]h+]h,]h-]h/]uh1K,h2hh]q(hW)q}q(h"X *Mandatory*qh#hh$h%h&h[h(}q(h*]h+]h,]h-]h/]uh1K&h2hh]qcdocutils.nodes emphasis q)q}q(h"hh(}q(h*]h+]h,]h-]h/]uh#hh]qh;X Mandatoryqq}q(h"Uh#hubah&UemphasisrubaubhW)r}r(h"XThis names the parser. Names starting with "rsyslog." are reserved for rsyslog use and must not be used. It is suggested to replace "rsyslog." with "custom." and keep the rest of the name descriptive. However, this is not enforced and just good practice.rh#hh$h%h&h[h(}r(h*]h+]h,]h-]h/]uh1K(h2hh]rh;XThis names the parser. Names starting with "rsyslog." are reserved for rsyslog use and must not be used. It is suggested to replace "rsyslog." with "custom." and keep the rest of the name descriptive. However, this is not enforced and just good practice.rr}r(h"jh#jubaubeubeubh?)r }r (h"Uh#hh$h%h&hBh(}r (h-]h,]h*]h+]h/]Uentries]uh1Nh2hh]ubh)r }r (h"Uh#hh$h%h&hh(}r(h։hXpyh-]h,]h*]h+]h/]hXfunctionrhjuh1Nh2hh]r(h)r}r(h"Xtype rh#j h$h%h&hh(}r(h-]h,]h*]h+]h/]huh1K8h2hh]rh)r}r(h"jh#jh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1K8h2hh]rh;Xtype rr}r(h"Uh#jubaubaubh)r}r(h"Uh#j h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1K8h2hh]r (hW)r!}r"(h"X *Mandatory*r#h#jh$h%h&h[h(}r$(h*]h+]h,]h-]h/]uh1K/h2hh]r%h)r&}r'(h"j#h(}r((h*]h+]h,]h-]h/]uh#j!h]r)h;X Mandatoryr*r+}r,(h"Uh#j&ubah&jubaubhW)r-}r.(h"XWThe ```` is a string identifying the parser module as given it each module's documentation. Do not mistake the parser module name with its default parser name. For example, the :doc:`Cisco IOS message parser module ` parser module name is "pmciscoios", whereas it's default parser name is "rsyslog.pmciscoios".h#jh$h%h&h[h(}r/(h*]h+]h,]h-]h/]uh1K1h2hh]r0(h;XThe r1r2}r3(h"XThe h#j-ubhd)r4}r5(h"X````h(}r6(h*]h+]h,]h-]h/]uh#j-h]r7h;X r8r9}r:(h"Uh#j4ubah&hlubh;X is a string identifying the parser module as given it each module's documentation. Do not mistake the parser module name with its default parser name. For example, the r;r<}r=(h"X is a string identifying the parser module as given it each module's documentation. Do not mistake the parser module name with its default parser name. For example, the h#j-ubh)r>}r?(h"X;:doc:`Cisco IOS message parser module `r@h#j-h$h%h&hh(}rA(UreftypeXdocrBhhXmodules/pmciscoiosU refdomainUh-]h,]U refexplicith*]h+]h/]hhuh1K1h]rChd)rD}rE(h"j@h(}rF(h*]h+]rG(hjBeh,]h-]h/]uh#j>h]rHh;XCisco IOS message parser modulerIrJ}rK(h"Uh#jDubah&hlubaubh;X^ parser module name is "pmciscoios", whereas it's default parser name is "rsyslog.pmciscoios".rLrM}rN(h"X^ parser module name is "pmciscoios", whereas it's default parser name is "rsyslog.pmciscoios".h#j-ubeubeubeubeubh)rO}rP(h"Uh#h h$h%h&h'h(}rQ(h*]h+]h,]h-]rRhah/]rShauh1K:h2hh]rT(h4)rU}rV(h"XSamplesrWh#jOh$h%h&h8h(}rX(h*]h+]h,]h-]h/]uh1K:h2hh]rYh;XSamplesrZr[}r\(h"jWh#jUubaubhW)r]}r^(h"XVThe following example creates a custom parser definition and uses it within a ruleset:r_h#jOh$h%h&h[h(}r`(h*]h+]h,]h-]h/]uh1K;h2hh]rah;XVThe following example creates a custom parser definition and uses it within a ruleset:rbrc}rd(h"j_h#j]ubaubcdocutils.nodes literal_block re)rf}rg(h"Xload(module="pmciscoios") parser(name="custom.pmciscoios.with_origin" type="pmciscoios") ruleset(name="myRuleset" parser="custom.pmciscoios.with_origin") { ... do something here ... }h#jOh$h%h&U literal_blockrhh(}ri(U xml:spacerjUpreserverkh-]h,]h*]h+]h/]uh1K?h2hh]rlh;Xload(module="pmciscoios") parser(name="custom.pmciscoios.with_origin" type="pmciscoios") ruleset(name="myRuleset" parser="custom.pmciscoios.with_origin") { ... do something here ... }rmrn}ro(h"Uh#jfubaubhW)rp}rq(h"XnThe following example uses multiple parsers within a ruleset without a parser object (the order is important):rrh#jOh$h%h&h[h(}rs(h*]h+]h,]h-]h/]uh1KFh2hh]rth;XnThe following example uses multiple parsers within a ruleset without a parser object (the order is important):rurv}rw(h"jrh#jpubaubje)rx}ry(h"Xload(module="pmaixforwardedfrom") load(module="pmlastmsg") ruleset(name="myRuleset" parser=["rsyslog.lastline","rsyslog.aixforwardedfrom","rsyslog.rfc5424","rsyslog.rfc3164"]) { ... do something here ... }h#jOh$h%h&jhh(}rz(jjjkh-]h,]h*]h+]h/]uh1KJh2hh]r{h;Xload(module="pmaixforwardedfrom") load(module="pmlastmsg") ruleset(name="myRuleset" parser=["rsyslog.lastline","rsyslog.aixforwardedfrom","rsyslog.rfc5424","rsyslog.rfc3164"]) { ... do something here ... }r|r}}r~(h"Uh#jxubaubhW)r}r(h"X|A more elaborate example can also be found in the :doc:`Cisco IOS message parser module ` documentation.h#jOh$h%h&h[h(}r(h*]h+]h,]h-]h/]uh1KSh2hh]r(h;X2A more elaborate example can also be found in the rr}r(h"X2A more elaborate example can also be found in the h#jubh)r}r(h"X;:doc:`Cisco IOS message parser module `rh#jh$h%h&hh(}r(UreftypeXdocrhhXmodules/pmciscoiosU refdomainUh-]h,]U refexplicith*]h+]h/]hhuh1KSh]rhd)r}r(h"jh(}r(h*]h+]r(hjeh,]h-]h/]uh#jh]rh;XCisco IOS message parser modulerr}r(h"Uh#jubah&hlubaubh;X documentation.rr}r(h"X documentation.h#jubeubhW)r}r(h"XThis documentation is part of the `rsyslog `_ project. Copyright © 2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h#jOh$h%h&h[h(}r(h*]h+]h,]h-]h/]uh1KVh2hh]r(h;X"This documentation is part of the rr}r(h"X"This documentation is part of the h#jubcdocutils.nodes reference r)r}r(h"X$`rsyslog `_h(}r(Unameh UrefurirXhttp://www.rsyslog.com/rh-]h,]h*]h+]h/]uh#jh]rh;Xrsyslogrr}r(h"Uh#jubah&U referencerubhK)r}r(h"X U referencedrKh#jh&hNh(}r(Urefurijh-]rhah,]h*]h+]h/]rh auh]ubh;X project. Copyright © 2014 by rr}r(h"X project. Copyright © 2014 by h#jubj)r}r(h"X3`Rainer Gerhards `_h(}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrh-]h,]h*]h+]h/]uh#jh]rh;XRainer Gerhardsrr}r(h"Uh#jubah&jubhK)r}r(h"X! jKh#jh&hNh(}r(Urefurijh-]rhah,]h*]h+]h/]rhauh]ubh;X and rr}r(h"X and h#jubj)r}r(h"X$`Adiscon `_h(}r(UnameXAdisconjXhttp://www.adiscon.com/rh-]h,]h*]h+]h/]uh#jh]rh;XAdisconrr}r(h"Uh#jubah&jubhK)r}r(h"X jKh#jh&hNh(}r(Urefurijh-]rhah,]h*]h+]h/]rh auh]ubh;X1. Released under the GNU GPL version 2 or higher.rr}r(h"X1. Released under the GNU GPL version 2 or higher.h#jubeubeubeubah"UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh2hU current_linerNUtransform_messagesr]r(cdocutils.nodes system_message r)r}r(h"Uh(}r(h*]UlevelKh-]h,]Usourceh%h+]h/]UlineKUtypeUINFOruh]rhW)r}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#jh]rh;X-Hyperlink target "index-0" is not referenced.rr}r(h"Uh#jubah&h[ubah&Usystem_messagerubj)r}r(h"Uh(}r(h*]UlevelKh-]h,]Usourceh%h+]h/]UlineKUtypejuh]rhW)r}r(h"Uh(}r(h*]h+]h,]h-]h/]uh#jh]rh;X2Hyperlink target "cfgobj-input" is not referenced.rr}r(h"Uh#jubah&h[ubah&jubeUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlr Uhttps://tools.ietf.org/html/r U tracebackr Upep_referencesr NUstrip_commentsr NU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamr NUpep_file_url_templater!Upep-%04dr"Uexit_status_levelr#KUconfigr$NUstrict_visitorr%NUcloak_email_addressesr&Utrim_footnote_reference_spacer'Uenvr(NUdump_pseudo_xmlr)NUexpose_internalsr*NUsectsubtitle_xformr+U source_linkr,NUrfc_referencesr-NUoutput_encodingr.Uutf-8r/U source_urlr0NUinput_encodingr1U utf-8-sigr2U_disable_configr3NU id_prefixr4UU tab_widthr5KUerror_encodingr6UUTF-8r7U_sourcer8h%Ugettext_compactr9U generatorr:NUdump_internalsr;NU smart_quotesr<U pep_base_urlr=U https://www.python.org/dev/peps/r>Usyntax_highlightr?Ulongr@Uinput_encoding_error_handlerrAjUauto_id_prefixrBUidrCUdoctitle_xformrDUstrip_elements_with_classesrENU _config_filesrF]Ufile_insertion_enabledrGU raw_enabledrHKU dump_settingsrINubUsymbol_footnote_startrJKUidsrK}rL(hjOhh hhXhGhXhjhjhhhjuUsubstitution_namesrM}rNh&h2h(}rO(h*]h-]h,]Usourceh%h+]h/]uU footnotesrP]rQUrefidsrR}rS(hG]rThLah]rUhQauub.build/.doctrees/configuration/global/0000775000175000017500000000000013035122641016631 5ustar rgerrgerbuild/.doctrees/configuration/global/options/0000775000175000017500000000000013035122641020324 5ustar rgerrgerbuild/.doctrees/configuration/global/options/rsconf1_umask.doctree0000664000175000017500000001601513035122641024451 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqX rsyslog siteqX$umaskqNXrainer gerhardsq Xrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhU rsyslog-siteqhUumaskqh Urainer-gerhardsqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XQ/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_umask.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hX$UMASKq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7X$UMASKq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hX(**Type:** global configuration directiveq>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qA(cdocutils.nodes strong qB)qC}qD(hX **Type:**h$}qE(h&]h']h(]h)]h+]uhh`_\ ]qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7X[q}q(hX[hhubcdocutils.nodes reference q)q}q(hX)`rsyslog site `_h$}q(UnameX rsyslog siteUrefuriqXhttp://www.rsyslog.com/qh)]h(]h&]h']h+]uhhh]qh7X rsyslog siteqq}q(hUhhubah"U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh"Utargetqh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X]q}q(hX\ ]hhubeubh;)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7X"This documentation is part of the qq}q(hX"This documentation is part of the hhubh)q}q(hX$`rsyslog `_h$}q(Unameh hXhttp://www.rsyslog.com/qh)]h(]h&]h']h+]uhhh]qh7Xrsyslogqq}q(hUhhubah"hubh)q}q(hX hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X project.qȅq}q(hX project.hhubeubh;)q}q(hXCopyright © 2007-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7XCopyright © 2007-2014 by qυq}q(hXCopyright © 2007-2014 by hhubh)q}q(hX3`Rainer Gerhards `_h$}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh)]h(]h&]h']h+]uhhh]qh7XRainer Gerhardsqׅq}q(hUhhubah"hubh)q}q(hX! hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X and q߅q}q(hX and hhubh)q}q(hX$`Adiscon `_h$}q(UnameXAdisconhXhttp://www.adiscon.com/qh)]h(]h&]h']h+]uhhh]qh7XAdisconq煁q}q(hUhhubah"hubh)q}q(hX hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh.hU current_lineqNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]r Usettingsr (cdocutils.frontend Values r or }r (Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugr NUembed_stylesheetr!Uoutput_encoding_error_handlerr"Ustrictr#U sectnum_xformr$KUdump_transformsr%NU docinfo_xformr&KUwarning_streamr'NUpep_file_url_templater(Upep-%04dr)Uexit_status_levelr*KUconfigr+NUstrict_visitorr,NUcloak_email_addressesr-Utrim_footnote_reference_spacer.Uenvr/NUdump_pseudo_xmlr0NUexpose_internalsr1NUsectsubtitle_xformr2U source_linkr3NUrfc_referencesr4NUoutput_encodingr5Uutf-8r6U source_urlr7NUinput_encodingr8U utf-8-sigr9U_disable_configr:NU id_prefixr;UU tab_widthr<KUerror_encodingr=UUTF-8r>U_sourcer?h!Ugettext_compactr@U generatorrANUdump_internalsrBNU smart_quotesrCU pep_base_urlrDU https://www.python.org/dev/peps/rEUsyntax_highlightrFUlongrGUinput_encoding_error_handlerrHj#Uauto_id_prefixrIUidrJUdoctitle_xformrKUstrip_elements_with_classesrLNU _config_filesrM]Ufile_insertion_enabledrNU raw_enabledrOKU dump_settingsrPNubUsymbol_footnote_startrQKUidsrR}rS(hhhhhhhhhhuUsubstitution_namesrT}rUh"h.h$}rV(h&]h)]h(]Usourceh!h']h+]uU footnotesrW]rXUrefidsrY}rZub.build/.doctrees/configuration/global/options/rsconf1_includeconfig.doctree0000664000175000017500000003710413035122641026144 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X0michael biebl had the idea to this functionalityqXrainer gerhardsqX$includeconfigqNXadisconq Xrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU0michael-biebl-had-the-idea-to-this-functionalityqhUrainer-gerhardsqhU includeconfigqh Uadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XY/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_includeconfig.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hX$IncludeConfigq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7X$IncludeConfigq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hX(**Type:** global configuration directiveq>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qA(cdocutils.nodes strong qB)qC}qD(hX **Type:**h$}qE(h&]h']h(]h)]h+]uhh`_. Let me quote him:hhh h!h"h?h$}qx(h&]h']h(]h)]h+]uh-Kh.hh]qy(h7XIf all regular files in the /etc/rsyslog.d directory are included, then files starting with "." are ignored - so you can use them to place comments into the dir (e.g. "/etc/rsyslog.d/.mycomment" will be ignored). qzq{}q|(hXIf all regular files in the /etc/rsyslog.d directory are included, then files starting with "." are ignored - so you can use them to place comments into the dir (e.g. "/etc/rsyslog.d/.mycomment" will be ignored). hhvubcdocutils.nodes reference q})q~}q(hX`Michael Biebl had the idea to this functionality `_h$}q(UnameX0Michael Biebl had the idea to this functionalityUrefuriqX\http://sourceforge.net/tracker/index.php?func=detail&aid=1764088&group_id=123448&atid=696555qh)]h(]h&]h']h+]uhhvh]qh7X0Michael Biebl had the idea to this functionalityqq}q(hUhh~ubah"U referencequbcdocutils.nodes target q)q}q(hX_ U referencedqKhhvh"Utargetqh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X. Let me quote him:qq}q(hX. Let me quote him:hhvubeubcdocutils.nodes block_quote q)q}q(hUhhh Nh"U block_quoteqh$}q(h&]h']h(]h)]h+]uh-Nh.hh]qcdocutils.nodes definition_list q)q}q(hUh$}q(h&]h']h(]h)]h+]uhhh]q(cdocutils.nodes definition_list_item q)q}q(hXSay you can add an option $IncludeConfig /etc/rsyslog.d/ (which probably would make a good default) to /etc/rsyslog.conf, which would then merge and include allhhh h!h"Udefinition_list_itemqh$}q(h&]h']h(]h)]h+]uh-K%h]q(cdocutils.nodes term q)q}q(hXSay you can add an optionqhhh h!h"Utermqh$}q(h&]h']h(]h)]h+]uh-K%h]qh7XSay you can add an optionqq}q(hhhhubaubcdocutils.nodes definition q)q}q(hUh$}q(h&]h']h(]h)]h+]uhhh]qh;)q}q(hX$IncludeConfig /etc/rsyslog.d/ (which probably would make a good default) to /etc/rsyslog.conf, which would then merge and include allqhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K$h]qh7X$IncludeConfig /etc/rsyslog.d/ (which probably would make a good default) to /etc/rsyslog.conf, which would then merge and include allqq}q(hhhhubaubah"U definitionqubeubh)q}q(hXc\*.conf files in /etc/rsyslog.d/. This way, a distribution can modify its packages easily to drop ahhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K(h]q(h)q}q(hX \*.conf filesqhhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K(h]qh7X *.conf filesqŅq}q(hX \*.conf fileshhubaubh)q}q(hUh$}q(h&]h']h(]h)]h+]uhhh]qh;)q}q(hXUin /etc/rsyslog.d/. This way, a distribution can modify its packages easily to drop aqhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K(h]qh7XUin /etc/rsyslog.d/. This way, a distribution can modify its packages easily to drop aqхq}q(hhhhubaubah"hubeubh)q}q(hX{simple config file into this directory upon installation. As an example, the network-manager package could install a simplehhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K+h]q(h)q}q(hXsimpleqhhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K+h]qh7Xsimpleq݅q}q(hhhhubaubh)q}q(hUh$}q(h&]h']h(]h)]h+]uhhh]qh;)q}q(hXtconfig file into this directory upon installation. As an example, the network-manager package could install a simpleqhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K+h]qh7Xtconfig file into this directory upon installation. As an example, the network-manager package could install a simpleq酁q}q(hhhhubaubah"hubeubh)q}q(hXmconfig file /etc/rsyslog.d/network-manager.conf which would contain. :programname, contains, "NetworkManager"hhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K.h]q(h)q}q(hXconfigqhhh h!h"hh$}q(h&]h']h(]h)]h+]uh-K.h]qh7Xconfigqq}q(hhhhubaubh)q}q(hUh$}q(h&]h']h(]h)]h+]uhhh]qh;)q}q(hXffile /etc/rsyslog.d/network-manager.conf which would contain. :programname, contains, "NetworkManager"qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-K.h]rh7Xffile /etc/rsyslog.d/network-manager.conf which would contain. :programname, contains, "NetworkManager"rr}r(hhhhubaubah"hubeubh)r}r(hX^-/var/log/NetworkManager.log Upon uninstallation, the file could be easily removed again. Thishhh h!h"hh$}r(h&]h']h(]h)]h+]uh-K0h]r(h)r}r (hX-/var/log/NetworkManager.logr hjh h!h"hh$}r (h&]h']h(]h)]h+]uh-K0h]r h7X-/var/log/NetworkManager.logr r}r(hj hjubaubh)r}r(hUh$}r(h&]h']h(]h)]h+]uhjh]rh;)r}r(hXAUpon uninstallation, the file could be easily removed again. Thisrhjh h!h"h?h$}r(h&]h']h(]h)]h+]uh-K1h]rh7XAUpon uninstallation, the file could be easily removed again. Thisrr}r(hjhjubaubah"hubeubh)r}r(hXIapproach would be much cleaner and less error prone, than having to mungehhh h!h"hh$}r(h&]h']h(]h)]h+]uh-K2h]r(h)r }r!(hXapproachr"hjh h!h"hh$}r#(h&]h']h(]h)]h+]uh-K2h]r$h7Xapproachr%r&}r'(hj"hj ubaubh)r(}r)(hUh$}r*(h&]h']h(]h)]h+]uhjh]r+h;)r,}r-(hX@would be much cleaner and less error prone, than having to munger.hj(h h!h"h?h$}r/(h&]h']h(]h)]h+]uh-K3h]r0h7X@would be much cleaner and less error prone, than having to munger1r2}r3(hj.hj,ubaubah"hubeubh)r4}r5(hX1around with the /etc/rsyslog.conf file directly. hhh h!h"hh$}r6(h&]h']h(]h)]h+]uh-K5h]r7(h)r8}r9(hXaroundr:hj4h h!h"hh$}r;(h&]h']h(]h)]h+]uh-K5h]r<h7Xaroundr=r>}r?(hj:hj8ubaubh)r@}rA(hUh$}rB(h&]h']h(]h)]h+]uhj4h]rCh;)rD}rE(hX)with the /etc/rsyslog.conf file directly.rFhj@h h!h"h?h$}rG(h&]h']h(]h)]h+]uh-K5h]rHh7X)with the /etc/rsyslog.conf file directly.rIrJ}rK(hjFhjDubaubah"hubeubeh"Udefinition_listrLubaubh;)rM}rN(hX **Sample:**rOhhh h!h"h?h$}rP(h&]h']h(]h)]h+]uh-K7h.hh]rQhB)rR}rS(hjOh$}rT(h&]h']h(]h)]h+]uhjMh]rUh7XSample:rVrW}rX(hUhjRubah"hJubaubh;)rY}rZ(hX/``$IncludeConfig /etc/some-included-file.conf``r[hhh h!h"h?h$}r\(h&]h']h(]h)]h+]uh-K9h.hh]r]cdocutils.nodes literal r^)r_}r`(hj[h$}ra(h&]h']h(]h)]h+]uhjYh]rbh7X+$IncludeConfig /etc/some-included-file.confrcrd}re(hUhj_ubah"Uliteralrfubaubh;)rg}rh(hXIDirectories can also be included. To do so, the name must end on a slash:rihhh h!h"h?h$}rj(h&]h']h(]h)]h+]uh-K;h.hh]rkh7XIDirectories can also be included. To do so, the name must end on a slash:rlrm}rn(hjihjgubaubh;)ro}rp(hX"``$IncludeConfig /etc/rsyslog.d/``rqhhh h!h"h?h$}rr(h&]h']h(]h)]h+]uh-K>h.hh]rsj^)rt}ru(hjqh$}rv(h&]h']h(]h)]h+]uhjoh]rwh7X$IncludeConfig /etc/rsyslog.d/rxry}rz(hUhjtubah"jfubaubh;)r{}r|(hXY**And finally, only specific files matching a wildcard my be included from a directory:**r}hhh h!h"h?h$}r~(h&]h']h(]h)]h+]uh-K@h.hh]rhB)r}r(hj}h$}r(h&]h']h(]h)]h+]uhj{h]rh7XUAnd finally, only specific files matching a wildcard my be included from a directory:rr}r(hUhjubah"hJubaubh;)r}r(hX(``$IncludeConfig /etc/rsyslog.d/*.conf``rhhh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KCh.hh]rj^)r}r(hjh$}r(h&]h']h(]h)]h+]uhjh]rh7X$$IncludeConfig /etc/rsyslog.d/*.confrr}r(hUhjubah"jfubaubh;)r}r(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhh h!h"h?h$}r(h&]h']h(]h)]h+]uh-KEh.hh]r(h7X"This documentation is part of the rr}r(hX"This documentation is part of the hjubh})r}r(hX$`rsyslog `_h$}r(Unameh hXhttp://www.rsyslog.com/rh)]h(]h&]h']h+]uhjh]rh7Xrsyslogrr}r(hUhjubah"hubh)r}r(hX hKhjh"hh$}r(Urefurijh)]rhah(]h&]h']h+]rh auh]ubh7X project. Copyright © 2007 by rr}r(hX project. Copyright © 2007 by hjubh})r}r(hX3`Rainer Gerhards `_h$}r(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerrh)]h(]h&]h']h+]uhjh]rh7XRainer Gerhardsrr}r(hUhjubah"hubh)r}r(hX! hKhjh"hh$}r(Urefurijh)]rhah(]h&]h']h+]rhauh]ubh7X and rr}r(hX and hjubh})r}r(hX$`Adiscon `_h$}r(UnameXAdisconhXhttp://www.adiscon.com/rh)]h(]h&]h']h+]uhjh]rh7XAdisconrr}r(hUhjubah"hubh)r}r(hX hKhjh"hh$}r(Urefurijh)]rhah(]h&]h']h+]rh auh]ubh7X1. Released under the GNU GPL version 2 or higher.rr}r(hX1. Released under the GNU GPL version 2 or higher.hjubeubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh.hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesr NUoutput_encodingr Uutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh!Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerr jUauto_id_prefixr!Uidr"Udoctitle_xformr#Ustrip_elements_with_classesr$NU _config_filesr%]Ufile_insertion_enabledr&U raw_enabledr'KU dump_settingsr(NubUsymbol_footnote_startr)KUidsr*}r+(hjhhhhhjhjuUsubstitution_namesr,}r-h"h.h$}r.(h&]h)]h(]Usourceh!h']h+]uU footnotesr/]r0Urefidsr1}r2ub.build/.doctrees/configuration/global/options/rsconf1_resetconfigvariables.doctree0000664000175000017500000001405513035122641027534 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXadisconqXrsyslogqX$resetconfigvariablesq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUadisconqhUrsyslogqh UresetconfigvariablesquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX`/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_resetconfigvariables.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*h auUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$ResetConfigVariablesq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$ResetConfigVariablesq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX **Default:**qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qPh@)qQ}qR(hhNh"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubaubh9)qX}qY(hX**Description:**qZhhhhh h=h"}q[(h$]h%]h&]h']h)]uh+Kh,hh]q\h@)q]}q^(hhZh"}q_(h$]h%]h&]h']h)]uhhXh]q`h5X Description:qaqb}qc(hUhh]ubah hHubaubh9)qd}qe(hXResets all configuration variables to their default value. Any settings made will not be applied to configuration lines following the $ResetConfigVariables. This is a good method to make sure no side-effects exists from previous directives. This directive has no parameters.qfhhhhh h=h"}qg(h$]h%]h&]h']h)]uh+K h,hh]qhh5XResets all configuration variables to their default value. Any settings made will not be applied to configuration lines following the $ResetConfigVariables. This is a good method to make sure no side-effects exists from previous directives. This directive has no parameters.qiqj}qk(hhfhhdubaubh9)ql}qm(hX **Sample:**qnhhhhh h=h"}qo(h$]h%]h&]h']h)]uh+Kh,hh]qph@)qq}qr(hhnh"}qs(h$]h%]h&]h']h)]uhhlh]qth5XSample:quqv}qw(hUhhqubah hHubaubh9)qx}qy(hX``$ResetConfigVariables``qzhhhhh h=h"}q{(h$]h%]h&]h']h)]uh+Kh,hh]q|cdocutils.nodes literal q})q~}q(hhzh"}q(h$]h%]h&]h']h)]uhhxh]qh5X$ResetConfigVariablesqq}q(hUhh~ubah Uliteralqubaubh9)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(UnamehUrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X project.qq}q(hX project.hhubeubh9)q}q(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5XCopyright © 2007 by qq}q(hXCopyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qDžq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesr NUoutput_encodingr Uutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerr hUauto_id_prefixr!Uidr"Udoctitle_xformr#Ustrip_elements_with_classesr$NU _config_filesr%]Ufile_insertion_enabledr&U raw_enabledr'KU dump_settingsr(NubUsymbol_footnote_startr)KUidsr*}r+(hhhhhhhhuUsubstitution_namesr,}r-h h,h"}r.(h$]h']h&]Usourcehh%]h)]uU footnotesr/]r0Urefidsr1}r2ub.build/.doctrees/configuration/global/options/rsconf1_debugprintmodulelist.doctree0000664000175000017500000001322713035122641027600 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqX$debugprintmodulelistqNXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUdebugprintmodulelistqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX`/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_debugprintmodulelist.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$DebugPrintModuleListq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$DebugPrintModuleListq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** onqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X onqXqY}qZ(hX onhhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXSpecifies whether or not the module list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled.qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XSpecifies whether or not the module list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled.qlqm}qn(hhihhgubaubh9)qo}qp(hX **Sample:**qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh@)qt}qu(hhqh"}qv(h$]h%]h&]h']h)]uhhoh]qwh5XSample:qxqy}qz(hUhhtubah hHubaubcdocutils.nodes transition q{)q|}q}(hX````q~hhhhh U transitionqh"}q(h$]h%]h&]h']h)]uh+Kh,hh]ubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqވUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingr UUTF-8r U_sourcer hUgettext_compactr U generatorr NUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhhhuUsubstitution_namesr }r!h h,h"}r"(h$]h']h&]Usourcehh%]h)]uU footnotesr#]r$Urefidsr%}r&ub.build/.doctrees/configuration/global/options/rsconf1_debugprinttemplatelist.doctree0000664000175000017500000001324713035122641030130 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqX$debugprinttemplatelistqNXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUdebugprinttemplatelistqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXb/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_debugprinttemplatelist.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$DebugPrintTemplateListq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$DebugPrintTemplateListq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** onqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X onqXqY}qZ(hX onhhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXSpecifies whether or not the template list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled..qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XSpecifies whether or not the template list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled..qlqm}qn(hhihhgubaubh9)qo}qp(hX **Sample:**qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh@)qt}qu(hhqh"}qv(h$]h%]h&]h']h)]uhhoh]qwh5XSample:qxqy}qz(hUhhtubah hHubaubcdocutils.nodes transition q{)q|}q}(hX````q~hhhhh U transitionqh"}q(h$]h%]h&]h']h)]uh+Kh,hh]ubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqވUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingr UUTF-8r U_sourcer hUgettext_compactr U generatorr NUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhhhuUsubstitution_namesr }r!h h,h"}r"(h$]h']h&]Usourcehh%]h)]uU footnotesr#]r$Urefidsr%}r&ub.build/.doctrees/configuration/global/options/rsconf1_mainmsgqueuesize.doctree0000664000175000017500000002027313035122641026725 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$mainmsgqueuesizeqNXrainer gerhardsqXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUmainmsgqueuesizeqhUrainer-gerhardsqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX\/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_mainmsgqueuesize.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$MainMsgQueueSizeq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$MainMsgQueueSizeq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** 10000qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X 10000qXqY}qZ(hX 10000hhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXBThis allows to specify the maximum size of the message queue. This directive is only available when rsyslogd has been compiled with multithreading support. In this mode, receiver and output modules are de-coupled via an in-memory queue. This queue buffers messages when the output modules are not capable to process them as fast as they are received. Once the queue size is exhausted, messages will be dropped. The slower the output (e.g. MySQL), the larger the queue should be. Buffer space for the actual queue entries is allocated on an as-needed basis. Please keep in mind that a very large queue may exhaust available system memory and swap space. Keep this in mind when configuring the max size. The actual size of a message depends largely on its content and the originator. As a rule of thumb, typically messages should not take up more then roughly 1k (this is the memory structure, not what you see in a network dump!). For typical linux messages, 512 bytes should be a good bet. Please also note that there is a minimal amount of memory taken for each queue entry, no matter if it is used or not. This is one pointer value, so on 32bit systems, it should typically be 4 bytes and on 64bit systems it should typically be 8 bytes. For example, the default queue size of 10,000 entries needs roughly 40k fixed overhead on a 32 bit system.qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XBThis allows to specify the maximum size of the message queue. This directive is only available when rsyslogd has been compiled with multithreading support. In this mode, receiver and output modules are de-coupled via an in-memory queue. This queue buffers messages when the output modules are not capable to process them as fast as they are received. Once the queue size is exhausted, messages will be dropped. The slower the output (e.g. MySQL), the larger the queue should be. Buffer space for the actual queue entries is allocated on an as-needed basis. Please keep in mind that a very large queue may exhaust available system memory and swap space. Keep this in mind when configuring the max size. The actual size of a message depends largely on its content and the originator. As a rule of thumb, typically messages should not take up more then roughly 1k (this is the memory structure, not what you see in a network dump!). For typical linux messages, 512 bytes should be a good bet. Please also note that there is a minimal amount of memory taken for each queue entry, no matter if it is used or not. This is one pointer value, so on 32bit systems, it should typically be 4 bytes and on 64bit systems it should typically be 8 bytes. For example, the default queue size of 10,000 entries needs roughly 40k fixed overhead on a 32 bit system.qlqm}qn(hhihhgubaubh9)qo}qp(hX **Sample:**qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh@)qt}qu(hhqh"}qv(h$]h%]h&]h']h)]uhhoh]qwh5XSample:qxqy}qz(hUhhtubah hHubaubh9)q{}q|(hXM``$MainMsgQueueSize 100000 # 100,000 may be a value to handle burst traffic``q}hhhhh h=h"}q~(h$]h%]h&]h']h)]uh+K!h,hh]qcdocutils.nodes literal q)q}q(hh}h"}q(h$]h%]h&]h']h)]uhh{h]qh5XI$MainMsgQueueSize 100000 # 100,000 may be a value to handle burst trafficqq}q(hUhhubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K#h,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qÅq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingr Uutf-8r U source_urlr NUinput_encodingr U utf-8-sigr U_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesr NU _config_filesr!]r"Ufile_insertion_enabledr#U raw_enabledr$KU dump_settingsr%NubUsymbol_footnote_startr&KUidsr'}r((hhhhhhhhuUsubstitution_namesr)}r*h h,h"}r+(h$]h']h&]Usourcehh%]h)]uU footnotesr,]r-Urefidsr.}r/ub.build/.doctrees/configuration/global/options/rsconf1_modload.doctree0000664000175000017500000001701513035122641024751 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqX$moddirqX$modloadqNXrainer gerhardsq Xrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUmoddirqhUmodloadqh Urainer-gerhardsqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XS/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_modload.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hX$ModLoadq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7X$ModLoadq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hX(**Type:** global configuration directiveq>hhh h!h"U paragraphq?h$}q@(h&]h']h(]h)]h+]uh-Kh.hh]qA(cdocutils.nodes strong qB)qC}qD(hX **Type:**h$}qE(h&]h']h(]h)]h+]uhh`_ directive.hhh h!h"h?h$}qp(h&]h']h(]h)]h+]uh-Kh.hh]qq(h7XvModules must be present in the system default destination for rsyslog modules. You can also set the directory via the qrqs}qt(hXvModules must be present in the system default destination for rsyslog modules. You can also set the directory via the hhnubcdocutils.nodes reference qu)qv}qw(hX `$ModDir `_h$}qx(UnameX$ModDirUrefuriqyXrsconf1_moddir.htmlqzh)]h(]h&]h']h+]uhhnh]q{h7X$ModDirq|q}}q~(hUhhvubah"U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhnh"Utargetqh$}q(Urefurihzh)]qhah(]h&]h']h+]qhauh]ubh7X directive.qq}q(hX directive.hhnubeubh;)q}q(hX|If a full path name is specified, the module is loaded from that path. The default module directory is ignored in that case.qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qh7X|If a full path name is specified, the module is loaded from that path. The default module directory is ignored in that case.qq}q(hhhhubaubh;)q}q(hX **Sample:**qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qhB)q}q(hhh$}q(h&]h']h(]h)]h+]uhhh]qh7XSample:qq}q(hUhhubah"hJubaubh;)q}q(hX``$ModLoad ommysql # load MySQL functionality $ModLoad /rsyslog/modules/ompgsql.so # load the postgres module via absolute path``qhhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]qcdocutils.nodes literal q)q}q(hhh$}q(h&]h']h(]h)]h+]uhhh]qh7X}$ModLoad ommysql # load MySQL functionality $ModLoad /rsyslog/modules/ompgsql.so # load the postgres module via absolute pathqq}q(hUhhubah"Uliteralqubaubh;)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7X"This documentation is part of the qq}q(hX"This documentation is part of the hhubhu)q}q(hX$`rsyslog `_h$}q(Unameh hyXhttp://www.rsyslog.com/qh)]h(]h&]h']h+]uhhh]qh7Xrsyslogqq}q(hUhhubah"hubh)q}q(hX hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X project.qq}q(hX project.hhubeubh;)q}q(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhh h!h"h?h$}q(h&]h']h(]h)]h+]uh-Kh.hh]q(h7XCopyright © 2007 by qȅq}q(hXCopyright © 2007 by hhubhu)q}q(hX3`Rainer Gerhards `_h$}q(UnameXRainer GerhardshyXhttp://www.gerhards.net/rainerqh)]h(]h&]h']h+]uhhh]qh7XRainer GerhardsqЅq}q(hUhhubah"hubh)q}q(hX! hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X and q؅q}q(hX and hhubhu)q}q(hX$`Adiscon `_h$}q(UnameXAdisconhyXhttp://www.adiscon.com/qh)]h(]h&]h']h+]uhhh]qh7XAdisconqq}q(hUhhubah"hubh)q}q(hX hKhhh"hh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X1. Released under the GNU GPL version 2 or higher.q腁q}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh.hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlr Uhttps://tools.ietf.org/html/r U tracebackr Upep_referencesr NUstrip_commentsr NU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh4NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamr NUpep_file_url_templater!Upep-%04dr"Uexit_status_levelr#KUconfigr$NUstrict_visitorr%NUcloak_email_addressesr&Utrim_footnote_reference_spacer'Uenvr(NUdump_pseudo_xmlr)NUexpose_internalsr*NUsectsubtitle_xformr+U source_linkr,NUrfc_referencesr-NUoutput_encodingr.Uutf-8r/U source_urlr0NUinput_encodingr1U utf-8-sigr2U_disable_configr3NU id_prefixr4UU tab_widthr5KUerror_encodingr6UUTF-8r7U_sourcer8h!Ugettext_compactr9U generatorr:NUdump_internalsr;NU smart_quotesr<U pep_base_urlr=U https://www.python.org/dev/peps/r>Usyntax_highlightr?Ulongr@Uinput_encoding_error_handlerrAjUauto_id_prefixrBUidrCUdoctitle_xformrDUstrip_elements_with_classesrENU _config_filesrF]Ufile_insertion_enabledrGU raw_enabledrHKU dump_settingsrINubUsymbol_footnote_startrJKUidsrK}rL(hhhhhhhhhhuUsubstitution_namesrM}rNh"h.h$}rO(h&]h)]h(]Usourceh!h']h+]uU footnotesrP]rQUrefidsrR}rSub.build/.doctrees/configuration/global/options/rsconf1_maxopenfiles.doctree0000664000175000017500000002045613035122641026027 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqX $maxopenfilesqNXrainer gerhardsqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhU maxopenfilesqhUrainer-gerhardsqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXX/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_maxopenfiles.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX $MaxOpenFilesq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X $MaxOpenFilesq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX**Available Since:** 4.3.0q(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX**Available Since:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XAvailable Since:qEqF}qG(hUhhAubah UstrongqHubh5X 4.3.0qIqJ}qK(hX 4.3.0hh:ubeubh9)qL}qM(hX(**Type:** global configuration directiveqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Type:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XType:qUqV}qW(hUhhQubah hHubh5X global configuration directiveqXqY}qZ(hX global configuration directivehhLubeubh9)q[}q\(hX'**Default:** *operating system default*q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_(h@)q`}qa(hX **Default:**h"}qb(h$]h%]h&]h']h)]uhh[h]qch5XDefault:qdqe}qf(hUhh`ubah hHubh5X qg}qh(hX hh[ubcdocutils.nodes emphasis qi)qj}qk(hX*operating system default*h"}ql(h$]h%]h&]h']h)]uhh[h]qmh5Xoperating system defaultqnqo}qp(hUhhjubah Uemphasisqqubeubh9)qr}qs(hX**Description:**qthhhhh h=h"}qu(h$]h%]h&]h']h)]uh+K h,hh]qvh@)qw}qx(hhth"}qy(h$]h%]h&]h']h)]uhhrh]qzh5X Description:q{q|}q}(hUhhwubah hHubaubh9)q~}q(hXSet the maximum number of files that the rsyslog process can have open at any given time. Note that this includes open tcp sockets, so this setting is the upper limit for the number of open TCP connections as well. If you expect a large nubmer of concurrent connections, it is suggested that the number is set to the max number connected plus 1000. Please note that each dynafile also requires up to 100 open file handles.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K h,hh]qh5XSet the maximum number of files that the rsyslog process can have open at any given time. Note that this includes open tcp sockets, so this setting is the upper limit for the number of open TCP connections as well. If you expect a large nubmer of concurrent connections, it is suggested that the number is set to the max number connected plus 1000. Please note that each dynafile also requires up to 100 open file handles.qq}q(hhhh~ubaubh9)q}q(hX>The setting is similar to running "ulimit -n number-of-files".qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5X>The setting is similar to running "ulimit -n number-of-files".qq}q(hhhhubaubh9)q}q(hXPlease note that depending on permissions and operating system configuration, the setrlimit() request issued by rsyslog may fail, in which case the previous limit is kept in effect. Rsyslog will emit a warning message in this case.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5XPlease note that depending on permissions and operating system configuration, the setrlimit() request issued by rsyslog may fail, in which case the previous limit is kept in effect. Rsyslog will emit a warning message in this case.qq}q(hhhhubaubh9)q}q(hX **Sample:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XSample:qq}q(hUhhubah hHubaubh9)q}q(hX``$MaxOpenFiles 2000``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X$MaxOpenFiles 2000qq}q(hUhhubah Uliteralqubaubh9)q}q(hX **Bugs:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XBugs:qq}q(hUhhubah hHubaubh9)q}q(hXFor some reason, this settings seems not to work on all platforms. If you experience problems, please let us know so that we can (hopefully) narrow down the issue.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K!h,hh]qh5XFor some reason, this settings seems not to work on all platforms. If you experience problems, please let us know so that we can (hopefully) narrow down the issue.qq}q(hhhhubaubh9)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K%h,hh]q(h5X"This documentation is part of the qȅq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogq҅q}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project.qޅq}q(hX project.hhubeubh9)q}q(hXCopyright © 2009 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K(h,hh]q(h5XCopyright © 2009 by q允q}q(hXCopyright © 2009 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsq텁q}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)r}r(hX hKhhh hh"}r(Urefurihh']rhah&]h$]h%]h)]rhauh]ubh5X1. Released under the GNU GPL version 3 or higher.rr}r(hX1. Released under the GNU GPL version 3 or higher.hhubeubeubahUU transformerrNU footnote_refsr }r Urefnamesr }r Usymbol_footnotesr ]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh,hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr (cdocutils.frontend Values r!or"}r#(Ufootnote_backlinksr$KUrecord_dependenciesr%NU rfc_base_urlr&Uhttps://tools.ietf.org/html/r'U tracebackr(Upep_referencesr)NUstrip_commentsr*NU toc_backlinksr+Uentryr,U language_coder-Uenr.U datestampr/NU report_levelr0KU _destinationr1NU halt_levelr2KU strip_classesr3Nh2NUerror_encoding_error_handlerr4Ubackslashreplacer5Udebugr6NUembed_stylesheetr7Uoutput_encoding_error_handlerr8Ustrictr9U sectnum_xformr:KUdump_transformsr;NU docinfo_xformr<KUwarning_streamr=NUpep_file_url_templater>Upep-%04dr?Uexit_status_levelr@KUconfigrANUstrict_visitorrBNUcloak_email_addressesrCUtrim_footnote_reference_spacerDUenvrENUdump_pseudo_xmlrFNUexpose_internalsrGNUsectsubtitle_xformrHU source_linkrINUrfc_referencesrJNUoutput_encodingrKUutf-8rLU source_urlrMNUinput_encodingrNU utf-8-sigrOU_disable_configrPNU id_prefixrQUU tab_widthrRKUerror_encodingrSUUTF-8rTU_sourcerUhUgettext_compactrVU generatorrWNUdump_internalsrXNU smart_quotesrYU pep_base_urlrZU https://www.python.org/dev/peps/r[Usyntax_highlightr\Ulongr]Uinput_encoding_error_handlerr^j9Uauto_id_prefixr_Uidr`Udoctitle_xformraUstrip_elements_with_classesrbNU _config_filesrc]rdUfile_insertion_enabledreU raw_enabledrfKU dump_settingsrgNubUsymbol_footnote_startrhKUidsri}rj(hhhjhhhhuUsubstitution_namesrk}rlh h,h"}rm(h$]h']h&]Usourcehh%]h)]uU footnotesrn]roUrefidsrp}rqub.build/.doctrees/configuration/global/options/rsconf1_abortonuncleanconfig.doctree0000664000175000017500000002254313035122641027534 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXadisconqXrsyslogqX rsyslog siteq X$abortonuncleanconfigq NX$rsyslog.conf configuration directiveq uUsubstitution_defsq }q Uparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUadisconqhUrsyslogqh U rsyslog-siteqh Uabortonuncleanconfigqh U$rsyslog-conf-configuration-directivequUchildrenq]q(cdocutils.nodes paragraph q)q}q(U rawsourceq XB`rsyslog.conf configuration directive `_q!Uparentq"hUsourceq#X`/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_abortonuncleanconfig.rstq$Utagnameq%U paragraphq&U attributesq'}q((Udupnamesq)]Uclassesq*]Ubackrefsq+]Uidsq,]Unamesq-]uUlineq.KUdocumentq/hh]q0(cdocutils.nodes reference q1)q2}q3(h h!h'}q4(UnameX$rsyslog.conf configuration directiveUrefuriq5Xrsyslog_conf_global.htmlq6h,]h+]h)]h*]h-]uh"hh]q7cdocutils.nodes Text q8X$rsyslog.conf configuration directiveq9q:}q;(h Uh"h2ubah%U referenceq}q?(h X U referencedq@Kh"hh%UtargetqAh'}qB(Urefurih6h,]qChah+]h)]h*]h-]qDh auh]ubeubcdocutils.nodes section qE)qF}qG(h Uh"hh#h$h%UsectionqHh'}qI(h)]h*]h+]h,]qJhah-]qKh auh.Kh/hh]qL(cdocutils.nodes title qM)qN}qO(h X$AbortOnUncleanConfigqPh"hFh#h$h%UtitleqQh'}qR(h)]h*]h+]h,]h-]uh.Kh/hh]qSh8X$AbortOnUncleanConfigqTqU}qV(h hPh"hNubaubh)qW}qX(h X(**Type:** global configuration directiveqYh"hFh#h$h%h&h'}qZ(h)]h*]h+]h,]h-]uh.Kh/hh]q[(cdocutils.nodes strong q\)q]}q^(h X **Type:**h'}q_(h)]h*]h+]h,]h-]uh"hWh]q`h8XType:qaqb}qc(h Uh"h]ubah%Ustrongqdubh8X global configuration directiveqeqf}qg(h X global configuration directiveh"hWubeubh)qh}qi(h X.**Parameter Values:** boolean (on/off, yes/no)qjh"hFh#h$h%h&h'}qk(h)]h*]h+]h,]h-]uh.Kh/hh]ql(h\)qm}qn(h X**Parameter Values:**h'}qo(h)]h*]h+]h,]h-]uh"hhh]qph8XParameter Values:qqqr}qs(h Uh"hmubah%hdubh8X boolean (on/off, yes/no)qtqu}qv(h X boolean (on/off, yes/no)h"hhubeubh)qw}qx(h X**Available since:** 5.3.1+qyh"hFh#h$h%h&h'}qz(h)]h*]h+]h,]h-]uh.K h/hh]q{(h\)q|}q}(h X**Available since:**h'}q~(h)]h*]h+]h,]h-]uh"hwh]qh8XAvailable since:qq}q(h Uh"h|ubah%hdubh8X 5.3.1+qq}q(h X 5.3.1+h"hwubeubh)q}q(h X**Default:** offqh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K h/hh]q(h\)q}q(h X **Default:**h'}q(h)]h*]h+]h,]h-]uh"hh]qh8XDefault:qq}q(h Uh"hubah%hdubh8X offqq}q(h X offh"hubeubh)q}q(h X**Description:**qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh\)q}q(h hh'}q(h)]h*]h+]h,]h-]uh"hh]qh8X Description:qq}q(h Uh"hubah%hdubaubh)q}q(h X2This directive permits to prevent rsyslog from running when the configuration file is not clean. "Not Clean" means there are errors or some other annoyances that rsyslgod reports on startup. This is a user-requested feature to have a strict startup mode. Note that with the current code base it is not always possible to differentiate between an real error and a warning-like condition. As such, the startup will also prevented if warnings are present. I consider this a good thing in being "strict", but I admit there also currently is no other way of doing it.qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh8X2This directive permits to prevent rsyslog from running when the configuration file is not clean. "Not Clean" means there are errors or some other annoyances that rsyslgod reports on startup. This is a user-requested feature to have a strict startup mode. Note that with the current code base it is not always possible to differentiate between an real error and a warning-like condition. As such, the startup will also prevented if warnings are present. I consider this a good thing in being "strict", but I admit there also currently is no other way of doing it.qq}q(h hh"hubaubh)q}q(h X **Caveats:**qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh\)q}q(h hh'}q(h)]h*]h+]h,]h-]uh"hh]qh8XCaveats:qq}q(h Uh"hubah%hdubaubh)q}q(h XNote that the consequences of a failed rsyslogd startup can be much more serious than a startup with only partial configuration. For example, log data may be lost or systems that depend on the log server in question will not be able to send logs, what in the ultimate result could result in a system hang on those systems. Also, the local system may hang when the local log socket has become full and is not read. There exist many such scenarios. As such, it is strongly recommended not to turn on this directive.qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.Kh/hh]qh8XNote that the consequences of a failed rsyslogd startup can be much more serious than a startup with only partial configuration. For example, log data may be lost or systems that depend on the log server in question will not be able to send logs, what in the ultimate result could result in a system hang on those systems. Also, the local system may hang when the local log socket has become full and is not read. There exist many such scenarios. As such, it is strongly recommended not to turn on this directive.qq}q(h hh"hubaubh)q}q(h X-[`rsyslog site `_\ ]qh"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K$h/hh]q(h8X[q}q(h X[h"hubh1)q}q(h X)`rsyslog site `_h'}q(UnameX rsyslog siteh5Xhttp://www.rsyslog.com/qh,]h+]h)]h*]h-]uh"hh]qh8X rsyslog siteqɅq}q(h Uh"hubah%hh@Kh"hh%hAh'}q(Urefurihh,]qhah+]h)]h*]h-]qh auh]ubh8X]q}q(h X\ ]h"hubeubh)q}q(h XOThis documentation is part of the `rsyslog `_ project.h"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K&h/hh]q(h8X"This documentation is part of the qׅq}q(h X"This documentation is part of the h"hubh1)q}q(h X$`rsyslog `_h'}q(Unamehh5Xhttp://www.rsyslog.com/qh,]h+]h)]h*]h-]uh"hh]qh8Xrsyslogq߅q}q(h Uh"hubah%hh@Kh"hh%hAh'}q(Urefurihh,]qhah+]h)]h*]h-]qhauh]ubh8X project.q煁q}q(h X project.h"hubeubh)q}q(h XCopyright © 2009-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h"hFh#h$h%h&h'}q(h)]h*]h+]h,]h-]uh.K)h/hh]q(h8XCopyright © 2009-2014 by qq}q(h XCopyright © 2009-2014 by h"hubh1)q}q(h X3`Rainer Gerhards `_h'}q(UnameXRainer Gerhardsh5Xhttp://www.gerhards.net/rainerqh,]h+]h)]h*]h-]uh"hh]qh8XRainer Gerhardsqq}q(h Uh"hubah%hh@Kh"hh%hAh'}q(Urefurihh,]qhah+]h)]h*]h-]qhauh]ubh8X and qq}r(h X and h"hubh1)r}r(h X$`Adiscon `_h'}r(UnameXAdisconh5Xhttp://www.adiscon.com/rh,]h+]h)]h*]h-]uh"hh]rh8XAdisconrr}r(h Uh"jubah%hh@Kh"hh%hAh'}r (Urefurijh,]r hah+]h)]h*]h-]r hauh]ubh8X1. Released under the GNU GPL version 2 or higher.rr}r(h X1. Released under the GNU GPL version 2 or higher.h"hubeubeubeh UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh/hU current_linerNUtransform_messagesr]r Ureporterr!NUid_startr"KU autofootnotesr#]r$U citation_refsr%}r&Uindirect_targetsr']r(Usettingsr)(cdocutils.frontend Values r*or+}r,(Ufootnote_backlinksr-KUrecord_dependenciesr.NU rfc_base_urlr/Uhttps://tools.ietf.org/html/r0U tracebackr1Upep_referencesr2NUstrip_commentsr3NU toc_backlinksr4Uentryr5U language_coder6Uenr7U datestampr8NU report_levelr9KU _destinationr:NU halt_levelr;KU strip_classesr<NhQNUerror_encoding_error_handlerr=Ubackslashreplacer>Udebugr?NUembed_stylesheetr@Uoutput_encoding_error_handlerrAUstrictrBU sectnum_xformrCKUdump_transformsrDNU docinfo_xformrEKUwarning_streamrFNUpep_file_url_templaterGUpep-%04drHUexit_status_levelrIKUconfigrJNUstrict_visitorrKNUcloak_email_addressesrLUtrim_footnote_reference_spacerMUenvrNNUdump_pseudo_xmlrONUexpose_internalsrPNUsectsubtitle_xformrQU source_linkrRNUrfc_referencesrSNUoutput_encodingrTUutf-8rUU source_urlrVNUinput_encodingrWU utf-8-sigrXU_disable_configrYNU id_prefixrZUU tab_widthr[KUerror_encodingr\UUTF-8r]U_sourcer^h$Ugettext_compactr_U generatorr`NUdump_internalsraNU smart_quotesrbU pep_base_urlrcU https://www.python.org/dev/peps/rdUsyntax_highlightreUlongrfUinput_encoding_error_handlerrgjBUauto_id_prefixrhUidriUdoctitle_xformrjUstrip_elements_with_classesrkNU _config_filesrl]Ufile_insertion_enabledrmU raw_enabledrnKU dump_settingsroNubUsymbol_footnote_startrpKUidsrq}rr(hh>hj hhhhhhFhhuUsubstitution_namesrs}rth%h/h'}ru(h)]h,]h+]Usourceh$h*]h-]uU footnotesrv]rwUrefidsrx}ryub.build/.doctrees/configuration/global/options/rsconf1_moddir.doctree0000664000175000017500000001462713035122641024616 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqX$moddirqNXrainer gerhardsqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUmoddirqhUrainer-gerhardsqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXR/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_moddir.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$ModDirq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$ModDirq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hXL**Default:** system default for user libraries, e.g. /usr/local/lib/rsyslog/hhhhh h=h"}qN(h$]h%]h&]h']h)]uh+Kh,hh]qO(h@)qP}qQ(hX **Default:**h"}qR(h$]h%]h&]h']h)]uhhLh]qSh5XDefault:qTqU}qV(hUhhPubah hHubh5X@ system default for user libraries, e.g. /usr/local/lib/rsyslog/qWqX}qY(hX@ system default for user libraries, e.g. /usr/local/lib/rsyslog/hhLubeubh9)qZ}q[(hX**Description:**q\hhhhh h=h"}q](h$]h%]h&]h']h)]uh+K h,hh]q^h@)q_}q`(hh\h"}qa(h$]h%]h&]h']h)]uhhZh]qbh5X Description:qcqd}qe(hUhh_ubah hHubaubh9)qf}qg(hXOProvides the default directory in which loadable modules reside. This may be used to specify an alternate location that is not based on the system default. If the system default is used, there is no need to specify this directive. Please note that it is vitally important to end the path name with a slash, else module loads will fail.qhhhhhh h=h"}qi(h$]h%]h&]h']h)]uh+K h,hh]qjh5XOProvides the default directory in which loadable modules reside. This may be used to specify an alternate location that is not based on the system default. If the system default is used, there is no need to specify this directive. Please note that it is vitally important to end the path name with a slash, else module loads will fail.qkql}qm(hhhhhfubaubh9)qn}qo(hX **Sample:**qphhhhh h=h"}qq(h$]h%]h&]h']h)]uh+Kh,hh]qrh@)qs}qt(hhph"}qu(h$]h%]h&]h']h)]uhhnh]qvh5XSample:qwqx}qy(hUhhsubah hHubaubh9)qz}q{(hX;``$ModDir /usr/rsyslog/libs/  # note the trailing slash!``q|hhhhh h=h"}q}(h$]h%]h&]h']h)]uh+Kh,hh]q~cdocutils.nodes literal q)q}q(hh|h"}q(h$]h%]h&]h']h)]uhhzh]qh5X7$ModDir /usr/rsyslog/libs/  # note the trailing slash!qq}q(hUhhubah Uliteralqubaubh9)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project.qq}q(hX project.hhubeubh9)q}q(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5XCopyright © 2007 by qq}q(hXCopyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qɅq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvr NUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformr U source_linkr NUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightr Ulongr!Uinput_encoding_error_handlerr"hUauto_id_prefixr#Uidr$Udoctitle_xformr%Ustrip_elements_with_classesr&NU _config_filesr']Ufile_insertion_enabledr(U raw_enabledr)KU dump_settingsr*NubUsymbol_footnote_startr+KUidsr,}r-(hhhhhhhhuUsubstitution_namesr.}r/h h,h"}r0(h$]h']h&]Usourcehh%]h)]uU footnotesr1]r2Urefidsr3}r4ub.build/.doctrees/configuration/global/options/rsconf1_generateconfiggraph.doctree0000664000175000017500000006671513035122641027347 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XtroubleshootingqX$generateconfiggraphqNXgraphvizquUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceq NU decorationqNUautofootnote_startqKUnameidsq}q(hUtroubleshootingqhUgenerateconfiggraphqhUgraphvizquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX_/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_generateconfiggraph.rstqUtagnameqUsectionqU attributesq }q!(Udupnamesq"]Uclassesq#]Ubackrefsq$]Uidsq%]q&haUnamesq']q(hauUlineq)KUdocumentq*hh]q+(cdocutils.nodes title q,)q-}q.(hX$GenerateConfigGraphq/hhhhhUtitleq0h }q1(h"]h#]h$]h%]h']uh)Kh*hh]q2cdocutils.nodes Text q3X$GenerateConfigGraphq4q5}q6(hh/hh-ubaubcdocutils.nodes paragraph q7)q8}q9(hX(**Type:** global configuration directiveq:hhhhhU paragraphq;h }q<(h"]h#]h$]h%]h']uh)Kh*hh]q=(cdocutils.nodes strong q>)q?}q@(hX **Type:**h }qA(h"]h#]h$]h%]h']uhh8h]qBh3XType:qCqD}qE(hUhh?ubahUstrongqFubh3X global configuration directiveqGqH}qI(hX global configuration directivehh8ubeubh7)qJ}qK(hX **Default:**qLhhhhhh;h }qM(h"]h#]h$]h%]h']uh)Kh*hh]qNh>)qO}qP(hhLh }qQ(h"]h#]h$]h%]h']uhhJh]qRh3XDefault:qSqT}qU(hUhhOubahhFubaubh7)qV}qW(hX6**Available Since:** 4.3.1 **CURRENTLY NOT AVAILABLE**qXhhhhhh;h }qY(h"]h#]h$]h%]h']uh)Kh*hh]qZ(h>)q[}q\(hX**Available Since:**h }q](h"]h#]h$]h%]h']uhhVh]q^h3XAvailable Since:q_q`}qa(hUhh[ubahhFubh3X 4.3.1 qbqc}qd(hX 4.3.1 hhVubh>)qe}qf(hX**CURRENTLY NOT AVAILABLE**h }qg(h"]h#]h$]h%]h']uhhVh]qhh3XCURRENTLY NOT AVAILABLEqiqj}qk(hUhheubahhFubeubh7)ql}qm(hX**Description:**qnhhhhhh;h }qo(h"]h#]h$]h%]h']uh)K h*hh]qph>)qq}qr(hhnh }qs(h"]h#]h$]h%]h']uhhlh]qth3X Description:quqv}qw(hUhhqubahhFubaubh7)qx}qy(hX**This directive is currently not supported. We had to disable it when we improved the rule engine. It is considerable effort to re-enable it. On the other hand, we are about to add a new config system, which will make yet another config graph method necessary. As such we have decided to currently disable this functionality and re-introduce it when the new config system has been instantiated.**qzhhhhhh;h }q{(h"]h#]h$]h%]h']uh)K h*hh]q|h>)q}}q~(hhzh }q(h"]h#]h$]h%]h']uhhxh]qh3XThis directive is currently not supported. We had to disable it when we improved the rule engine. It is considerable effort to re-enable it. On the other hand, we are about to add a new config system, which will make yet another config graph method necessary. As such we have decided to currently disable this functionality and re-introduce it when the new config system has been instantiated.qq}q(hUhh}ubahhFubaubh7)q}q(hXThis directive permits to create (hopefully) good-looking visualizations of rsyslogd's configuration. It does not affect rsyslog operation. If the directive is specified multiple times, all but the last are ignored. If it is specified, a graph is created. This happens both during a regular startup as well a config check run. It is recommended to include this directive only for documentation purposes and remove it from a production configuraton.qhhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh*hh]qh3XThis directive permits to create (hopefully) good-looking visualizations of rsyslogd's configuration. It does not affect rsyslog operation. If the directive is specified multiple times, all but the last are ignored. If it is specified, a graph is created. This happens both during a regular startup as well a config check run. It is recommended to include this directive only for documentation purposes and remove it from a production configuraton.qq}q(hhhhubaubh7)q}q(hXThe graph is not drawn by rsyslog itself. Instead, it uses the great open source tool `Graphviz `_ to do the actual drawing. This has at least two advantages:hhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh*hh]q(h3XVThe graph is not drawn by rsyslog itself. Instead, it uses the great open source tool qq}q(hXVThe graph is not drawn by rsyslog itself. Instead, it uses the great open source tool hhubcdocutils.nodes reference q)q}q(hX%`Graphviz `_h }q(UnameXGraphvizUrefuriqXhttp://www.graphviz.orgqh%]h$]h"]h#]h']uhhh]qh3XGraphvizqq}q(hUhhubahU referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhhUtargetqh }q(Urefurihh%]qhah$]h"]h#]h']qhauh]ubh3X< to do the actual drawing. This has at least two advantages:qq}q(hX< to do the actual drawing. This has at least two advantages:hhubeubcdocutils.nodes bullet_list q)q}q(hUhhhhhU bullet_listqh }q(UbulletqX-h%]h$]h"]h#]h']uh)Kh*hh]q(cdocutils.nodes list_item q)q}q(hXOthe graph drawing support code in rsyslog is extremly slim and without overheadhhhhhU list_itemqh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXOthe graph drawing support code in rsyslog is extremly slim and without overheadqhhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh]qh3XOthe graph drawing support code in rsyslog is extremly slim and without overheadqq}q(hhhhubaubaubh)q}q(hXithe user may change or further annotate the generated file, thus potentially improving his documentation hhhhhhh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXhthe user may change or further annotate the generated file, thus potentially improving his documentationqhhhhhh;h }q(h"]h#]h$]h%]h']uh)K!h]qh3Xhthe user may change or further annotate the generated file, thus potentially improving his documentationqDžq}q(hhhhubaubaubeubh7)q}q(hXThe drawback, of course, is that you need to run Graphviz once you have generated the control file with rsyslog. Fortunately, the process to do so is rather easy:qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K$h*hh]qh3XThe drawback, of course, is that you need to run Graphviz once you have generated the control file with rsyslog. Fortunately, the process to do so is rather easy:qυq}q(hhhhubaubcdocutils.nodes enumerated_list q)q}q(hUhhhhhUenumerated_listqh }q(UsuffixqU.h%]h$]h"]UprefixqUh#]h']UenumtypeqUarabicquh)K(h*hh]q(h)q}q(hXadd "$GenerateConfigGraph /path/to/file.dot" to rsyslog.conf (from now on, I will call the file just file.dot). Optionally, add "$ActionName" statement **in front of** those actions that you like to use friendly names with. If you do this, keep the names short.hhhhhhh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXadd "$GenerateConfigGraph /path/to/file.dot" to rsyslog.conf (from now on, I will call the file just file.dot). Optionally, add "$ActionName" statement **in front of** those actions that you like to use friendly names with. If you do this, keep the names short.hhhhhh;h }q(h"]h#]h$]h%]h']uh)K(h]q(h3Xadd "$GenerateConfigGraph /path/to/file.dot" to rsyslog.conf (from now on, I will call the file just file.dot). Optionally, add "$ActionName" statement q䅁q}q(hXadd "$GenerateConfigGraph /path/to/file.dot" to rsyslog.conf (from now on, I will call the file just file.dot). Optionally, add "$ActionName" statement hhubh>)q}q(hX**in front of**h }q(h"]h#]h$]h%]h']uhhh]qh3X in front ofq녁q}q(hUhhubahhFubh3X^ those actions that you like to use friendly names with. If you do this, keep the names short.qq}q(hX^ those actions that you like to use friendly names with. If you do this, keep the names short.hhubeubaubh)q}q(hXIrun rsyslog at least once (either in regular or configuration check mode)hhhhhhh }q(h"]h#]h$]h%]h']uh)Nh*hh]qh7)q}q(hXIrun rsyslog at least once (either in regular or configuration check mode)qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K,h]qh3XIrun rsyslog at least once (either in regular or configuration check mode)qq}q(hhhhubaubaubh)q}q(hXdremember to remove the $GenerateConfigGraph directive when you no longer need it (or comment it out)hhhhhhh }q(h"]h#]h$]h%]h']uh)Nh*hh]rh7)r}r(hXdremember to remove the $GenerateConfigGraph directive when you no longer need it (or comment it out)rhhhhhh;h }r(h"]h#]h$]h%]h']uh)K.h]rh3Xdremember to remove the $GenerateConfigGraph directive when you no longer need it (or comment it out)rr}r(hjhjubaubaubh)r }r (hX=change your working directory to where you place the dot filer hhhhhhh }r (h"]h#]h$]h%]h']uh)Nh*hh]r h7)r}r(hj hj hhhh;h }r(h"]h#]h$]h%]h']uh)K0h]rh3X=change your working directory to where you place the dot filerr}r(hj hjubaubaubh)r}r(hXNif you would like to edit the rsyslog-generated file, now is the time to do sohhhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]rh7)r}r(hXNif you would like to edit the rsyslog-generated file, now is the time to do sorhjhhhh;h }r(h"]h#]h$]h%]h']uh)K1h]rh3XNif you would like to edit the rsyslog-generated file, now is the time to do sorr}r (hjhjubaubaubh)r!}r"(hX"do "dot -Tpng file.dot > file.png"r#hhhhhhh }r$(h"]h#]h$]h%]h']uh)Nh*hh]r%h7)r&}r'(hj#hj!hhhh;h }r((h"]h#]h$]h%]h']uh)K3h]r)h3X"do "dot -Tpng file.dot > file.png"r*r+}r,(hj#hj&ubaubaubh)r-}r.(hXremember that you can use "convert -resize 50% file.png resized.png" if dot's output is too large (likely) or too small. Resizing can be especially useful if you intend to get a rough overview over your configuration. hhhhhhh }r/(h"]h#]h$]h%]h']uh)Nh*hh]r0h7)r1}r2(hXremember that you can use "convert -resize 50% file.png resized.png" if dot's output is too large (likely) or too small. Resizing can be especially useful if you intend to get a rough overview over your configuration.r3hj-hhhh;h }r4(h"]h#]h$]h%]h']uh)K4h]r5h3Xremember that you can use "convert -resize 50% file.png resized.png" if dot's output is too large (likely) or too small. Resizing can be especially useful if you intend to get a rough overview over your configuration.r6r7}r8(hj3hj1ubaubaubeubh7)r9}r:(hX%After completing these steps, you should have a nice graph of your configuration. Details are missing, but that is exactly the point. At the start of the graph is always (at least in this version, could be improved) a node called "inputs" in a tripple hexagon shape. This represents all inputs active in the system (assuming you have defined some, what the current version does not check). Next comes the main queue. It is given in a hexagon shape. That shape indicates that a queue is peresent and used to de-couple the inbound from the outbound part of the graph. In technical terms, here is a threading boundary. Action with "real" queues (other than in direct mode) also utilize this shape. For actions, notice that a "hexagon action" creates a deep copy of the message. As such, a "discard hexagon action" actually does nothing, because it duplicates the message and then discards **the duplicate**. At the end of the diagram, you always see a "discard" action. This indicates that rsyslog discards messages which have been run through all available rules.hhhhhh;h }r;(h"]h#]h$]h%]h']uh)K9h*hh]r<(h3XvAfter completing these steps, you should have a nice graph of your configuration. Details are missing, but that is exactly the point. At the start of the graph is always (at least in this version, could be improved) a node called "inputs" in a tripple hexagon shape. This represents all inputs active in the system (assuming you have defined some, what the current version does not check). Next comes the main queue. It is given in a hexagon shape. That shape indicates that a queue is peresent and used to de-couple the inbound from the outbound part of the graph. In technical terms, here is a threading boundary. Action with "real" queues (other than in direct mode) also utilize this shape. For actions, notice that a "hexagon action" creates a deep copy of the message. As such, a "discard hexagon action" actually does nothing, because it duplicates the message and then discards r=r>}r?(hXvAfter completing these steps, you should have a nice graph of your configuration. Details are missing, but that is exactly the point. At the start of the graph is always (at least in this version, could be improved) a node called "inputs" in a tripple hexagon shape. This represents all inputs active in the system (assuming you have defined some, what the current version does not check). Next comes the main queue. It is given in a hexagon shape. That shape indicates that a queue is peresent and used to de-couple the inbound from the outbound part of the graph. In technical terms, here is a threading boundary. Action with "real" queues (other than in direct mode) also utilize this shape. For actions, notice that a "hexagon action" creates a deep copy of the message. As such, a "discard hexagon action" actually does nothing, because it duplicates the message and then discards hj9ubh>)r@}rA(hX**the duplicate**h }rB(h"]h#]h$]h%]h']uhj9h]rCh3X the duplicaterDrE}rF(hUhj@ubahhFubh3X. At the end of the diagram, you always see a "discard" action. This indicates that rsyslog discards messages which have been run through all available rules.rGrH}rI(hX. At the end of the diagram, you always see a "discard" action. This indicates that rsyslog discards messages which have been run through all available rules.hj9ubeubh7)rJ}rK(hXEdges are labeled with information about when they are taken. For filters, the type of filter, but not any specifics, are given. It is also indicated if no filter is applied in the configuration file (by using a "\*.\*" selector). Edges without labels are unconditionally taken. The actions themselfs are labeled with the name of the output module that handles them. If provided, the name given via "ActionName" is used instead. No further details are provided.hhhhhh;h }rL(h"]h#]h$]h%]h']uh)KJh*hh]rMh3XEdges are labeled with information about when they are taken. For filters, the type of filter, but not any specifics, are given. It is also indicated if no filter is applied in the configuration file (by using a "*.*" selector). Edges without labels are unconditionally taken. The actions themselfs are labeled with the name of the output module that handles them. If provided, the name given via "ActionName" is used instead. No further details are provided.rNrO}rP(hXEdges are labeled with information about when they are taken. For filters, the type of filter, but not any specifics, are given. It is also indicated if no filter is applied in the configuration file (by using a "\*.\*" selector). Edges without labels are unconditionally taken. The actions themselfs are labeled with the name of the output module that handles them. If provided, the name given via "ActionName" is used instead. No further details are provided.hjJubaubh7)rQ}rR(hXIf there is anything in red, this should draw your attention. In this case, rsyslogd has detected something that does not look quite right. A typical example is a discard action which is followed by some other actions in an action unit. Even though something may be red, it can be valid - rsyslogd's graph generator does not yet check each and every speciality, so the configuration may just cover a very uncommon case.rShhhhhh;h }rT(h"]h#]h$]h%]h']uh)KRh*hh]rUh3XIf there is anything in red, this should draw your attention. In this case, rsyslogd has detected something that does not look quite right. A typical example is a discard action which is followed by some other actions in an action unit. Even though something may be red, it can be valid - rsyslogd's graph generator does not yet check each and every speciality, so the configuration may just cover a very uncommon case.rVrW}rX(hjShjQubaubh7)rY}rZ(hXNow let's look at some examples. The graph below was generated on a fairly standard Fedora rsyslog.conf file. It had only the usually commented-out last forwarding action activated:r[hhhhhh;h }r\(h"]h#]h$]h%]h']uh)KYh*hh]r]h3XNow let's look at some examples. The graph below was generated on a fairly standard Fedora rsyslog.conf file. It had only the usually commented-out last forwarding action activated:r^r_}r`(hj[hjYubaubcdocutils.nodes figure ra)rb}rc(hUhhhhhUfigurerdh }re(UalignrfXcenterh%]rgUid1rhah$]h"]h#]h']uh)Nh*hh]ri(cdocutils.nodes image rj)rk}rl(hX.. figure:: rsyslog_confgraph_std.png :align: center :alt: rsyslog configuration graph for a default fedora rsyslog.conf rsyslog configuration graph for a default fedora rsyslog.conf h }rm(UuriX6configuration/global/options/rsyslog_confgraph_std.pngrnh%]h$]h"]h#]U candidatesro}rpU*jnsh']Ualtcdocutils.nodes reprunicode rqX=rsyslog configuration graph for a default fedora rsyslog.confrrrs}rtbuhjbh]hUimageruubcdocutils.nodes caption rv)rw}rx(hX=rsyslog configuration graph for a default fedora rsyslog.confryhjbhhhUcaptionrzh }r{(h"]h#]h$]h%]h']uh)Kah]r|h3X=rsyslog configuration graph for a default fedora rsyslog.confr}r~}r(hjyhjwubaubeubh7)r}r(hXtThis is the typical structure for a simple rsyslog configuration. There are a couple of actions, each guarded by a filter. Messages run from top to bottom and control branches whenever a filter evaluates to true. As there is no discard action, all messages will run through all filters and discarded in the system default discard action right after all configured actions.rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kch*hh]rh3XtThis is the typical structure for a simple rsyslog configuration. There are a couple of actions, each guarded by a filter. Messages run from top to bottom and control branches whenever a filter evaluates to true. As there is no discard action, all messages will run through all filters and discarded in the system default discard action right after all configured actions.rr}r(hjhjubaubh7)r}r(hXA more complex example can be seen in the next graph. This is a configuration I created for testing the graph-creation features, so it contains a little bit of everything. However, real-world configurations can look quite complex, too (and I wouldn't say this one is very complex):rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kjh*hh]rh3XA more complex example can be seen in the next graph. This is a configuration I created for testing the graph-creation features, so it contains a little bit of everything. However, real-world configurations can look quite complex, too (and I wouldn't say this one is very complex):rr}r(hjhjubaubja)r}r(hUhhhhhjdh }r(jfXcenterh%]h$]h"]h#]h']uh)Nh*hh]rjj)r}r(hXE.. figure:: rsyslog_confgraph_complex.png :align: center :alt: h }r(UuriX:configuration/global/options/rsyslog_confgraph_complex.pngrh%]h$]h"]h#]jo}rU*jsh']UaltXuhjh]hjuubaubh7)r}r(hXHere, we have a user-defined discard action. You can immediately see this because processing branches after the first "builtin-file" action. Those messages where the filter evaluates to true for will never run through the left-hand action branch. However, there is also a configuration error present: there are two more actions (now shown red) after the discard action. As the message is discarded, these will never be executed. Note that the discard branch contains no further filters. This is because these actions are all part of the same action unit, which is guarded only by an entry filter. The same is present a bit further down at the node labeled "write\_system\_log\_2". This note has one more special feature, that is label was set via "ActionName", thus is does not have standard form (the same happened to the node named "Forward" right at the top of the diagram. Inside this diagram, the "Forward" node is executed asynchonously on its own queue. All others are executed synchronously.hhhhhh;h }r(h"]h#]h$]h%]h']uh)Kth*hh]rh3XHere, we have a user-defined discard action. You can immediately see this because processing branches after the first "builtin-file" action. Those messages where the filter evaluates to true for will never run through the left-hand action branch. However, there is also a configuration error present: there are two more actions (now shown red) after the discard action. As the message is discarded, these will never be executed. Note that the discard branch contains no further filters. This is because these actions are all part of the same action unit, which is guarded only by an entry filter. The same is present a bit further down at the node labeled "write_system_log_2". This note has one more special feature, that is label was set via "ActionName", thus is does not have standard form (the same happened to the node named "Forward" right at the top of the diagram. Inside this diagram, the "Forward" node is executed asynchonously on its own queue. All others are executed synchronously.rr}r(hXHere, we have a user-defined discard action. You can immediately see this because processing branches after the first "builtin-file" action. Those messages where the filter evaluates to true for will never run through the left-hand action branch. However, there is also a configuration error present: there are two more actions (now shown red) after the discard action. As the message is discarded, these will never be executed. Note that the discard branch contains no further filters. This is because these actions are all part of the same action unit, which is guarded only by an entry filter. The same is present a bit further down at the node labeled "write\_system\_log\_2". This note has one more special feature, that is label was set via "ActionName", thus is does not have standard form (the same happened to the node named "Forward" right at the top of the diagram. Inside this diagram, the "Forward" node is executed asynchonously on its own queue. All others are executed synchronously.hjubaubh7)r}r(hXConfiguration graphs are useful for documenting a setup, but are also a great `troubleshooting `_ resource. It is important to remember that **these graphs are generated from rsyslogd's in-memory action processing structures**. You can not get closer to understanding on how rsyslog interpreted its configuration files. So if the graph does not look what you intended to do, there is probably something worng in rsyslog.conf.hhhhhh;h }r(h"]h#]h$]h%]h']uh)Kh*hh]r(h3XNConfiguration graphs are useful for documenting a setup, but are also a great rr}r(hXNConfiguration graphs are useful for documenting a setup, but are also a great hjubh)r}r(hX&`troubleshooting `_h }r(UnamehhXtroubleshoot.htmlrh%]h$]h"]h#]h']uhjh]rh3Xtroubleshootingrr}r(hUhjubahhubh)r}r(hX hKhjhhh }r(Urefurijh%]rhah$]h"]h#]h']rhauh]ubh3X, resource. It is important to remember that rr}r(hX, resource. It is important to remember that hjubh>)r}r(hXU**these graphs are generated from rsyslogd's in-memory action processing structures**h }r(h"]h#]h$]h%]h']uhjh]rh3XQthese graphs are generated from rsyslogd's in-memory action processing structuresrr}r(hUhjubahhFubh3X. You can not get closer to understanding on how rsyslog interpreted its configuration files. So if the graph does not look what you intended to do, there is probably something worng in rsyslog.conf.rr}r(hX. You can not get closer to understanding on how rsyslog interpreted its configuration files. So if the graph does not look what you intended to do, there is probably something worng in rsyslog.conf.hjubeubh7)r}r(hX>If something is not working as expected, but you do not spot the error immediately, I recommend to generate a graph and zoom it so that you see all of it in one great picture. You may not be able to read anything, but the structure should look good to you and so you can zoom into those areas that draw your attention.rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kh*hh]rh3X>If something is not working as expected, but you do not spot the error immediately, I recommend to generate a graph and zoom it so that you see all of it in one great picture. You may not be able to read anything, but the structure should look good to you and so you can zoom into those areas that draw your attention.rr}r(hjhjubaubh7)r}r(hX **Sample:**rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kh*hh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3XSample:rr}r(hUhjubahhFubaubh7)r}r(hX)``$DirOwner /path/to/graphfile-file.dot``rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kh*hh]rcdocutils.nodes literal r)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X%$DirOwner /path/to/graphfile-file.dotrr}r(hUhjubahUliteralrubaubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh*hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenr U datestampr NU report_levelr KU _destinationr NU halt_levelr KU strip_classesrNh0NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvr NUdump_pseudo_xmlr!NUexpose_internalsr"NUsectsubtitle_xformr#U source_linkr$NUrfc_referencesr%NUoutput_encodingr&Uutf-8r'U source_urlr(NUinput_encodingr)U utf-8-sigr*U_disable_configr+NU id_prefixr,UU tab_widthr-KUerror_encodingr.UUTF-8r/U_sourcer0hUgettext_compactr1U generatorr2NUdump_internalsr3NU smart_quotesr4U pep_base_urlr5U https://www.python.org/dev/peps/r6Usyntax_highlightr7Ulongr8Uinput_encoding_error_handlerr9jUauto_id_prefixr:Uidr;Udoctitle_xformr<Ustrip_elements_with_classesr=NU _config_filesr>]Ufile_insertion_enabledr?U raw_enabledr@KU dump_settingsrANubUsymbol_footnote_startrBKUidsrC}rD(jhjbhjhhhhuUsubstitution_namesrE}rFhh*h }rG(h"]h%]h$]Usourcehh#]h']uU footnotesrH]rIUrefidsrJ}rKub.build/.doctrees/configuration/global/options/rsconf1_failonchownfailure.doctree0000664000175000017500000001457513035122641027221 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqX$failonchownfailureqNXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUfailonchownfailureqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX^/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_failonchownfailure.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$FailOnChownFailureq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$FailOnChownFailureq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** onqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X onqXqY}qZ(hX onhhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXThis option modifies behaviour of dynaFile creation. If different owners or groups are specified for new files or directories and rsyslogd fails to set these new owners or groups, it will log an error and NOT write to the file in question if that option is set to "on". If it is set to "off", the error will be ignored and processing continues. Keep in mind, that the files in this case may be (in)accessible by people who should not have permission. The default is "on".qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XThis option modifies behaviour of dynaFile creation. If different owners or groups are specified for new files or directories and rsyslogd fails to set these new owners or groups, it will log an error and NOT write to the file in question if that option is set to "on". If it is set to "off", the error will be ignored and processing continues. Keep in mind, that the files in this case may be (in)accessible by people who should not have permission. The default is "on".qlqm}qn(hhihhgubaubh9)qo}qp(hX **Sample:**qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh@)qt}qu(hhqh"}qv(h$]h%]h&]h']h)]uhhoh]qwh5XSample:qxqy}qz(hUhhtubah hHubaubh9)q{}q|(hX``$FailOnChownFailure off``q}hhhhh h=h"}q~(h$]h%]h&]h']h)]uh+Kh,hh]qcdocutils.nodes literal q)q}q(hh}h"}q(h$]h%]h&]h']h)]uhh{h]qh5X$FailOnChownFailure offqq}q(hUhhubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qÅq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingr Uutf-8r U source_urlr NUinput_encodingr U utf-8-sigr U_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesr NU _config_filesr!]Ufile_insertion_enabledr"U raw_enabledr#KU dump_settingsr$NubUsymbol_footnote_startr%KUidsr&}r'(hhhhhhhhuUsubstitution_namesr(}r)h h,h"}r*(h$]h']h&]Usourcehh%]h)]uU footnotesr+]r,Urefidsr-}r.ub.build/.doctrees/configuration/global/options/rsconf1_debugprintcfsyslinehandlerlist.doctree0000664000175000017500000001340113035122641031642 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$debugprintcfsyslinehandlerlistqNXrainer gerhardsqXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUdebugprintcfsyslinehandlerlistqhUrainer-gerhardsqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXj/home/rger/proj/rsyslog-doc/source/configuration/global/options/rsconf1_debugprintcfsyslinehandlerlist.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$DebugPrintCFSyslineHandlerListq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$DebugPrintCFSyslineHandlerListq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** onqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X onqXqY}qZ(hX onhhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXSpecifies whether or not the configuration file sysline handler list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled.qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XSpecifies whether or not the configuration file sysline handler list should be written to the debug log. Possible values: on/off. Default is on. Does not affect operation if debugging is disabled.qlqm}qn(hhihhgubaubh9)qo}qp(hX **Sample:**qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh@)qt}qu(hhqh"}qv(h$]h%]h&]h']h)]uhhoh]qwh5XSample:qxqy}qz(hUhhtubah hHubaubcdocutils.nodes transition q{)q|}q}(hX````q~hhhhh U transitionqh"}q(h$]h%]h&]h']h)]uh+Kh,hh]ubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqވUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingr UUTF-8r U_sourcer hUgettext_compactr U generatorr NUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhhhuUsubstitution_namesr }r!h h,h"}r"(h$]h']h&]Usourcehh%]h)]uU footnotesr#]r$Urefidsr%}r&ub.build/.doctrees/configuration/global/index.doctree0000664000175000017500000014132313035122641021313 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$privdroptogroupqX$privdroptogroupidqX$privdroptouseridqXmain queue specific directivesq NXtrue global directivesq NX&legacy global configuration statementsq NX$privdroptouserq X eventreporterq uUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUprivdroptogroupqhUprivdroptogroupidqhUprivdroptouseridqh Umain-queue-specific-directivesqh Utrue-global-directivesqh U&legacy-global-configuration-statementsqh Uprivdroptouserqh U eventreporterquUchildrenq]q cdocutils.nodes section q!)q"}q#(U rawsourceq$UUparentq%hUsourceq&XA/home/rger/proj/rsyslog-doc/source/configuration/global/index.rstq'Utagnameq(Usectionq)U attributesq*}q+(Udupnamesq,]Uclassesq-]Ubackrefsq.]Uidsq/]q0haUnamesq1]q2h auUlineq3KUdocumentq4hh]q5(cdocutils.nodes title q6)q7}q8(h$X&Legacy Global Configuration Statementsq9h%h"h&h'h(Utitleq:h*}q;(h,]h-]h.]h/]h1]uh3Kh4hh]qq?}q@(h$h9h%h7ubaubcdocutils.nodes paragraph qA)qB}qC(h$XGlobal configuration statements, as their name implies, usually affect some global features. However, some also affect main queues, which are "global" to a ruleset.qDh%h"h&h'h(U paragraphqEh*}qF(h,]h-]h.]h/]h1]uh3Kh4hh]qGh=XGlobal configuration statements, as their name implies, usually affect some global features. However, some also affect main queues, which are "global" to a ruleset.qHqI}qJ(h$hDh%hBubaubh!)qK}qL(h$Uh%h"h&h'h(h)h*}qM(h,]h-]h.]h/]qNhah1]qOh auh3Kh4hh]qP(h6)qQ}qR(h$XTrue Global DirectivesqSh%hKh&h'h(h:h*}qT(h,]h-]h.]h/]h1]uh3Kh4hh]qUh=XTrue Global DirectivesqVqW}qX(h$hSh%hQubaubcdocutils.nodes compound qY)qZ}q[(h$Uh%hKh&h'h(Ucompoundq\h*}q](h,]h-]q^Utoctree-wrapperq_ah.]h/]h1]uh3Nh4hh]q`csphinx.addnodes toctree qa)qb}qc(h$Uh%hZh&h'h(Utoctreeqdh*}qe(UnumberedqfKU includehiddenqgh%Xconfiguration/global/indexqhUcaptionqiNUglobqjh/]h.]U titlesonlyqkh,]h-]h1]Uentriesql]qm(NX9configuration/global/options/rsconf1_abortonuncleanconfigqnqoNXCconfiguration/global/options/rsconf1_debugprintcfsyslinehandlerlistqpqqNX9configuration/global/options/rsconf1_debugprintmodulelistqrqsNX;configuration/global/options/rsconf1_debugprinttemplatelistqtquNX7configuration/global/options/rsconf1_failonchownfailureqvqwNX8configuration/global/options/rsconf1_generateconfiggraphqxqyNX2configuration/global/options/rsconf1_includeconfigqzq{NX5configuration/global/options/rsconf1_mainmsgqueuesizeq|q}NX1configuration/global/options/rsconf1_maxopenfilesq~qNX+configuration/global/options/rsconf1_moddirqqNX,configuration/global/options/rsconf1_modloadqqNX*configuration/global/options/rsconf1_umaskqqNX9configuration/global/options/rsconf1_resetconfigvariablesqqeUhiddenqU includefilesq]q(hnhphrhthvhxhzh|h~hhhheUmaxdepthqJuh3K h]ubaubcdocutils.nodes bullet_list q)q}q(h$Uh%hKh&h'h(U bullet_listqh*}q(UbulletqX-h/]h.]h,]h-]h1]uh3Kh4hh]q(cdocutils.nodes list_item q)q}q(h$X**$MaxMessageSize** , default 8k - allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations. **Important:** In order for this directive to work correctly, it **must** be placed right at the top of ``rsyslog.conf`` (before any input is defined). Change the setting to e.g. 32768 if you would like to support large message sizes for IHE (32k is the current maximum needed for IHE). I was initially tempted to set the default to 32k, but there is a some memory footprint with the current implementation in rsyslog. If you intend to receive Windows Event Log data (e.g. via `EventReporter `_), you might want to increase this number to an even higher value, as event log messages can be very lengthy ("$MaxMessageSize 64k" is not a bad idea). Note: testing showed that 4k seems to be the typical maximum for **UDP** based syslog. This is an IP stack restriction. Not always ... but very often. If you go beyond that value, be sure to test that rsyslogd actually does what you think it should do ;) It is highly suggested to use a TCP based transport instead of UDP (plain TCP syslog, RELP). This resolves the UDP stack size restrictions. Note that 2k, is the smallest size that must be supported in order to be compliant to the upcoming new syslog RFC series.h%hh&h'h(U list_itemqh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]q(hA)q}q(h$X **$MaxMessageSize** , default 8k - allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations.h%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3Kh]q(cdocutils.nodes strong q)q}q(h$X**$MaxMessageSize**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X$MaxMessageSizeqq}q(h$Uh%hubah(Ustrongqubh=X  , default 8k - allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations.qq}q(h$X  , default 8k - allows to specify maximum supported message size (both for sending and receiving). The default should be sufficient for almost all cases. Do not set this below 1k, as it would cause interoperability problems with other syslog implementations.h%hubeubhA)q}q(h$X**Important:** In order for this directive to work correctly, it **must** be placed right at the top of ``rsyslog.conf`` (before any input is defined).h%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K!h]q(h)q}q(h$X**Important:**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X Important:qq}q(h$Uh%hubah(hubh=X3 In order for this directive to work correctly, it qq}q(h$X3 In order for this directive to work correctly, it h%hubh)q}q(h$X**must**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=Xmustqq}q(h$Uh%hubah(hubh=X be placed right at the top of qq}q(h$X be placed right at the top of h%hubcdocutils.nodes literal q)q}q(h$X``rsyslog.conf``h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X rsyslog.confqƅq}q(h$Uh%hubah(Uliteralqubh=X (before any input is defined).qʅq}q(h$X (before any input is defined).h%hubeubhA)q}q(h$XChange the setting to e.g. 32768 if you would like to support large message sizes for IHE (32k is the current maximum needed for IHE). I was initially tempted to set the default to 32k, but there is a some memory footprint with the current implementation in rsyslog. If you intend to receive Windows Event Log data (e.g. via `EventReporter `_), you might want to increase this number to an even higher value, as event log messages can be very lengthy ("$MaxMessageSize 64k" is not a bad idea). Note: testing showed that 4k seems to be the typical maximum for **UDP** based syslog. This is an IP stack restriction. Not always ... but very often. If you go beyond that value, be sure to test that rsyslogd actually does what you think it should do ;) It is highly suggested to use a TCP based transport instead of UDP (plain TCP syslog, RELP). This resolves the UDP stack size restrictions. Note that 2k, is the smallest size that must be supported in order to be compliant to the upcoming new syslog RFC series.h%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K%h]q(h=XEChange the setting to e.g. 32768 if you would like to support large message sizes for IHE (32k is the current maximum needed for IHE). I was initially tempted to set the default to 32k, but there is a some memory footprint with the current implementation in rsyslog. If you intend to receive Windows Event Log data (e.g. via qхq}q(h$XEChange the setting to e.g. 32768 if you would like to support large message sizes for IHE (32k is the current maximum needed for IHE). I was initially tempted to set the default to 32k, but there is a some memory footprint with the current implementation in rsyslog. If you intend to receive Windows Event Log data (e.g. via h%hubcdocutils.nodes reference q)q}q(h$X0`EventReporter `_h*}q(UnameX EventReporterUrefuriqXhttp://www.eventreporter.com/qh/]h.]h,]h-]h1]uh%hh]qh=X EventReporterqۅq}q(h$Uh%hubah(U referencequbcdocutils.nodes target q)q}q(h$X U referencedqKh%hh(Utargetqh*}q(Urefurihh/]qhah.]h,]h-]h1]qh auh]ubh=X), you might want to increase this number to an even higher value, as event log messages can be very lengthy ("$MaxMessageSize 64k" is not a bad idea). Note: testing showed that 4k seems to be the typical maximum for q煁q}q(h$X), you might want to increase this number to an even higher value, as event log messages can be very lengthy ("$MaxMessageSize 64k" is not a bad idea). Note: testing showed that 4k seems to be the typical maximum for h%hubh)q}q(h$X**UDP**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=XUDPqq}q(h$Uh%hubah(hubh=X based syslog. This is an IP stack restriction. Not always ... but very often. If you go beyond that value, be sure to test that rsyslogd actually does what you think it should do ;) It is highly suggested to use a TCP based transport instead of UDP (plain TCP syslog, RELP). This resolves the UDP stack size restrictions. Note that 2k, is the smallest size that must be supported in order to be compliant to the upcoming new syslog RFC series.qq}q(h$X based syslog. This is an IP stack restriction. Not always ... but very often. If you go beyond that value, be sure to test that rsyslogd actually does what you think it should do ;) It is highly suggested to use a TCP based transport instead of UDP (plain TCP syslog, RELP). This resolves the UDP stack size restrictions. Note that 2k, is the smallest size that must be supported in order to be compliant to the upcoming new syslog RFC series.h%hubeubeubh)q}q(h$X**$LocalHostName** [name] - this directive permits to overwrite the system hostname with the one specified in the directive. If the directive is given multiple times, all but the last one will be ignored. Please note that startup error messages may be issued with the real hostname. This is by design and not a bug (but one may argue if the design should be changed ;)). Available since 4.7.4+, 5.7.3+, 6.1.3+.h%hh&h'h(hh*}q(h,]h-]h.]h/]h1]uh3Nh4hh]qhA)q}q(h$X**$LocalHostName** [name] - this directive permits to overwrite the system hostname with the one specified in the directive. If the directive is given multiple times, all but the last one will be ignored. Please note that startup error messages may be issued with the real hostname. This is by design and not a bug (but one may argue if the design should be changed ;)). Available since 4.7.4+, 5.7.3+, 6.1.3+.h%hh&h'h(hEh*}q(h,]h-]h.]h/]h1]uh3K6h]q(h)q}q(h$X**$LocalHostName**h*}q(h,]h-]h.]h/]h1]uh%hh]qh=X$LocalHostNamerr}r(h$Uh%hubah(hubh=X [name] - this directive permits to overwrite the system hostname with the one specified in the directive. If the directive is given multiple times, all but the last one will be ignored. Please note that startup error messages may be issued with the real hostname. This is by design and not a bug (but one may argue if the design should be changed ;)). Available since 4.7.4+, 5.7.3+, 6.1.3+.rr}r(h$X [name] - this directive permits to overwrite the system hostname with the one specified in the directive. If the directive is given multiple times, all but the last one will be ignored. Please note that startup error messages may be issued with the real hostname. This is by design and not a bug (but one may argue if the design should be changed ;)). Available since 4.7.4+, 5.7.3+, 6.1.3+.h%hubeubaubh)r}r(h$XH**$LogRSyslogStatusMessages** [**on**/off] - If set to on (the default), rsyslog emits message on startup and shutdown as well as when it is HUPed. This information might be needed by some log analyzers. If set to off, no such status messages are logged, what may be useful for other scenarios. [available since 4.7.0 and 5.3.0]h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]r hA)r }r (h$XH**$LogRSyslogStatusMessages** [**on**/off] - If set to on (the default), rsyslog emits message on startup and shutdown as well as when it is HUPed. This information might be needed by some log analyzers. If set to off, no such status messages are logged, what may be useful for other scenarios. [available since 4.7.0 and 5.3.0]h%jh&h'h(hEh*}r (h,]h-]h.]h/]h1]uh3K=h]r (h)r}r(h$X**$LogRSyslogStatusMessages**h*}r(h,]h-]h.]h/]h1]uh%j h]rh=X$LogRSyslogStatusMessagesrr}r(h$Uh%jubah(hubh=X [rr}r(h$X [h%j ubh)r}r(h$X**on**h*}r(h,]h-]h.]h/]h1]uh%j h]rh=Xonrr}r(h$Uh%jubah(hubh=X#/off] - If set to on (the default), rsyslog emits message on startup and shutdown as well as when it is HUPed. This information might be needed by some log analyzers. If set to off, no such status messages are logged, what may be useful for other scenarios. [available since 4.7.0 and 5.3.0]rr }r!(h$X#/off] - If set to on (the default), rsyslog emits message on startup and shutdown as well as when it is HUPed. This information might be needed by some log analyzers. If set to off, no such status messages are logged, what may be useful for other scenarios. [available since 4.7.0 and 5.3.0]h%j ubeubaubh)r"}r#(h$X**$DefaultRuleset** [name] - changes the default ruleset for unbound inputs to the provided *name* (the default default ruleset is named "RSYSLOG\_DefaultRuleset"). It is advised to also read our paper on :doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`.h%hh&h'h(hh*}r$(h,]h-]h.]h/]h1]uh3Nh4hh]r%hA)r&}r'(h$X**$DefaultRuleset** [name] - changes the default ruleset for unbound inputs to the provided *name* (the default default ruleset is named "RSYSLOG\_DefaultRuleset"). It is advised to also read our paper on :doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`.h%j"h&h'h(hEh*}r((h,]h-]h.]h/]h1]uh3KBh]r)(h)r*}r+(h$X**$DefaultRuleset**h*}r,(h,]h-]h.]h/]h1]uh%j&h]r-h=X$DefaultRulesetr.r/}r0(h$Uh%j*ubah(hubh=XI [name] - changes the default ruleset for unbound inputs to the provided r1r2}r3(h$XI [name] - changes the default ruleset for unbound inputs to the provided h%j&ubcdocutils.nodes emphasis r4)r5}r6(h$X*name*h*}r7(h,]h-]h.]h/]h1]uh%j&h]r8h=Xnamer9r:}r;(h$Uh%j5ubah(Uemphasisr<ubh=Xj (the default default ruleset is named "RSYSLOG_DefaultRuleset"). It is advised to also read our paper on r=r>}r?(h$Xk (the default default ruleset is named "RSYSLOG\_DefaultRuleset"). It is advised to also read our paper on h%j&ubcsphinx.addnodes pending_xref r@)rA}rB(h$XI:doc:`using multiple rule sets in rsyslog <../../concepts/multi_ruleset>`rCh%j&h&h'h(U pending_xrefrDh*}rE(UreftypeXdocrFUrefwarnrGU reftargetrHX../../concepts/multi_rulesetU refdomainUh/]h.]U refexplicith,]h-]h1]UrefdocrIhhuh3KBh]rJh)rK}rL(h$jCh*}rM(h,]h-]rN(UxrefrOjFeh.]h/]h1]uh%jAh]rPh=X#using multiple rule sets in rsyslogrQrR}rS(h$Uh%jKubah(hubaubh=X.rT}rU(h$X.h%j&ubeubaubh)rV}rW(h$X**$DefaultNetstreamDriver** , the default :doc:`network stream driver <../../concepts/netstrm_drvr>` to use. Defaults to ptcp.h%hh&h'h(hh*}rX(h,]h-]h.]h/]h1]uh3Nh4hh]rYhA)rZ}r[(h$X**$DefaultNetstreamDriver** , the default :doc:`network stream driver <../../concepts/netstrm_drvr>` to use. Defaults to ptcp.h%jVh&h'h(hEh*}r\(h,]h-]h.]h/]h1]uh3KFh]r](h)r^}r_(h$X**$DefaultNetstreamDriver**h*}r`(h,]h-]h.]h/]h1]uh%jZh]rah=X$DefaultNetstreamDriverrbrc}rd(h$Uh%j^ubah(hubh=X , the default rerf}rg(h$X , the default h%jZubj@)rh}ri(h$X::doc:`network stream driver <../../concepts/netstrm_drvr>`rjh%jZh&h'h(jDh*}rk(UreftypeXdocrljGjHX../../concepts/netstrm_drvrU refdomainUh/]h.]U refexplicith,]h-]h1]jIhhuh3KFh]rmh)rn}ro(h$jjh*}rp(h,]h-]rq(jOjleh.]h/]h1]uh%jhh]rrh=Xnetwork stream driverrsrt}ru(h$Uh%jnubah(hubaubh=X to use. Defaults to ptcp.rvrw}rx(h$X to use. Defaults to ptcp.h%jZubeubaubh)ry}rz(h$X7**$DefaultNetstreamDriverCAFile** r{h%hh&h'h(hh*}r|(h,]h-]h.]h/]h1]uh3Nh4hh]r}hA)r~}r(h$j{h%jyh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KIh]r(h)r}r(h$X!**$DefaultNetstreamDriverCAFile**h*}r(h,]h-]h.]h/]h1]uh%j~h]rh=X$DefaultNetstreamDriverCAFilerr}r(h$Uh%jubah(hubh=X rr}r(h$X h%j~ubeubaubh)r}r(h$X;**$DefaultNetstreamDriverCertFile** rh%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KJh]r(h)r}r(h$X#**$DefaultNetstreamDriverCertFile**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$DefaultNetstreamDriverCertFilerr}r(h$Uh%jubah(hubh=X rr}r(h$X h%jubeubaubh)r}r(h$X9**$DefaultNetstreamDriverKeyFile** rh%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KKh]r(h)r}r(h$X"**$DefaultNetstreamDriverKeyFile**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$DefaultNetstreamDriverKeyFilerr}r(h$Uh%jubah(hubh=X rr}r(h$X h%jubeubaubh)r}r(h$XI**$RepeatedMsgContainsOriginalMsg** [on/**off**] - "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5). Once set, it affects all following actions.h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$XI**$RepeatedMsgContainsOriginalMsg** [on/**off**] - "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5). Once set, it affects all following actions.h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KLh]r(h)r}r(h$X#**$RepeatedMsgContainsOriginalMsg**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$RepeatedMsgContainsOriginalMsgrr}r(h$Uh%jubah(hubh=X [on/rr}r(h$X [on/h%jubh)r}r(h$X**off**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xoffrr}r(h$Uh%jubah(hubh=X] - "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5). Once set, it affects all following actions.rr}r(h$X] - "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5). Once set, it affects all following actions.h%jubeubaubh)r}r(h$X**$OptimizeForUniprocessor** [on/**off**] - turns on optimizatons which lead to better performance on uniprocessors. If you run on multicore-machiens, turning this off lessens CPU load. The default may change as uniprocessor systems become less common. [available since 4.1.0]h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X**$OptimizeForUniprocessor** [on/**off**] - turns on optimizatons which lead to better performance on uniprocessors. If you run on multicore-machiens, turning this off lessens CPU load. The default may change as uniprocessor systems become less common. [available since 4.1.0]h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KUh]r(h)r}r(h$X**$OptimizeForUniprocessor**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$OptimizeForUniprocessorrr}r(h$Uh%jubah(hubh=X [on/rr}r(h$X [on/h%jubh)r}r(h$X**off**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xoffrr}r(h$Uh%jubah(hubh=X] - turns on optimizatons which lead to better performance on uniprocessors. If you run on multicore-machiens, turning this off lessens CPU load. The default may change as uniprocessor systems become less common. [available since 4.1.0]rr}r(h$X] - turns on optimizatons which lead to better performance on uniprocessors. If you run on multicore-machiens, turning this off lessens CPU load. The default may change as uniprocessor systems become less common. [available since 4.1.0]h%jubeubaubh)r}r(h$X**$PreserveFQDN** [on/**off**) - if set to off (legacy default to remain compatible to sysklogd), the domain part from a name that is within the same domain as the receiving system is stripped. If set to on, full names are always used.h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X**$PreserveFQDN** [on/**off**) - if set to off (legacy default to remain compatible to sysklogd), the domain part from a name that is within the same domain as the receiving system is stripped. If set to on, full names are always used.h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3KZh]r(h)r}r(h$X**$PreserveFQDN**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X $PreserveFQDNrr}r(h$Uh%jubah(hubh=X [on/rr}r(h$X [on/h%jubh)r}r(h$X**off**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xoffrr}r(h$Uh%jubah(hubh=X) - if set to off (legacy default to remain compatible to sysklogd), the domain part from a name that is within the same domain as the receiving system is stripped. If set to on, full names are always used.rr}r(h$X) - if set to off (legacy default to remain compatible to sysklogd), the domain part from a name that is within the same domain as the receiving system is stripped. If set to on, full names are always used.h%jubeubaubh)r}r(h$Xe**$WorkDirectory** (directory for spool and other work files. Do **not** use trailing slashes)h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]r hA)r }r (h$Xe**$WorkDirectory** (directory for spool and other work files. Do **not** use trailing slashes)h%jh&h'h(hEh*}r (h,]h-]h.]h/]h1]uh3K^h]r (h)r}r(h$X**$WorkDirectory**h*}r(h,]h-]h.]h/]h1]uh%j h]rh=X$WorkDirectoryrr}r(h$Uh%jubah(hubh=X6 (directory for spool and other work files. Do rr}r(h$X6 (directory for spool and other work files. Do h%j ubh)r}r(h$X**not**h*}r(h,]h-]h.]h/]h1]uh%j h]rh=Xnotrr}r(h$Uh%jubah(hubh=X use trailing slashes)rr }r!(h$X use trailing slashes)h%j ubeubaubh)r"}r#(h$X#`$PrivDropToGroup `_r$h%hh&h'h(hh*}r%(h,]h-]h.]h/]h1]uh3Nh4hh]r&hA)r'}r((h$j$h%j"h&h'h(hEh*}r)(h,]h-]h.]h/]h1]uh3K`h]r*(h)r+}r,(h$j$h*}r-(UnameX$PrivDropToGrouphX droppriv.htmlr.h/]h.]h,]h-]h1]uh%j'h]r/h=X$PrivDropToGroupr0r1}r2(h$Uh%j+ubah(hubh)r3}r4(h$X hKh%j'h(hh*}r5(Urefurij.h/]r6hah.]h,]h-]h1]r7hauh]ubeubaubh)r8}r9(h$X%`$PrivDropToGroupID `_r:h%hh&h'h(hh*}r;(h,]h-]h.]h/]h1]uh3Nh4hh]r<hA)r=}r>(h$j:h%j8h&h'h(hEh*}r?(h,]h-]h.]h/]h1]uh3Kah]r@(h)rA}rB(h$j:h*}rC(UnameX$PrivDropToGroupIDhX droppriv.htmlrDh/]h.]h,]h-]h1]uh%j=h]rEh=X$PrivDropToGroupIDrFrG}rH(h$Uh%jAubah(hubh)rI}rJ(h$X hKh%j=h(hh*}rK(UrefurijDh/]rLhah.]h,]h-]h1]rMhauh]ubeubaubh)rN}rO(h$X"`$PrivDropToUser `_rPh%hh&h'h(hh*}rQ(h,]h-]h.]h/]h1]uh3Nh4hh]rRhA)rS}rT(h$jPh%jNh&h'h(hEh*}rU(h,]h-]h.]h/]h1]uh3Kbh]rV(h)rW}rX(h$jPh*}rY(UnameX$PrivDropToUserhX droppriv.htmlrZh/]h.]h,]h-]h1]uh%jSh]r[h=X$PrivDropToUserr\r]}r^(h$Uh%jWubah(hubh)r_}r`(h$X hKh%jSh(hh*}ra(UrefurijZh/]rbhah.]h,]h-]h1]rch auh]ubeubaubh)rd}re(h$X$`$PrivDropToUserID `_rfh%hh&h'h(hh*}rg(h,]h-]h.]h/]h1]uh3Nh4hh]rhhA)ri}rj(h$jfh%jdh&h'h(hEh*}rk(h,]h-]h.]h/]h1]uh3Kch]rl(h)rm}rn(h$jfh*}ro(UnameX$PrivDropToUserIDhX droppriv.htmlrph/]h.]h,]h-]h1]uh%jih]rqh=X$PrivDropToUserIDrrrs}rt(h$Uh%jmubah(hubh)ru}rv(h$X hKh%jih(hh*}rw(Urefurijph/]rxhah.]h,]h-]h1]ryhauh]ubeubaubh)rz}r{(h$X**$Sleep** - puts the rsyslog main thread to sleep for the specified number of seconds immediately when the directive is encountered. You should have a good reason for using this directive!h%hh&h'h(hh*}r|(h,]h-]h.]h/]h1]uh3Nh4hh]r}hA)r~}r(h$X**$Sleep** - puts the rsyslog main thread to sleep for the specified number of seconds immediately when the directive is encountered. You should have a good reason for using this directive!h%jzh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kdh]r(h)r}r(h$X **$Sleep**h*}r(h,]h-]h.]h/]h1]uh%j~h]rh=X$Sleeprr}r(h$Uh%jubah(hubh=X - puts the rsyslog main thread to sleep for the specified number of seconds immediately when the directive is encountered. You should have a good reason for using this directive!rr}r(h$X - puts the rsyslog main thread to sleep for the specified number of seconds immediately when the directive is encountered. You should have a good reason for using this directive!h%j~ubeubaubh)r}r(h$X~**$LocalHostIPIF** - (available since 5.9.6) - if provided, the IP of the specified interface (e.g. "eth0") shall be used as fromhost-ip for locall-originating messages. If this directive is not given OR the interface cannot be found (or has no IP address), the default of "127.0.0.1" is used. Note that this directive can be given only once. Trying to reset will result in an error message and the new value will be ignored. Please note that modules must have support for obtaining the local IP address set via this directive. While this is the case for rsyslog-provided modules, it may not always be the case for contributed plugins. **Important:** This directive shall be placed **right at the top of rsyslog.conf**. Otherwise, if error messages are triggered before this directive is processed, rsyslog will fix the local host IP to "127.0.0.1", what than can not be reset.h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X~**$LocalHostIPIF** - (available since 5.9.6) - if provided, the IP of the specified interface (e.g. "eth0") shall be used as fromhost-ip for locall-originating messages. If this directive is not given OR the interface cannot be found (or has no IP address), the default of "127.0.0.1" is used. Note that this directive can be given only once. Trying to reset will result in an error message and the new value will be ignored. Please note that modules must have support for obtaining the local IP address set via this directive. While this is the case for rsyslog-provided modules, it may not always be the case for contributed plugins. **Important:** This directive shall be placed **right at the top of rsyslog.conf**. Otherwise, if error messages are triggered before this directive is processed, rsyslog will fix the local host IP to "127.0.0.1", what than can not be reset.h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kgh]r(h)r}r(h$X**$LocalHostIPIF**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$LocalHostIPIFrr}r(h$Uh%jubah(hubh=X{ - (available since 5.9.6) - if provided, the IP of the specified interface (e.g. "eth0") shall be used as fromhost-ip for locall-originating messages. If this directive is not given OR the interface cannot be found (or has no IP address), the default of "127.0.0.1" is used. Note that this directive can be given only once. Trying to reset will result in an error message and the new value will be ignored. Please note that modules must have support for obtaining the local IP address set via this directive. While this is the case for rsyslog-provided modules, it may not always be the case for contributed plugins. rr}r(h$X{ - (available since 5.9.6) - if provided, the IP of the specified interface (e.g. "eth0") shall be used as fromhost-ip for locall-originating messages. If this directive is not given OR the interface cannot be found (or has no IP address), the default of "127.0.0.1" is used. Note that this directive can be given only once. Trying to reset will result in an error message and the new value will be ignored. Please note that modules must have support for obtaining the local IP address set via this directive. While this is the case for rsyslog-provided modules, it may not always be the case for contributed plugins. h%jubh)r}r(h$X**Important:**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X Important:rr}r(h$Uh%jubah(hubh=X This directive shall be placed rr}r(h$X This directive shall be placed h%jubh)r}r(h$X$**right at the top of rsyslog.conf**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X right at the top of rsyslog.confrr}r(h$Uh%jubah(hubh=X. Otherwise, if error messages are triggered before this directive is processed, rsyslog will fix the local host IP to "127.0.0.1", what than can not be reset.rr}r(h$X. Otherwise, if error messages are triggered before this directive is processed, rsyslog will fix the local host IP to "127.0.0.1", what than can not be reset.h%jubeubaubh)r}r(h$Xs**$ErrorMessagesToStderr** [**on**\ \|off] - direct rsyslogd error message to stderr (in addition to other targets)h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$Xs**$ErrorMessagesToStderr** [**on**\ \|off] - direct rsyslogd error message to stderr (in addition to other targets)h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kuh]r(h)r}r(h$X**$ErrorMessagesToStderr**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$ErrorMessagesToStderrrr}r(h$Uh%jubah(hubh=X [rr}r(h$X [h%jubh)r}r(h$X**on**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xonrr}r(h$Uh%jubah(hubh=XN|off] - direct rsyslogd error message to stderr (in addition to other targets)rr}r(h$XQ\ \|off] - direct rsyslogd error message to stderr (in addition to other targets)h%jubeubaubh)r}r(h$X1**$SpaceLFOnReceive** [on/**off**] - instructs rsyslogd to replace LF with spaces during message reception (sysklogd compatibility aid). This is applied at the beginning of the parser stage and cannot be overridden (neither at the input nor parser level). Consequently, it affects all inputs and parsers. h%hh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X0**$SpaceLFOnReceive** [on/**off**] - instructs rsyslogd to replace LF with spaces during message reception (sysklogd compatibility aid). This is applied at the beginning of the parser stage and cannot be overridden (neither at the input nor parser level). Consequently, it affects all inputs and parsers.h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kwh]r(h)r}r(h$X**$SpaceLFOnReceive**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$SpaceLFOnReceiverr}r(h$Uh%jubah(hubh=X [on/rr}r(h$X [on/h%jubh)r}r(h$X**off**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xoffrr}r(h$Uh%jubah(hubh=X] - instructs rsyslogd to replace LF with spaces during message reception (sysklogd compatibility aid). This is applied at the beginning of the parser stage and cannot be overridden (neither at the input nor parser level). Consequently, it affects all inputs and parsers.rr}r(h$X] - instructs rsyslogd to replace LF with spaces during message reception (sysklogd compatibility aid). This is applied at the beginning of the parser stage and cannot be overridden (neither at the input nor parser level). Consequently, it affects all inputs and parsers.h%jubeubaubeubeubh!)r}r(h$Uh%h"h&h'h(h)h*}r(h,]h-]h.]h/]rhah1]rh auh3K~h4hh]r(h6)r}r(h$Xmain queue specific Directivesrh%jh&h'h(h:h*}r(h,]h-]h.]h/]h1]uh3K~h4hh]rh=Xmain queue specific Directivesrr}r(h$jh%jubaubhA)r}r(h$XNote that these directives modify ruleset main message queues. This includes the default ruleset's main message queue, the one that is always present. To do this, specify directives outside of a ruleset definition.rh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh4hh]rh=XNote that these directives modify ruleset main message queues. This includes the default ruleset's main message queue, the one that is always present. To do this, specify directives outside of a ruleset definition.rr}r(h$jh%jubaubhA)r}r(h$XVTo understand queue parameters, read :doc:`queues in rsyslog <../../concepts/queues>`.h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh4hh]r(h=X%To understand queue parameters, read rr}r(h$X%To understand queue parameters, read h%jubj@)r}r(h$X0:doc:`queues in rsyslog <../../concepts/queues>`r h%jh&h'h(jDh*}r (UreftypeXdocr jGjHX../../concepts/queuesU refdomainUh/]h.]U refexplicith,]h-]h1]jIhhuh3Kh]r h)r }r(h$j h*}r(h,]h-]r(jOj eh.]h/]h1]uh%jh]rh=Xqueues in rsyslogrr}r(h$Uh%j ubah(hubaubh=X.r}r(h$X.h%jubeubh)r}r(h$Uh%jh&h'h(hh*}r(hX-h/]h.]h,]h-]h1]uh3Kh4hh]r(h)r}r(h$X,**$MainMsgQueueCheckpointInterval** rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r }r!(h$jh%jh&h'h(hEh*}r"(h,]h-]h.]h/]h1]uh3Kh]r#(h)r$}r%(h$X#**$MainMsgQueueCheckpointInterval**h*}r&(h,]h-]h.]h/]h1]uh%j h]r'h=X$MainMsgQueueCheckpointIntervalr(r)}r*(h$Uh%j$ubah(hubh=X r+r,}r-(h$X h%j ubeubaubh)r.}r/(h$X7**$MainMsgQueueDequeueBatchSize** [default 32]r0h%jh&h'h(hh*}r1(h,]h-]h.]h/]h1]uh3Nh4hh]r2hA)r3}r4(h$j0h%j.h&h'h(hEh*}r5(h,]h-]h.]h/]h1]uh3Kh]r6(h)r7}r8(h$X!**$MainMsgQueueDequeueBatchSize**h*}r9(h,]h-]h.]h/]h1]uh%j3h]r:h=X$MainMsgQueueDequeueBatchSizer;r<}r=(h$Uh%j7ubah(hubh=X [default 32]r>r?}r@(h$X [default 32]h%j3ubeubaubh)rA}rB(h$X**$MainMsgQueueDequeueSlowdown** [number is timeout in *micro*\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h%jh&h'h(hh*}rC(h,]h-]h.]h/]h1]uh3Nh4hh]rDhA)rE}rF(h$X**$MainMsgQueueDequeueSlowdown** [number is timeout in *micro*\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h%jAh&h'h(hEh*}rG(h,]h-]h.]h/]h1]uh3Kh]rH(h)rI}rJ(h$X **$MainMsgQueueDequeueSlowdown**h*}rK(h,]h-]h.]h/]h1]uh%jEh]rLh=X$MainMsgQueueDequeueSlowdownrMrN}rO(h$Uh%jIubah(hubh=X [number is timeout in rPrQ}rR(h$X [number is timeout in h%jEubj4)rS}rT(h$X*micro*h*}rU(h,]h-]h.]h/]h1]uh%jEh]rVh=XmicrorWrX}rY(h$Uh%jSubah(j<ubh=XJseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]rZr[}r\(h$XL\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h%jEubeubaubh)r]}r^(h$X4**$MainMsgQueueDiscardMark** [default 9750]r_h%jh&h'h(hh*}r`(h,]h-]h.]h/]h1]uh3Nh4hh]rahA)rb}rc(h$j_h%j]h&h'h(hEh*}rd(h,]h-]h.]h/]h1]uh3Kh]re(h)rf}rg(h$X**$MainMsgQueueDiscardMark**h*}rh(h,]h-]h.]h/]h1]uh%jbh]rih=X$MainMsgQueueDiscardMarkrjrk}rl(h$Uh%jfubah(hubh=X [default 9750]rmrn}ro(h$X [default 9750]h%jbubeubaubh)rp}rq(h$Xi**$MainMsgQueueDiscardSeverity** [either a textual or numerical severity! default 4 (warning)]h%jh&h'h(hh*}rr(h,]h-]h.]h/]h1]uh3Nh4hh]rshA)rt}ru(h$Xi**$MainMsgQueueDiscardSeverity** [either a textual or numerical severity! default 4 (warning)]h%jph&h'h(hEh*}rv(h,]h-]h.]h/]h1]uh3Kh]rw(h)rx}ry(h$X **$MainMsgQueueDiscardSeverity**h*}rz(h,]h-]h.]h/]h1]uh%jth]r{h=X$MainMsgQueueDiscardSeverityr|r}}r~(h$Uh%jxubah(hubh=XI [either a textual or numerical severity! default 4 (warning)]rr}r(h$XI [either a textual or numerical severity! default 4 (warning)]h%jtubeubaubh)r}r(h$X **$MainMsgQueueFileName** rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X**$MainMsgQueueFileName**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueFileNamerr}r(h$Uh%jubah(hubh=X rr}r(h$X h%jubeubaubh)r}r(h$X6**$MainMsgQueueHighWaterMark** [default 8000]rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X**$MainMsgQueueHighWaterMark**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueHighWaterMarkrr}r(h$Uh%jubah(hubh=X [default 8000]rr}r(h$X [default 8000]h%jubeubaubh)r}r(h$X/**$MainMsgQueueImmediateShutdown** [on/**off**]rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X"**$MainMsgQueueImmediateShutdown**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueImmediateShutdownrr}r(h$Uh%jubah(hubh=X [on/rr}r(h$X [on/h%jubh)r}r(h$X**off**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=Xoffrr}r(h$Uh%jubah(hubh=X]r}r(h$X]h%jubeubaubh)r}r(h$X5**$MainMsgQueueLowWaterMark** [default 2000]rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X**$MainMsgQueueLowWaterMark**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueLowWaterMarkrr}r(h$Uh%jubah(hubh=X [default 2000]rr}r(h$X [default 2000]h%jubeubaubh)r}r(h$X4**$MainMsgQueueMaxFileSize** , default 1mrh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X**$MainMsgQueueMaxFileSize**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueMaxFileSizerr}r(h$Uh%jubah(hubh=X , default 1mrr}r(h$X , default 1mh%jubeubaubh)r}r(h$X**$MainMsgQueueTimeoutActionCompletion** [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X**$MainMsgQueueTimeoutActionCompletion** [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X(**$MainMsgQueueTimeoutActionCompletion**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$$MainMsgQueueTimeoutActionCompletionrr}r(h$Uh%jubah(hubh=XW [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]rr}r(h$XW [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h%jubeubaubh)r}r(h$X**$MainMsgQueueTimeoutEnqueue** [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$X**$MainMsgQueueTimeoutEnqueue** [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X**$MainMsgQueueTimeoutEnqueue**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueTimeoutEnqueuerr }r (h$Uh%jubah(hubh=X` [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]r r }r (h$X` [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h%jubeubaubh)r}r(h$Xm**$MainMsgQueueTimeoutShutdown** [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$Xm**$MainMsgQueueTimeoutShutdown** [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h%jh&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X **$MainMsgQueueTimeoutShutdown**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X$MainMsgQueueTimeoutShutdownrr}r(h$Uh%jubah(hubh=XM [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]rr}r(h$XM [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h%jubeubaubh)r }r!(h$X{**$MainMsgQueueWorkerTimeoutThreadShutdown** [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h%jh&h'h(hh*}r"(h,]h-]h.]h/]h1]uh3Nh4hh]r#hA)r$}r%(h$X{**$MainMsgQueueWorkerTimeoutThreadShutdown** [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h%j h&h'h(hEh*}r&(h,]h-]h.]h/]h1]uh3Kh]r'(h)r(}r)(h$X,**$MainMsgQueueWorkerTimeoutThreadShutdown**h*}r*(h,]h-]h.]h/]h1]uh%j$h]r+h=X($MainMsgQueueWorkerTimeoutThreadShutdownr,r-}r.(h$Uh%j(ubah(hubh=XO [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]r/r0}r1(h$XO [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h%j$ubeubaubh)r2}r3(h$X=**$MainMsgQueueType** [**FixedArray**/LinkedList/Direct/Disk]r4h%jh&h'h(hh*}r5(h,]h-]h.]h/]h1]uh3Nh4hh]r6hA)r7}r8(h$j4h%j2h&h'h(hEh*}r9(h,]h-]h.]h/]h1]uh3Kh]r:(h)r;}r<(h$X**$MainMsgQueueType**h*}r=(h,]h-]h.]h/]h1]uh%j7h]r>h=X$MainMsgQueueTyper?r@}rA(h$Uh%j;ubah(hubh=X [rBrC}rD(h$X [h%j7ubh)rE}rF(h$X**FixedArray**h*}rG(h,]h-]h.]h/]h1]uh%j7h]rHh=X FixedArrayrIrJ}rK(h$Uh%jEubah(hubh=X/LinkedList/Direct/Disk]rLrM}rN(h$X/LinkedList/Direct/Disk]h%j7ubeubaubh)rO}rP(h$X.**$MainMsgQueueSaveOnShutdown**  [on/**off**]rQh%jh&h'h(hh*}rR(h,]h-]h.]h/]h1]uh3Nh4hh]rShA)rT}rU(h$jQh%jOh&h'h(hEh*}rV(h,]h-]h.]h/]h1]uh3Kh]rW(h)rX}rY(h$X**$MainMsgQueueSaveOnShutdown**h*}rZ(h,]h-]h.]h/]h1]uh%jTh]r[h=X$MainMsgQueueSaveOnShutdownr\r]}r^(h$Uh%jXubah(hubh=X  [on/r_r`}ra(h$X  [on/h%jTubh)rb}rc(h$X**off**h*}rd(h,]h-]h.]h/]h1]uh%jTh]reh=Xoffrfrg}rh(h$Uh%jbubah(hubh=X]ri}rj(h$X]h%jTubeubaubh)rk}rl(h$XU**$MainMsgQueueWorkerThreads** , num worker threads, default 1, recommended 1h%jh&h'h(hh*}rm(h,]h-]h.]h/]h1]uh3Nh4hh]rnhA)ro}rp(h$XU**$MainMsgQueueWorkerThreads** , num worker threads, default 1, recommended 1h%jkh&h'h(hEh*}rq(h,]h-]h.]h/]h1]uh3Kh]rr(h)rs}rt(h$X**$MainMsgQueueWorkerThreads**h*}ru(h,]h-]h.]h/]h1]uh%joh]rvh=X$MainMsgQueueWorkerThreadsrwrx}ry(h$Uh%jsubah(hubh=X7 , num worker threads, default 1, recommended 1rzr{}r|(h$X7 , num worker threads, default 1, recommended 1h%joubeubaubh)r}}r~(h$XB**$MainMsgQueueWorkerThreadMinumumMessages** , default 100rh%jh&h'h(hh*}r(h,]h-]h.]h/]h1]uh3Nh4hh]rhA)r}r(h$jh%j}h&h'h(hEh*}r(h,]h-]h.]h/]h1]uh3Kh]r(h)r}r(h$X,**$MainMsgQueueWorkerThreadMinumumMessages**h*}r(h,]h-]h.]h/]h1]uh%jh]rh=X($MainMsgQueueWorkerThreadMinumumMessagesrr}r(h$Uh%jubah(hubh=X , default 100rr}r(h$X , default 100h%jubeubaubeubeubeubah$UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh4hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh:NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh'Ugettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hj_hhKhjuhjhjIhj3hhhh"uUsubstitution_namesr}rh(h4h*}r(h,]h/]h.]Usourceh'h-]h1]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/index_directives.doctree0000664000175000017500000001201313035122641022265 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXlegacy configuration directivesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUlegacy-configuration-directivesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXE/home/rger/proj/rsyslog-doc/source/configuration/index_directives.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXLegacy Configuration Directivesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XLegacy Configuration Directivesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXrAll legacy configuration directives need to be specified on a line by their own and must start with a dollar-sign.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/XrAll legacy configuration directives need to be specified on a line by their own and must start with a dollar-sign.q:q;}q<(hh6hh4ubaubh3)q=}q>(hXNote that legacy configuration directives that set object options (e.g. for inputs or actions) only affect those objects that are defined via legacy constructs. Objects defined via new-style RainerScript objects (e.g. action(), input()) are **not** affected by legacy directives. The reason is that otherwise we would again have the ability to mess up a configuration file with hard to understand constructs. This is avoided by not permitting to mix and match the way object values are set.hhhhhh7h}q?(h]h]h ]h!]h#]uh%Kh&hh]q@(h/XNote that legacy configuration directives that set object options (e.g. for inputs or actions) only affect those objects that are defined via legacy constructs. Objects defined via new-style RainerScript objects (e.g. action(), input()) are qAqB}qC(hXNote that legacy configuration directives that set object options (e.g. for inputs or actions) only affect those objects that are defined via legacy constructs. Objects defined via new-style RainerScript objects (e.g. action(), input()) are hh=ubcdocutils.nodes strong qD)qE}qF(hX**not**h}qG(h]h]h ]h!]h#]uhh=h]qHh/XnotqIqJ}qK(hUhhEubahUstrongqLubh/X affected by legacy directives. The reason is that otherwise we would again have the ability to mess up a configuration file with hard to understand constructs. This is avoided by not permitting to mix and match the way object values are set.qMqN}qO(hX affected by legacy directives. The reason is that otherwise we would again have the ability to mess up a configuration file with hard to understand constructs. This is avoided by not permitting to mix and match the way object values are set.hh=ubeubcdocutils.nodes compound qP)qQ}qR(hUhhhhhUcompoundqSh}qT(h]h]qUUtoctree-wrapperqVah ]h!]h#]uh%Nh&hh]qWcsphinx.addnodes toctree qX)qY}qZ(hUhhQhhhUtoctreeq[h}q\(Unumberedq]KU includehiddenq^hXconfiguration/index_directivesq_Ucaptionq`NUglobqah!]h ]U titlesonlyqbh]h]h#]Uentriesqc]qd(NX configuration/config_param_typesqeqfNXconfiguration/global/indexqgqhNX$configuration/input_directives/indexqiqjNXconfiguration/action/indexqkqlNXconfiguration/ruleset/indexqmqneUhiddenqoU includefilesqp]qq(hehghihkhmeUmaxdepthqrKuh%Kh]ubaubeubahUU transformerqsNU footnote_refsqt}quUrefnamesqv}qwUsymbol_footnotesqx]qyUautofootnote_refsqz]q{Usymbol_footnote_refsq|]q}U citationsq~]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqĉU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformq̉Ustrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqψU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/configuration/actions.doctree0000664000175000017500000031030713035122641020404 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X4rsyslog execonlywhenpreviousisspuspended precisenessqXgeneral action parametersqNXactionsqNXeveryone logged onq NXrsyslogq Xlegacy descriptionq NX regular fileq NXterminal and consoleq NX monitorwareqX legacy formatqNX list of usersqNXrainer gerhardsqX$main and action queue worker threadsqXoutput channelqNX useful linksqNX call pluginqNX template nameqNXremote machineqNX named pipesqNX cfgobj_inputqX winsyslogqXlegacy-action-orderqXadisconqXdiscardqNX shell executeqNXdatabase tableqNuUsubstitution_defsq }q!Uparse_messagesq"]q#Ucurrent_sourceq$NU decorationq%NUautofootnote_startq&KUnameidsq'}q((hU4rsyslog-execonlywhenpreviousisspuspended-precisenessq)hUgeneral-action-parametersq*hUactionsq+h Ueveryone-logged-onq,h Ursyslogq-h Ulegacy-descriptionq.h U regular-fileq/h Uterminal-and-consoleq0hU monitorwareq1hU legacy-formatq2hU list-of-usersq3hUrainer-gerhardsq4hU$main-and-action-queue-worker-threadsq5hUoutput-channelq6hU useful-linksq7hU call-pluginq8hU template-nameq9hUremote-machineq:hU named-pipesq;hU cfgobj-inputqhUadisconq?hUdiscardq@hU shell-executeqAhUdatabase-tableqBuUchildrenqC]qDcdocutils.nodes section qE)qF}qG(U rawsourceqHUUparentqIhUsourceqJX</home/rger/proj/rsyslog-doc/source/configuration/actions.rstqKUtagnameqLUsectionqMU attributesqN}qO(UdupnamesqP]UclassesqQ]UbackrefsqR]UidsqS]qTh+aUnamesqU]qVhauUlineqWKUdocumentqXhhC]qY(cdocutils.nodes title qZ)q[}q\(hHXActionsq]hIhFhJhKhLUtitleq^hN}q_(hP]hQ]hR]hS]hU]uhWKhXhhC]q`cdocutils.nodes Text qaXActionsqbqc}qd(hHh]hIh[ubaubcsphinx.addnodes index qe)qf}qg(hHUhIhFhJhKhLUindexqhhN}qi(hS]hR]hP]hQ]hU]Uentriesqj]qk(UsingleqlXactionUindex-0qmUmainqntqoaUinlineqpuhWKhXhhC]ubcdocutils.nodes target qq)qr}qs(hHUhIhFhJhKhLUtargetqthN}qu(hS]hR]hP]hQ]hU]UrefidqvhmuhWKhXhhC]ubhq)qw}qx(hHX.. _cfgobj_input:hIhFhJhKUexpect_referenced_by_nameqy}hLhthN}qz(hS]hR]hP]hQ]hU]hvh`.hIhFhJhKhy}qhhwshLU paragraphqhN}q(hP]hQ]hR]hS]q(h`qhIh~hJhKhLU pending_xrefqhN}q(UreftypeXdocqUrefwarnqU reftargetqXmodules/idx_outputU refdomainUhS]hR]U refexplicithP]hQ]hU]UrefdocqXconfiguration/actionsquhWKhC]qcdocutils.nodes literal q)q}q(hHhhN}q(hP]hQ]q(UxrefqhehR]hS]hU]uhIhhC]qhaXoutput modulesqq}q(hHUhIhubahLUliteralqubaubhaX.q}q(hHX.hIh~ubeubh})q}q(hHX+The action object has different parameters:qhIhFhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWK hXhhC]qhaX+The action object has different parameters:qq}q(hHhhIhubaubcdocutils.nodes bullet_list q)q}q(hHUhIhFhJhKhLU bullet_listqhN}q(UbulletqX-hS]hR]hP]hQ]hU]uhWK hXhhC]q(cdocutils.nodes list_item q)q}q(hHXTthose that apply to all actions and are action specific. These are documented below.hIhhJhKhLU list_itemqhN}q(hP]hQ]hR]hS]hU]uhWNhXhhC]qh})q}q(hHXTthose that apply to all actions and are action specific. These are documented below.qhIhhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWK hC]qhaXTthose that apply to all actions and are action specific. These are documented below.qq}q(hHhhIhubaubaubh)q}q(hHXparameters for the action queue. While they also apply to all parameters, they are queue-specific, not action-specific (they are the same that are used in rulesets, for example). The are documented separately under :doc:`queue parameters <../rainerscript/queue_parameters>`.hIhhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWNhXhhC]qh})q}q(hHXparameters for the action queue. While they also apply to all parameters, they are queue-specific, not action-specific (they are the same that are used in rulesets, for example). The are documented separately under :doc:`queue parameters <../rainerscript/queue_parameters>`.hIhhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWKhC]q(haXparameters for the action queue. While they also apply to all parameters, they are queue-specific, not action-specific (they are the same that are used in rulesets, for example). The are documented separately under qȅq}q(hHXparameters for the action queue. While they also apply to all parameters, they are queue-specific, not action-specific (they are the same that are used in rulesets, for example). The are documented separately under hIhubh)q}q(hHX::doc:`queue parameters <../rainerscript/queue_parameters>`qhIhhJhKhLhhN}q(UreftypeXdocqhhX ../rainerscript/queue_parametersU refdomainUhS]hR]U refexplicithP]hQ]hU]hhuhWKhC]qh)q}q(hHhhN}q(hP]hQ]q(hhehR]hS]hU]uhIhhC]qhaXqueue parametersqօq}q(hHUhIhubahLhubaubhaX.q}q(hHX.hIhubeubaubh)q}q(hHXaction-specific parameters. These are specific to a certain type of actions. They are documented by the :doc:`output modules` in question. hIhhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWNhXhhC]qh})q}q(hHXaction-specific parameters. These are specific to a certain type of actions. They are documented by the :doc:`output modules` in question.hIhhJhKhLhhN}q(hP]hQ]hR]hS]hU]uhWKhC]q(haXhaction-specific parameters. These are specific to a certain type of actions. They are documented by the qㅁq}q(hHXhaction-specific parameters. These are specific to a certain type of actions. They are documented by the hIhubh)q}q(hHX):doc:`output modules`qhIhhJhKhLhhN}q(UreftypeXdocqhhXmodules/idx_outputU refdomainUhS]hR]U refexplicithP]hQ]hU]hhuhWKhC]qh)q}q(hHhhN}q(hP]hQ]q(hhehR]hS]hU]uhIhhC]qhaXoutput modulesqq}q(hHUhIhubahLhubaubhaX in question.qq}q(hHX in question.hIhubeubaubeubhE)q}q(hHUhIhFhJhKhLhMhN}q(hP]hQ]hR]hS]qh*ahU]qhauhWKhXhhC]q(hZ)q}q(hHXGeneral Action ParametersqhIhhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXGeneral Action Parametersrr}r(hHhhIhubaubh)r}r(hHUhIhhJhKhLhhN}r(hX-hS]hR]hP]hQ]hU]uhWKhXhhC]r(h)r }r (hHX **name** word This names the action. The name is used for statistics gathering and documentation. If no name is given, one is dynamically generated based on the occurence of this action inside the rsyslog configuration. Actions are sequentially numbered from 1 to n. hIjhJhKhLhhN}r (hP]hQ]hR]hS]hU]uhWNhXhhC]r (h})r }r(hHX **name** wordhIj hJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhC]r(cdocutils.nodes strong r)r}r(hHX**name**hN}r(hP]hQ]hR]hS]hU]uhIj hC]rhaXnamerr}r(hHUhIjubahLUstrongrubhaX wordrr}r(hHX wordhIj ubeubh})r}r(hHXThis names the action. The name is used for statistics gathering and documentation. If no name is given, one is dynamically generated based on the occurence of this action inside the rsyslog configuration. Actions are sequentially numbered from 1 to n.rhIj hJhKhLhhN}r (hP]hQ]hR]hS]hU]uhWKhC]r!haXThis names the action. The name is used for statistics gathering and documentation. If no name is given, one is dynamically generated based on the occurence of this action inside the rsyslog configuration. Actions are sequentially numbered from 1 to n.r"r#}r$(hHjhIjubaubeubh)r%}r&(hHXa**type** string Mandatory parameter for every action. The name of the module that should be used.hIjhJhKhLhhN}r'(hP]hQ]hR]hS]hU]uhWNhXhhC]r(h})r)}r*(hHXa**type** string Mandatory parameter for every action. The name of the module that should be used.hIj%hJhKhLhhN}r+(hP]hQ]hR]hS]hU]uhWK hC]r,(j)r-}r.(hHX**type**hN}r/(hP]hQ]hR]hS]hU]uhIj)hC]r0haXtyper1r2}r3(hHUhIj-ubahLjubhaXY string Mandatory parameter for every action. The name of the module that should be used.r4r5}r6(hHXY string Mandatory parameter for every action. The name of the module that should be used.hIj)ubeubaubh)r7}r8(hHX**action.writeAllMarkMessages** *on*/off This setting tells if mark messages are always written ("on", the default) or only if the action was not recently executed ("off"). By default, recently means within the past 20 minutes. If this setting is "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. This mode also enables faster processing inside the rule engine. So it should be set to "off" only when there is a good reason to do so.hIjhJhKhLhhN}r9(hP]hQ]hR]hS]hU]uhWNhXhhC]r:h})r;}r<(hHX**action.writeAllMarkMessages** *on*/off This setting tells if mark messages are always written ("on", the default) or only if the action was not recently executed ("off"). By default, recently means within the past 20 minutes. If this setting is "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. This mode also enables faster processing inside the rule engine. So it should be set to "off" only when there is a good reason to do so.hIj7hJhKhLhhN}r=(hP]hQ]hR]hS]hU]uhWK#hC]r>(j)r?}r@(hHX**action.writeAllMarkMessages**hN}rA(hP]hQ]hR]hS]hU]uhIj;hC]rBhaXaction.writeAllMarkMessagesrCrD}rE(hHUhIj?ubahLjubhaX rF}rG(hHX hIj;ubcdocutils.nodes emphasis rH)rI}rJ(hHX*on*hN}rK(hP]hQ]hR]hS]hU]uhIj;hC]rLhaXonrMrN}rO(hHUhIjIubahLUemphasisrPubhaX/off This setting tells if mark messages are always written ("on", the default) or only if the action was not recently executed ("off"). By default, recently means within the past 20 minutes. If this setting is "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. This mode also enables faster processing inside the rule engine. So it should be set to "off" only when there is a good reason to do so.rQrR}rS(hHX/off This setting tells if mark messages are always written ("on", the default) or only if the action was not recently executed ("off"). By default, recently means within the past 20 minutes. If this setting is "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. This mode also enables faster processing inside the rule engine. So it should be set to "off" only when there is a good reason to do so.hIj;ubeubaubh)rT}rU(hHXT**action.execOnlyEveryNthTime** integer If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on.hIjhJhKhLhhN}rV(hP]hQ]hR]hS]hU]uhWNhXhhC]rWh})rX}rY(hHXT**action.execOnlyEveryNthTime** integer If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on.hIjThJhKhLhhN}rZ(hP]hQ]hR]hS]hU]uhWK,hC]r[(j)r\}r](hHX**action.execOnlyEveryNthTime**hN}r^(hP]hQ]hR]hS]hU]uhIjXhC]r_haXaction.execOnlyEveryNthTimer`ra}rb(hHUhIj\ubahLjubhaX5 integer If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on.rcrd}re(hHX5 integer If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on.hIjXubeubaubh)rf}rg(hHX**action.execOnlyEveryNthTimeout** integer Has a meaning only if Action.ExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. Why is this option needed? Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a Action.ExecOnlyEveryNthTimeTimeout="1200" This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.hIjhJhKhLhhN}rh(hP]hQ]hR]hS]hU]uhWNhXhhC]rih})rj}rk(hHX**action.execOnlyEveryNthTimeout** integer Has a meaning only if Action.ExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. Why is this option needed? Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a Action.ExecOnlyEveryNthTimeTimeout="1200" This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.hIjfhJhKhLhhN}rl(hP]hQ]hR]hS]hU]uhWK2hC]rm(j)rn}ro(hHX"**action.execOnlyEveryNthTimeout**hN}rp(hP]hQ]hR]hS]hU]uhIjjhC]rqhaXaction.execOnlyEveryNthTimeoutrrrs}rt(hHUhIjnubahLjubhaX integer Has a meaning only if Action.ExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. Why is this option needed? Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a Action.ExecOnlyEveryNthTimeTimeout="1200" This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.rurv}rw(hHX integer Has a meaning only if Action.ExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. Why is this option needed? Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a Action.ExecOnlyEveryNthTimeTimeout="1200" This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.hIjjubeubaubh)rx}ry(hHX**action.execOnlyOnceEveryInterval** integer Execute action only if the last execute is at last seconds in the past (more info in ommail, but may be used with any action)hIjhJhKhLhhN}rz(hP]hQ]hR]hS]hU]uhWNhXhhC]r{h})r|}r}(hHX**action.execOnlyOnceEveryInterval** integer Execute action only if the last execute is at last seconds in the past (more info in ommail, but may be used with any action)hIjxhJhKhLhhN}r~(hP]hQ]hR]hS]hU]uhWKBhC]r(j)r}r(hHX$**action.execOnlyOnceEveryInterval**hN}r(hP]hQ]hR]hS]hU]uhIj|hC]rhaX action.execOnlyOnceEveryIntervalrr}r(hHUhIjubahLjubhaX integer Execute action only if the last execute is at last seconds in the past (more info in ommail, but may be used with any action)rr}r(hHX integer Execute action only if the last execute is at last seconds in the past (more info in ommail, but may be used with any action)hIj|ubeubaubh)r}r(hHX**action.execOnlyWhenPreviousIsSuspended** on/off This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder). Note, however, that a failed action may not immediately be detected. For more information, see the `rsyslog execOnlyWhenPreviousIsSpuspended preciseness `_ FAQ article.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX**action.execOnlyWhenPreviousIsSuspended** on/off This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder). Note, however, that a failed action may not immediately be detected. For more information, see the `rsyslog execOnlyWhenPreviousIsSpuspended preciseness `_ FAQ article.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKEhC]r(j)r}r(hHX***action.execOnlyWhenPreviousIsSuspended**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX&action.execOnlyWhenPreviousIsSuspendedrr}r(hHUhIjubahLjubhaX on/off This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder). Note, however, that a failed action may not immediately be detected. For more information, see the rr}r(hHX on/off This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder). Note, however, that a failed action may not immediately be detected. For more information, see the hIjubcdocutils.nodes reference r)r}r(hHX`rsyslog execOnlyWhenPreviousIsSpuspended preciseness `_hN}r(UnameX4rsyslog execOnlyWhenPreviousIsSpuspended precisenessUrefurirXJhttp://www.rsyslog.com/action-execonlywhenpreviousissuspended-preciseness/rhS]hR]hP]hQ]hU]uhIjhC]rhaX4rsyslog execOnlyWhenPreviousIsSpuspended precisenessrr}r(hHUhIjubahLU referencerubhq)r}r(hHXM U referencedrKhIjhLhthN}r(UrefurijhS]rh)ahR]hP]hQ]hU]rhauhC]ubhaX FAQ article.rr}r(hHX FAQ article.hIjubeubaubh)r}r(hHX**action.repeatedmsgcontainsoriginalmsg** on/off "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5).hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX**action.repeatedmsgcontainsoriginalmsg** on/off "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5).hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKThC]r(j)r}r(hHX)**action.repeatedmsgcontainsoriginalmsg**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX%action.repeatedmsgcontainsoriginalmsgrr}r(hHUhIjubahLjubhaX on/off "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5).rr}r(hHX on/off "last message repeated n times" messages, if generated, have a different format that contains the message that is being repeated. Note that only the first "n" characters are included, with n to be at least 80 characters, most probably more (this may change from version to version, thus no specific limit is given). The bottom line is that n is large enough to get a good idea which message was repeated but it is not necessarily large enough for the whole message. (Introduced with 4.1.5).hIjubeubaubh)r}r(hHXA**action.resumeRetryCount** integer [default 0, -1 means eternal]hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHXA**action.resumeRetryCount** integer [default 0, -1 means eternal]hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWK]hC]r(j)r}r(hHX**action.resumeRetryCount**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXaction.resumeRetryCountrr}r(hHUhIjubahLjubhaX& integer [default 0, -1 means eternal]rr}r(hHX& integer [default 0, -1 means eternal]hIjubeubaubh)r}r(hHX**action.resumeInterval** integer Sets the ActionResumeInterval for the action. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended). When an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) \* Action.ResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX**action.resumeInterval** integer Sets the ActionResumeInterval for the action. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended). When an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) \* Action.ResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWK_hC]r(j)r}r(hHX**action.resumeInterval**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXaction.resumeIntervalrr}r(hHUhIjubahLjubhaX integer Sets the ActionResumeInterval for the action. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended). When an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) * Action.ResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.rr}r(hHX integer Sets the ActionResumeInterval for the action. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended). When an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) \* Action.ResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.hIjubeubaubh)r}r(hHX**action.reportSuspension** on/off Configures rsyslog to report suspension and reactivation of the action. This is useful to note which actions have problems (e.g. connecting to a remote system) and when. The default for this setting is the equally-named global parameter.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX**action.reportSuspension** on/off Configures rsyslog to report suspension and reactivation of the action. This is useful to note which actions have problems (e.g. connecting to a remote system) and when. The default for this setting is the equally-named global parameter.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKkhC]r(j)r}r(hHX**action.reportSuspension**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXaction.reportSuspensionrr}r(hHUhIjubahLjubhaX on/off Configures rsyslog to report suspension and reactivation of the action. This is useful to note which actions have problems (e.g. connecting to a remote system) and when. The default for this setting is the equally-named global parameter.rr}r(hHX on/off Configures rsyslog to report suspension and reactivation of the action. This is useful to note which actions have problems (e.g. connecting to a remote system) and when. The default for this setting is the equally-named global parameter.hIjubeubaubh)r}r(hHXS**action.reportSuspensionContinuation** on/off Configures rsyslog to report continuation of action suspension. This emits new messages whenever an action is to be retried, but continues to fail. If set to "on", *action.reportSuspension* is also automatically set to "on". The default for this setting is the equally-named global parameter.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHXS**action.reportSuspensionContinuation** on/off Configures rsyslog to report continuation of action suspension. This emits new messages whenever an action is to be retried, but continues to fail. If set to "on", *action.reportSuspension* is also automatically set to "on". The default for this setting is the equally-named global parameter.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKqhC]r(j)r}r(hHX'**action.reportSuspensionContinuation**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX#action.reportSuspensionContinuationrr}r(hHUhIjubahLjubhaX on/off Configures rsyslog to report continuation of action suspension. This emits new messages whenever an action is to be retried, but continues to fail. If set to "on", rr}r (hHX on/off Configures rsyslog to report continuation of action suspension. This emits new messages whenever an action is to be retried, but continues to fail. If set to "on", hIjubjH)r }r (hHX*action.reportSuspension*hN}r (hP]hQ]hR]hS]hU]uhIjhC]r haXaction.reportSuspensionrr}r(hHUhIj ubahLjPubhaXg is also automatically set to "on". The default for this setting is the equally-named global parameter.rr}r(hHXg is also automatically set to "on". The default for this setting is the equally-named global parameter.hIjubeubaubh)r}r(hHX**action.copyMsg** on/*off* Configures action to *copy* the message if *on*. Defaults to *off* (which is how actions have worked traditionally), which causes queue to refer to the original message object, with reference-counting. (Introduced with 8.10.0). hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX**action.copyMsg** on/*off* Configures action to *copy* the message if *on*. Defaults to *off* (which is how actions have worked traditionally), which causes queue to refer to the original message object, with reference-counting. (Introduced with 8.10.0).hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKxhC]r(j)r}r(hHX**action.copyMsg**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXaction.copyMsgr r!}r"(hHUhIjubahLjubhaX on/r#r$}r%(hHX on/hIjubjH)r&}r'(hHX*off*hN}r((hP]hQ]hR]hS]hU]uhIjhC]r)haXoffr*r+}r,(hHUhIj&ubahLjPubhaX Configures action to r-r.}r/(hHX Configures action to hIjubjH)r0}r1(hHX*copy*hN}r2(hP]hQ]hR]hS]hU]uhIjhC]r3haXcopyr4r5}r6(hHUhIj0ubahLjPubhaX the message if r7r8}r9(hHX the message if hIjubjH)r:}r;(hHX*on*hN}r<(hP]hQ]hR]hS]hU]uhIjhC]r=haXonr>r?}r@(hHUhIj:ubahLjPubhaX. Defaults to rArB}rC(hHX. Defaults to hIjubjH)rD}rE(hHX*off*hN}rF(hP]hQ]hR]hS]hU]uhIjhC]rGhaXoffrHrI}rJ(hHUhIjDubahLjPubhaX (which is how actions have worked traditionally), which causes queue to refer to the original message object, with reference-counting. (Introduced with 8.10.0).rKrL}rM(hHX (which is how actions have worked traditionally), which causes queue to refer to the original message object, with reference-counting. (Introduced with 8.10.0).hIjubeubaubeubeubhE)rN}rO(hHUhIhFhJhKhLhMhN}rP(hP]hQ]hR]hS]rQh7ahU]rRhauhWKhXhhC]rS(hZ)rT}rU(hHX Useful LinksrVhIjNhJhKhLh^hN}rW(hP]hQ]hR]hS]hU]uhWKhXhhC]rXhaX Useful LinksrYrZ}r[(hHjVhIjTubaubh)r\}r](hHUhIjNhJhKhLhhN}r^(hX-hS]hR]hP]hQ]hU]uhWKhXhhC]r_h)r`}ra(hHXRainer's blog posting on the performance of `main and action queue worker threads `_ hIj\hJhKhLhhN}rb(hP]hQ]hR]hS]hU]uhWNhXhhC]rch})rd}re(hHXRainer's blog posting on the performance of `main and action queue worker threads `_hIj`hJhKhLhhN}rf(hP]hQ]hR]hS]hU]uhWKhC]rg(haX,Rainer's blog posting on the performance of rhri}rj(hHX,Rainer's blog posting on the performance of hIjdubj)rk}rl(hHXs`main and action queue worker threads `_hN}rm(UnameX$main and action queue worker threadsjXIhttp://blog.gerhards.net/2013/06/rsyslog-performance-main-and-action.htmlrnhS]hR]hP]hQ]hU]uhIjdhC]rohaX$main and action queue worker threadsrprq}rr(hHUhIjkubahLjubhq)rs}rt(hHXL jKhIjdhLhthN}ru(UrefurijnhS]rvh5ahR]hP]hQ]hU]rwhauhC]ubeubaubaubeubhE)rx}ry(hHUhIhFhJhKhLhMhN}rz(hP]hQ]hR]hS]r{h2ahU]r|hauhWKhXhhC]r}(hZ)r~}r(hHX Legacy FormatrhIjxhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaX Legacy Formatrr}r(hHjhIj~ubaubhq)r}r(hHX.. _legacy-action-order:hIjxhJhKhLhthN}r(hS]hR]hP]hQ]hU]hvh>uhWKhXhhC]ubh})r}r(hHXP**Be warned that legacy action format is hard to get right. It is recommended to use RainerScript-Style action format whenever possible!** A key problem with legacy format is that a single action is defined via multiple configurations lines, which may be spread all across rsyslog.conf. Even the definition of multiple actions may be intermixed (often not intentional!). If legacy actions format needs to be used (e.g. some modules may not yet implement the RainerScript format), it is strongly recommended to place all configuration statements pertaining to a single action closely together.hIjxhJhKhy}rhjshLhhN}r(hP]hQ]hR]hS]rh>ahU]rhauhWKhXhh{}rh>jshC]r(j)r}r(hHX**Be warned that legacy action format is hard to get right. It is recommended to use RainerScript-Style action format whenever possible!**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXBe warned that legacy action format is hard to get right. It is recommended to use RainerScript-Style action format whenever possible!rr}r(hHUhIjubahLjubhaX A key problem with legacy format is that a single action is defined via multiple configurations lines, which may be spread all across rsyslog.conf. Even the definition of multiple actions may be intermixed (often not intentional!). If legacy actions format needs to be used (e.g. some modules may not yet implement the RainerScript format), it is strongly recommended to place all configuration statements pertaining to a single action closely together.rr}r(hHX A key problem with legacy format is that a single action is defined via multiple configurations lines, which may be spread all across rsyslog.conf. Even the definition of multiple actions may be intermixed (often not intentional!). If legacy actions format needs to be used (e.g. some modules may not yet implement the RainerScript format), it is strongly recommended to place all configuration statements pertaining to a single action closely together.hIjubeubh})r}r(hHX{Please also note that legacy action parameters **do not** affect RainerScript action objects. So if you define for example:hIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]r(haX/Please also note that legacy action parameters rr}r(hHX/Please also note that legacy action parameters hIjubj)r}r(hHX **do not**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXdo notrr}r(hHUhIjubahLjubhaXB affect RainerScript action objects. So if you define for example:rr}r(hHXB affect RainerScript action objects. So if you define for example:hIjubeubcdocutils.nodes literal_block r)r}r(hHXb$actionResumeRetryCount 10 action(type="omfwd" target="server1.example.net") @@server2.example.nethIjxhJhKhLU literal_blockrhN}r(U xml:spacerUpreserverhS]hR]hP]hQ]hU]uhWKhXhhC]rhaXb$actionResumeRetryCount 10 action(type="omfwd" target="server1.example.net") @@server2.example.netrr}r(hHUhIjubaubh})r}r(hHXSserver1's "action.resumeRetryCount" parameter is **not** set, instead server2's is!hIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]r(haX1server1's "action.resumeRetryCount" parameter is rr}r(hHX1server1's "action.resumeRetryCount" parameter is hIjubj)r}r(hHX**not**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXnotrr}r(hHUhIjubahLjubhaX set, instead server2's is!rr}r(hHX set, instead server2's is!hIjubeubh})r}r(hHXA goal of the new RainerScript action format was to avoid confusion which parameters are actually used. As such, it would be counter-productive to honor legacy action parameters inside a RainerScript definition. As result, both types of action definitions are strictly (and nicely) separated from each other. The bottom line is that if RainerScript actions are used, one does not need to care about which legacy action parameters may (still...) be in effect.rhIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXA goal of the new RainerScript action format was to avoid confusion which parameters are actually used. As such, it would be counter-productive to honor legacy action parameters inside a RainerScript definition. As result, both types of action definitions are strictly (and nicely) separated from each other. The bottom line is that if RainerScript actions are used, one does not need to care about which legacy action parameters may (still...) be in effect.rr}r(hHjhIjubaubh})r}r(hHXNote that not all modules necessarily support legacy action format. Especially newer modules are recommended to NOT support it.rhIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXNote that not all modules necessarily support legacy action format. Especially newer modules are recommended to NOT support it.rr}r(hHjhIjubaubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh.ahU]rh auhWKhXhhC]r(hZ)r}r(hHXLegacy DescriptionrhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXLegacy Descriptionrr}r(hHjhIjubaubh})r}r(hHXITemplates can be used with many actions. If used, the specified template is used to generate the message content (instead of the default template). To specify a template, write a semicolon after the action value immediately followed by the template name. Beware: templates MUST be defined BEFORE they are used. It is OK to define some templates, then use them in selector lines, define more templates and use use them in the following selector lines. But it is NOT permitted to use a template in a selector line that is above its definition. If you do this, the action will be ignored.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXITemplates can be used with many actions. If used, the specified template is used to generate the message content (instead of the default template). To specify a template, write a semicolon after the action value immediately followed by the template name. Beware: templates MUST be defined BEFORE they are used. It is OK to define some templates, then use them in selector lines, define more templates and use use them in the following selector lines. But it is NOT permitted to use a template in a selector line that is above its definition. If you do this, the action will be ignored.rr}r(hHjhIjubaubh})r}r(hHX**You can have multiple actions for a single selector** (or more precisely a single filter of such a selector line). Each action must be on its own line and the line must start with an ampersand ('&') character and have no filters. An example would behIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]r(j)r}r(hHX7**You can have multiple actions for a single selector**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX3You can have multiple actions for a single selectorrr}r(hHUhIjubahLjubhaX (or more precisely a single filter of such a selector line). Each action must be on its own line and the line must start with an ampersand ('&') character and have no filters. An example would berr}r(hHX (or more precisely a single filter of such a selector line). Each action must be on its own line and the line must start with an ampersand ('&') character and have no filters. An example would behIjubeubj)r}r(hHX1*.=crit :omusrmsg:rger & root & /var/log/critmsgshIjhJhKhLjhN}r(jjhS]hR]hP]hQ]hU]uhWKhXhhC]rhaX1*.=crit :omusrmsg:rger & root & /var/log/critmsgsrr}r(hHUhIjubaubh})r}r(hHXqThese three lines send critical messages to the user rger and root and also store them in /var/log/critmsgs. **Using multiple actions per selector is** convenient and also **offers a performance benefit**. As the filter needs to be evaluated only once, there is less computation required to process the directive compared to the otherwise-equal config directives below:hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]r(haXmThese three lines send critical messages to the user rger and root and also store them in /var/log/critmsgs. rr}r (hHXmThese three lines send critical messages to the user rger and root and also store them in /var/log/critmsgs. hIjubj)r }r (hHX***Using multiple actions per selector is**hN}r (hP]hQ]hR]hS]hU]uhIjhC]r haX&Using multiple actions per selector isrr}r(hHUhIj ubahLjubhaX convenient and also rr}r(hHX convenient and also hIjubj)r}r(hHX **offers a performance benefit**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXoffers a performance benefitrr}r(hHUhIjubahLjubhaX. As the filter needs to be evaluated only once, there is less computation required to process the directive compared to the otherwise-equal config directives below:rr}r(hHX. As the filter needs to be evaluated only once, there is less computation required to process the directive compared to the otherwise-equal config directives below:hIjubeubj)r}r(hHX=*.=crit :omusrmsg:rger *.=crit root *.=crit /var/log/critmsgshIjhJhKhLjhN}r (jjhS]hR]hP]hQ]hU]uhWKhXhhC]r!haX=*.=crit :omusrmsg:rger *.=crit root *.=crit /var/log/critmsgsr"r#}r$(hHUhIjubaubeubhE)r%}r&(hHUhIjxhJhKhLhMhN}r'(hP]hQ]hR]hS]r(h/ahU]r)h auhWKhXhhC]r*(hZ)r+}r,(hHX Regular Filer-hIj%hJhKhLh^hN}r.(hP]hQ]hR]hS]hU]uhWKhXhhC]r/haX Regular Filer0r1}r2(hHj-hIj+ubaubh})r3}r4(hHXTypically messages are logged to real files. The file usually is specified by full pathname, beginning with a slash "/". Starting with version 4.6.2 and 5.4.1 (previous v5 version do NOT support this) relative file names can also be specified. To do so, these must begin with a dot. For example, use "./file-in-current-dir.log" to specify a file in the current directory. Please note that rsyslogd usually changes its working directory to the root, so relative file names must be tested with care (they were introduced primarily as a debugging vehicle, but may have useful other applications as well). You may prefix each entry with the minus "-'' sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless this might give you back some performance, especially if you run programs that use logging in a very verbose manner.r5hIj%hJhKhLhhN}r6(hP]hQ]hR]hS]hU]uhWKhXhhC]r7haXTypically messages are logged to real files. The file usually is specified by full pathname, beginning with a slash "/". Starting with version 4.6.2 and 5.4.1 (previous v5 version do NOT support this) relative file names can also be specified. To do so, these must begin with a dot. For example, use "./file-in-current-dir.log" to specify a file in the current directory. Please note that rsyslogd usually changes its working directory to the root, so relative file names must be tested with care (they were introduced primarily as a debugging vehicle, but may have useful other applications as well). You may prefix each entry with the minus "-'' sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless this might give you back some performance, especially if you run programs that use logging in a very verbose manner.r8r9}r:(hHj5hIj3ubaubh})r;}r<(hHXIf your system is connected to a reliable UPS and you receive lots of log data (e.g. firewall logs), it might be a very good idea to turn of syncing by specifying the "-" in front of the file name.r=hIj%hJhKhLhhN}r>(hP]hQ]hR]hS]hU]uhWKhXhhC]r?haXIf your system is connected to a reliable UPS and you receive lots of log data (e.g. firewall logs), it might be a very good idea to turn of syncing by specifying the "-" in front of the file name.r@rA}rB(hHj=hIj;ubaubh})rC}rD(hHX**The filename can be either static**\ (always the same) or **dynamic** (different based on message received). The later is useful if you would automatically split messages into different files based on some message criteria. For example, dynamic file name selectors allow you to split messages into different files based on the host that sent them. With dynamic file names, everything is automatic and you do not need any filters.hIj%hJhKhLhhN}rE(hP]hQ]hR]hS]hU]uhWKhXhhC]rF(j)rG}rH(hHX%**The filename can be either static**hN}rI(hP]hQ]hR]hS]hU]uhIjChC]rJhaX!The filename can be either staticrKrL}rM(hHUhIjGubahLjubhaX(always the same) or rNrO}rP(hHX\ (always the same) or hIjCubj)rQ}rR(hHX **dynamic**hN}rS(hP]hQ]hR]hS]hU]uhIjChC]rThaXdynamicrUrV}rW(hHUhIjQubahLjubhaXh (different based on message received). The later is useful if you would automatically split messages into different files based on some message criteria. For example, dynamic file name selectors allow you to split messages into different files based on the host that sent them. With dynamic file names, everything is automatic and you do not need any filters.rXrY}rZ(hHXh (different based on message received). The later is useful if you would automatically split messages into different files based on some message criteria. For example, dynamic file name selectors allow you to split messages into different files based on the host that sent them. With dynamic file names, everything is automatic and you do not need any filters.hIjCubeubh})r[}r\(hHXIt works via the template system. First, you define a template for the file name. An example can be seen above in the description of template. We will use the "DynFile" template defined there. Dynamic filenames are indicated by specifying a questions mark "?" instead of a slash, followed by the template name. Thus, the selector line for our dynamic file name would look as follows:r]hIj%hJhKhLhhN}r^(hP]hQ]hR]hS]hU]uhWKhXhhC]r_haXIt works via the template system. First, you define a template for the file name. An example can be seen above in the description of template. We will use the "DynFile" template defined there. Dynamic filenames are indicated by specifying a questions mark "?" instead of a slash, followed by the template name. Thus, the selector line for our dynamic file name would look as follows:r`ra}rb(hHj]hIj[ubaubcdocutils.nodes block_quote rc)rd}re(hHUhIj%hJhKhLU block_quoterfhN}rg(hP]hQ]hR]hS]hU]uhWNhXhhC]rhh})ri}rj(hHX``*.* ?DynFile``rkhIjdhJhKhLhhN}rl(hP]hQ]hR]hS]hU]uhWKhC]rmh)rn}ro(hHjkhN}rp(hP]hQ]hR]hS]hU]uhIjihC]rqhaX *.* ?DynFilerrrs}rt(hHUhIjnubahLhubaubaubh})ru}rv(hHXThat's all you need to do. Rsyslog will now automatically generate file names for you and store the right messages into the right files. Please note that the minus sign also works with dynamic file name selectors. Thus, to avoid syncing, you may userwhIj%hJhKhLhhN}rx(hP]hQ]hR]hS]hU]uhWKhXhhC]ryhaXThat's all you need to do. Rsyslog will now automatically generate file names for you and store the right messages into the right files. Please note that the minus sign also works with dynamic file name selectors. Thus, to avoid syncing, you may userzr{}r|(hHjwhIjuubaubjc)r}}r~(hHUhIj%hJhKhLjfhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX``*.* -?DynFile``rhIj}hJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhC]rh)r}r(hHjhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX *.* -?DynFilerr}r(hHUhIjubahLhubaubaubh})r}r(hHXAAnd of course you can use templates to specify the output format:rhIj%hJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWKhXhhC]rhaXAAnd of course you can use templates to specify the output format:rr}r(hHjhIjubaubjc)r}r(hHUhIj%hJhKhLjfhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX``*.* ?DynFile;MyTemplate``rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhC]rh)r}r(hHjhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX*.* ?DynFile;MyTemplaterr}r(hHUhIjubahLhubaubaubh})r}r(hHX**A word of caution:** rsyslog creates files as needed. So if a new host is using your syslog server, rsyslog will automatically create a new file for it.hIj%hJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]r(j)r}r(hHX**A word of caution:**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXA word of caution:rr}r(hHUhIjubahLjubhaX rsyslog creates files as needed. So if a new host is using your syslog server, rsyslog will automatically create a new file for it.rr}r(hHX rsyslog creates files as needed. So if a new host is using your syslog server, rsyslog will automatically create a new file for it.hIjubeubh})r}r(hHX**Creating directories is also supported**. For example you can use the hostname as directory and the program name as file name:hIj%hJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]r(j)r}r(hHX***Creating directories is also supported**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX&Creating directories is also supportedrr}r(hHUhIjubahLjubhaXV. For example you can use the hostname as directory and the program name as file name:rr}r(hHXV. For example you can use the hostname as directory and the program name as file name:hIjubeubjc)r}r(hHUhIj%hJhKhLjfhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rh})r}r(hHX=``$template DynFile,"/var/log/%HOSTNAME%/%programname%.log"``rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWM hC]rh)r}r(hHjhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX9$template DynFile,"/var/log/%HOSTNAME%/%programname%.log"rr}r(hHUhIjubahLhubaubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh;ahU]rhauhWM hXhhC]r(hZ)r}r(hHX Named PipesrhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWM hXhhC]rhaX Named Pipesrr}r(hHjhIjubaubh})r}r(hHXLThis version of rsyslogd(8) has support for logging output to named pipes (fifos). A fifo or named pipe can be used as a destination for log messages by prepending a pipe symbol ("\|'') to the name of the file. This is handy for debugging. Note that the fifo must be created with the mkfifo(1) command before rsyslogd(8) is started.hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXKThis version of rsyslogd(8) has support for logging output to named pipes (fifos). A fifo or named pipe can be used as a destination for log messages by prepending a pipe symbol ("|'') to the name of the file. This is handy for debugging. Note that the fifo must be created with the mkfifo(1) command before rsyslogd(8) is started.rr}r(hHXLThis version of rsyslogd(8) has support for logging output to named pipes (fifos). A fifo or named pipe can be used as a destination for log messages by prepending a pipe symbol ("\|'') to the name of the file. This is handy for debugging. Note that the fifo must be created with the mkfifo(1) command before rsyslogd(8) is started.hIjubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh0ahU]rh auhWMhXhhC]r(hZ)r}r(hHXTerminal and ConsolerhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXTerminal and Consolerr}r(hHjhIjubaubh})r}r(hHXYIf the file you specified is a tty, special tty-handling is done, same with /dev/console.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXYIf the file you specified is a tty, special tty-handling is done, same with /dev/console.rr}r(hHjhIjubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh:ahU]rhauhWMhXhhC]r(hZ)r}r(hHXRemote MachinerhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXRemote Machinerr}r (hHjhIjubaubh})r }r (hHX6Rsyslogd provides full remote logging, i.e. is able to send messages to a remote host running rsyslogd(8) and to receive messages from remote hosts. Using this feature you're able to control all syslog messages on one host, if all other machines will log remotely to that. This tears down administration needs.r hIjhJhKhLhhN}r (hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX6Rsyslogd provides full remote logging, i.e. is able to send messages to a remote host running rsyslogd(8) and to receive messages from remote hosts. Using this feature you're able to control all syslog messages on one host, if all other machines will log remotely to that. This tears down administration needs.rr}r(hHj hIj ubaubh})r}r(hHXTo forward messages to another host, prepend the hostname with the at sign ("@"). A single at sign means that messages will be forwarded via UDP protocol (the standard for syslog). If you prepend two at signs ("@@"), the messages will be transmitted via TCP. Please note that plain TCP based syslog is not officially standardized, but most major syslogds support it (e.g. syslog-ng or `WinSyslog `_). The forwarding action indicator (at-sign) can be followed by one or more options. If they are given, they must be immediately (without a space) following the final at sign and be enclosed in parenthesis. The individual options must be separated by commas. The following options are right now defined:hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWM#hXhhC]r(haXTo forward messages to another host, prepend the hostname with the at sign ("@"). A single at sign means that messages will be forwarded via UDP protocol (the standard for syslog). If you prepend two at signs ("@@"), the messages will be transmitted via TCP. Please note that plain TCP based syslog is not officially standardized, but most major syslogds support it (e.g. syslog-ng or rr}r(hHXTo forward messages to another host, prepend the hostname with the at sign ("@"). A single at sign means that messages will be forwarded via UDP protocol (the standard for syslog). If you prepend two at signs ("@@"), the messages will be transmitted via TCP. Please note that plain TCP based syslog is not officially standardized, but most major syslogds support it (e.g. syslog-ng or hIjubj)r}r(hHX(`WinSyslog `_hN}r(UnameX WinSyslogjXhttp://www.winsyslog.com/rhS]hR]hP]hQ]hU]uhIjhC]rhaX WinSyslogrr}r (hHUhIjubahLjubhq)r!}r"(hHX jKhIjhLhthN}r#(UrefurijhS]r$h=ahR]hP]hQ]hU]r%hauhC]ubhaX/). The forwarding action indicator (at-sign) can be followed by one or more options. If they are given, they must be immediately (without a space) following the final at sign and be enclosed in parenthesis. The individual options must be separated by commas. The following options are right now defined:r&r'}r((hHX/). The forwarding action indicator (at-sign) can be followed by one or more options. If they are given, they must be immediately (without a space) following the final at sign and be enclosed in parenthesis. The individual options must be separated by commas. The following options are right now defined:hIjubeubh})r)}r*(hHX **z**r+hIjhJhKhLhhN}r,(hP]hQ]hR]hS]hU]uhWM/hXhhC]r-j)r.}r/(hHj+hN}r0(hP]hQ]hR]hS]hU]uhIj)hC]r1haX zr2r3}r4(hHUhIj.ubahLjubaubh})r5}r6(hHXTEnable zlib-compression for the message. The is the compression level. It can be 1 (lowest gain, lowest CPU overhead) to 9 (maximum compression, highest CPU overhead). The level can also be 0, which means "no compression". If given, the "z" option is ignored. So this does not make an awful lot of sense. There is hardly a difference between level 1 and 9 for typical syslog messages. You can expect a compression gain between 0% and 30% for typical messages. Very chatty messages may compress up to 50%, but this is seldom seen with typically traffic. Please note that rsyslogd checks the compression gain. Messages with 60 bytes or less will never be compressed. This is because compression gain is pretty unlikely and we prefer to save CPU cycles. Messages over that size are always compressed. However, it is checked if there is a gain in compression and only if there is, the compressed message is transmitted. Otherwise, the uncompressed messages is transmitted. This saves the receiver CPU cycles for decompression. It also prevents small message to actually become larger in compressed form.r7hIjhJhKhLhhN}r8(hP]hQ]hR]hS]hU]uhWM1hXhhC]r9haXTEnable zlib-compression for the message. The is the compression level. It can be 1 (lowest gain, lowest CPU overhead) to 9 (maximum compression, highest CPU overhead). The level can also be 0, which means "no compression". If given, the "z" option is ignored. So this does not make an awful lot of sense. There is hardly a difference between level 1 and 9 for typical syslog messages. You can expect a compression gain between 0% and 30% for typical messages. Very chatty messages may compress up to 50%, but this is seldom seen with typically traffic. Please note that rsyslogd checks the compression gain. Messages with 60 bytes or less will never be compressed. This is because compression gain is pretty unlikely and we prefer to save CPU cycles. Messages over that size are always compressed. However, it is checked if there is a gain in compression and only if there is, the compressed message is transmitted. Otherwise, the uncompressed messages is transmitted. This saves the receiver CPU cycles for decompression. It also prevents small message to actually become larger in compressed form.r:r;}r<(hHj7hIj5ubaubh})r=}r>(hHX**Please note that when a TCP transport is used, compression will also turn on syslog-transport-tls framing. See the "o" option for important information on the implications.**r?hIjhJhKhLhhN}r@(hP]hQ]hR]hS]hU]uhWMBhXhhC]rAj)rB}rC(hHj?hN}rD(hP]hQ]hR]hS]hU]uhIj=hC]rEhaXPlease note that when a TCP transport is used, compression will also turn on syslog-transport-tls framing. See the "o" option for important information on the implications.rFrG}rH(hHUhIjBubahLjubaubh})rI}rJ(hHXCompressed messages are automatically detected and decompressed by the receiver. There is nothing that needs to be configured on the receiver side.rKhIjhJhKhLhhN}rL(hP]hQ]hR]hS]hU]uhWMFhXhhC]rMhaXCompressed messages are automatically detected and decompressed by the receiver. There is nothing that needs to be configured on the receiver side.rNrO}rP(hHjKhIjIubaubh})rQ}rR(hHX**o**rShIjhJhKhLhhN}rT(hP]hQ]hR]hS]hU]uhWMJhXhhC]rUj)rV}rW(hHjShN}rX(hP]hQ]hR]hS]hU]uhIjQhC]rYhaXorZ}r[(hHUhIjVubahLjubaubh})r\}r](hHX{**This option is experimental. Use at your own risk and only if you know why you need it! If in doubt, do NOT turn it on.**r^hIjhJhKhLhhN}r_(hP]hQ]hR]hS]hU]uhWMLhXhhC]r`j)ra}rb(hHj^hN}rc(hP]hQ]hR]hS]hU]uhIj\hC]rdhaXwThis option is experimental. Use at your own risk and only if you know why you need it! If in doubt, do NOT turn it on.rerf}rg(hHUhIjaubahLjubaubh})rh}ri(hHX This option is only valid for plain TCP based transports. It selects a different framing based on IETF internet draft syslog-transport-tls-06. This framing offers some benefits over traditional LF-based framing. However, the standardization effort is not yet complete. There may be changes in upcoming versions of this standard. Rsyslog will be kept in line with the standard. There is some chance that upcoming changes will be incompatible to the current specification. In this case, all systems using -transport-tls framing must be upgraded. There will be no effort made to retain compatibility between different versions of rsyslog. The primary reason for that is that it seems technically impossible to provide compatibility between some of those changes. So you should take this note very serious. It is not something we do not \*like\* to do (and may change our mind if enough people beg...), it is something we most probably \*can not\* do for technical reasons (aka: you can beg as much as you like, it won't change anything...).hIjhJhKhLhhN}rj(hP]hQ]hR]hS]hU]uhWMOhXhhC]rkhaX This option is only valid for plain TCP based transports. It selects a different framing based on IETF internet draft syslog-transport-tls-06. This framing offers some benefits over traditional LF-based framing. However, the standardization effort is not yet complete. There may be changes in upcoming versions of this standard. Rsyslog will be kept in line with the standard. There is some chance that upcoming changes will be incompatible to the current specification. In this case, all systems using -transport-tls framing must be upgraded. There will be no effort made to retain compatibility between different versions of rsyslog. The primary reason for that is that it seems technically impossible to provide compatibility between some of those changes. So you should take this note very serious. It is not something we do not *like* to do (and may change our mind if enough people beg...), it is something we most probably *can not* do for technical reasons (aka: you can beg as much as you like, it won't change anything...).rlrm}rn(hHX This option is only valid for plain TCP based transports. It selects a different framing based on IETF internet draft syslog-transport-tls-06. This framing offers some benefits over traditional LF-based framing. However, the standardization effort is not yet complete. There may be changes in upcoming versions of this standard. Rsyslog will be kept in line with the standard. There is some chance that upcoming changes will be incompatible to the current specification. In this case, all systems using -transport-tls framing must be upgraded. There will be no effort made to retain compatibility between different versions of rsyslog. The primary reason for that is that it seems technically impossible to provide compatibility between some of those changes. So you should take this note very serious. It is not something we do not \*like\* to do (and may change our mind if enough people beg...), it is something we most probably \*can not\* do for technical reasons (aka: you can beg as much as you like, it won't change anything...).hIjhubaubh})ro}rp(hHX The most important implication is that compressed syslog messages via TCP must be considered with care. Unfortunately, it is technically impossible to transfer compressed records over traditional syslog plain tcp transports, so you are left with two evil choices...rqhIjhJhKhLhhN}rr(hP]hQ]hR]hS]hU]uhWM_hXhhC]rshaX The most important implication is that compressed syslog messages via TCP must be considered with care. Unfortunately, it is technically impossible to transfer compressed records over traditional syslog plain tcp transports, so you are left with two evil choices...rtru}rv(hHjqhIjoubaubjc)rw}rx(hHUhIjhJhKhLjfhN}ry(hP]hQ]hR]hS]hU]uhWNhXhhC]rzh})r{}r|(hHXAThe hostname may be followed by a colon and the destination port.r}hIjwhJhKhLhhN}r~(hP]hQ]hR]hS]hU]uhWMdhC]rhaXAThe hostname may be followed by a colon and the destination port.rr}r(hHj}hIj{ubaubaubh})r}r(hHX:The following is an example selector line with forwarding:rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMfhXhhC]rhaX:The following is an example selector line with forwarding:rr}r(hHjhIjubaubh})r}r(hHX$\*.\*    @@(o,z9)192.168.0.1:1470rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhhXhhC]rhaX"*.*    @@(o,z9)192.168.0.1:1470rr}r(hHX$\*.\*    @@(o,z9)192.168.0.1:1470hIjubaubh})r}r(hHXIn this example, messages are forwarded via plain TCP with experimental framing and maximum compression to the host 192.168.0.1 at port 1470.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMjhXhhC]rhaXIn this example, messages are forwarded via plain TCP with experimental framing and maximum compression to the host 192.168.0.1 at port 1470.rr}r(hHjhIjubaubh})r}r(hHX\*.\* @192.168.0.1rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMmhXhhC]rhaX*.* @192.168.0.1rr}r(hHX\*.\* @192.168.0.1hIjubaubh})r}r(hHXIn the example above, messages are forwarded via UDP to the machine 192.168.0.1, the destination port defaults to 514. Messages will not be compressed.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMohXhhC]rhaXIn the example above, messages are forwarded via UDP to the machine 192.168.0.1, the destination port defaults to 514. Messages will not be compressed.rr}r(hHjhIjubaubh})r}r(hHX`Note that IPv6 addresses contain colons. So if an IPv6 address is specified in the hostname part, rsyslogd could not detect where the IP address ends and where the port starts. There is a syntax extension to support this: put squary brackets around the address (e.g. "[2001::1]"). Square brackets also work with real host names and IPv4 addresses, too.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMshXhhC]rhaX`Note that IPv6 addresses contain colons. So if an IPv6 address is specified in the hostname part, rsyslogd could not detect where the IP address ends and where the port starts. There is a syntax extension to support this: put squary brackets around the address (e.g. "[2001::1]"). Square brackets also work with real host names and IPv4 addresses, too.rr}r(hHjhIjubaubh})r}r(hHXSA valid sample to send messages to the IPv6 host 2001::1 at port 515 is as follows:rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMyhXhhC]rhaXSA valid sample to send messages to the IPv6 host 2001::1 at port 515 is as follows:rr}r(hHjhIjubaubh})r}r(hHX\*.\* @[2001::1]:515rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWM|hXhhC]rhaX*.* @[2001::1]:515rr}r(hHX\*.\* @[2001::1]:515hIjubaubh})r}r(hHXThis works with TCP, too.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWM~hXhhC]rhaXThis works with TCP, too.rr}r(hHjhIjubaubh})r}r(hHX.**Note to sysklogd users:** sysklogd does **not** support RFC 3164 format, which is the default forwarding template in rsyslog. As such, you will experience duplicate hostnames if rsyslog is the sender and sysklogd is the receiver. The fix is simple: you need to use a different template. Use that one:hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]r(j)r}r(hHX**Note to sysklogd users:**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXNote to sysklogd users:rr}r(hHUhIjubahLjubhaX sysklogd does rr}r(hHX sysklogd does hIjubj)r}r(hHX**not**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXnotrr}r(hHUhIjubahLjubhaX support RFC 3164 format, which is the default forwarding template in rsyslog. As such, you will experience duplicate hostnames if rsyslog is the sender and sysklogd is the receiver. The fix is simple: you need to use a different template. Use that one:rr}r(hHX support RFC 3164 format, which is the default forwarding template in rsyslog. As such, you will experience duplicate hostnames if rsyslog is the sender and sysklogd is the receiver. The fix is simple: you need to use a different template. Use that one:hIjubeubcdocutils.nodes definition_list r)r}r(hHUhIjhJhKhLUdefinition_listrhN}r(hP]hQ]hR]hS]hU]uhWNhXhhC]rcdocutils.nodes definition_list_item r)r}r(hHXX$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%\\"" \*.\* @192.168.0.1;sysklogd hIjhJhKhLUdefinition_list_itemrhN}r(hP]hQ]hR]hS]hU]uhWMhC]r(cdocutils.nodes term r)r}r(hHX;$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%\\""rhIjhJhKhLUtermrhN}r(hP]hQ]hR]hS]hU]uhWMhC]rhaX:$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%\""rr}r(hHX;$template sysklogd,"<%PRI%>%TIMESTAMP% %syslogtag%%msg%\\""hIjubaubcdocutils.nodes definition r)r}r(hHUhN}r(hP]hQ]hR]hS]hU]uhIjhC]rh})r}r(hHX\*.\* @192.168.0.1;sysklogdrhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhC]rhaX*.* @192.168.0.1;sysklogdrr}r(hHX\*.\* @192.168.0.1;sysklogdhIjubaubahLU definitionrubeubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r (hP]hQ]hR]hS]r h3ahU]r hauhWMhXhhC]r (hZ)r }r(hHX List of UsersrhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX List of Usersrr}r(hHjhIj ubaubh})r}r(hHX.Usually critical messages are also directed to "root'' on that machine. You can specify a list of users that shall get the message by simply writing ":omusrmsg: followed by the login name. For example, the send messages to root, use ":omusrmsg:root". You may specify more than one user by separating them with commas (",''). Do not repeat the ":omusrmsg:" prefix in this case. For example, to send data to users root and rger, use ":omusrmsg:root,rger" (do not use ":omusrmsg:root,:omusrmsg:rger", this is invalid). If they're logged in they get the message.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX.Usually critical messages are also directed to "root'' on that machine. You can specify a list of users that shall get the message by simply writing ":omusrmsg: followed by the login name. For example, the send messages to root, use ":omusrmsg:root". You may specify more than one user by separating them with commas (",''). Do not repeat the ":omusrmsg:" prefix in this case. For example, to send data to users root and rger, use ":omusrmsg:root,rger" (do not use ":omusrmsg:root,:omusrmsg:rger", this is invalid). If they're logged in they get the message.rr}r(hHjhIjubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]r h,ahU]r!h auhWMhXhhC]r"(hZ)r#}r$(hHXEveryone logged onr%hIjhJhKhLh^hN}r&(hP]hQ]hR]hS]hU]uhWMhXhhC]r'haXEveryone logged onr(r)}r*(hHj%hIj#ubaubh})r+}r,(hHXEmergency messages often go to all users currently online to notify them that something strange is happening with the system. To specify this wall(1)-feature use an asterisk as the user message destination(":omusrmsg:\*'').hIjhJhKhLhhN}r-(hP]hQ]hR]hS]hU]uhWMhXhhC]r.haXEmergency messages often go to all users currently online to notify them that something strange is happening with the system. To specify this wall(1)-feature use an asterisk as the user message destination(":omusrmsg:*'').r/r0}r1(hHXEmergency messages often go to all users currently online to notify them that something strange is happening with the system. To specify this wall(1)-feature use an asterisk as the user message destination(":omusrmsg:\*'').hIj+ubaubeubhE)r2}r3(hHUhIjxhJhKhLhMhN}r4(hP]hQ]hR]hS]r5h8ahU]r6hauhWMhXhhC]r7(hZ)r8}r9(hHX Call Pluginr:hIj2hJhKhLh^hN}r;(hP]hQ]hR]hS]hU]uhWMhXhhC]r<haX Call Pluginr=r>}r?(hHj:hIj8ubaubh})r@}rA(hHXThis is a generic way to call an output plugin. The plugin must support this functionality. Actual parameters depend on the module, so see the module's doc on what to supply. The general syntax is as follows:rBhIj2hJhKhLhhN}rC(hP]hQ]hR]hS]hU]uhWMhXhhC]rDhaXThis is a generic way to call an output plugin. The plugin must support this functionality. Actual parameters depend on the module, so see the module's doc on what to supply. The general syntax is as follows:rErF}rG(hHjBhIj@ubaubh})rH}rI(hHX:modname:params;templaterJhIj2hJhKhLhhN}rK(hP]hQ]hR]hS]hU]uhWMhXhhC]rLhaX:modname:params;templaterMrN}rO(hHjJhIjHubaubh})rP}rQ(hHX9Currently, the ommysql database output module supports this syntax (in addtion to the ">" syntax it traditionally supported). For ommysql, the module name is "ommysql" and the params are the traditional ones. The ;template part is not module specific, it is generic rsyslog functionality available to all modules.rRhIj2hJhKhLhhN}rS(hP]hQ]hR]hS]hU]uhWMhXhhC]rThaX9Currently, the ommysql database output module supports this syntax (in addtion to the ">" syntax it traditionally supported). For ommysql, the module name is "ommysql" and the params are the traditional ones. The ;template part is not module specific, it is generic rsyslog functionality available to all modules.rUrV}rW(hHjRhIjPubaubh})rX}rY(hHX;As an example, the ommysql module may be called as follows:rZhIj2hJhKhLhhN}r[(hP]hQ]hR]hS]hU]uhWMhXhhC]r\haX;As an example, the ommysql module may be called as follows:r]r^}r_(hHjZhIjXubaubh})r`}ra(hHX3:ommysql:dbhost,dbname,dbuser,dbpassword;dbtemplaterbhIj2hJhKhLhhN}rc(hP]hQ]hR]hS]hU]uhWMhXhhC]rdhaX3:ommysql:dbhost,dbname,dbuser,dbpassword;dbtemplatererf}rg(hHjbhIj`ubaubh})rh}ri(hHXKFor details, please see the "Database Table" section of this documentation.rjhIj2hJhKhLhhN}rk(hP]hQ]hR]hS]hU]uhWMhXhhC]rlhaXKFor details, please see the "Database Table" section of this documentation.rmrn}ro(hHjjhIjhubaubh})rp}rq(hHXNote: as of this writing, the ":modname:" part is hardcoded into the module. So the name to use is not necessarily the name the module's plugin file is called.rrhIj2hJhKhLhhN}rs(hP]hQ]hR]hS]hU]uhWMhXhhC]rthaXNote: as of this writing, the ":modname:" part is hardcoded into the module. So the name to use is not necessarily the name the module's plugin file is called.rurv}rw(hHjrhIjpubaubeubhE)rx}ry(hHUhIjxhJhKhLhMhN}rz(hP]hQ]hR]hS]r{hBahU]r|hauhWMhXhhC]r}(hZ)r~}r(hHXDatabase TablerhIjxhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXDatabase Tablerr}r(hHjhIj~ubaubh})r}r(hHXThis allows logging of the message to a database table. Currently, only MySQL databases are supported. However, other database drivers will most probably be developed as plugins. By default, a `MonitorWare `_-compatible schema is required for this to work. You can create that schema with the createDB.SQL file that came with the rsyslog package. You can also use any other schema of your liking - you just need to define a proper template and assign this template to the action. The database writer is called by specifying a greater-then sign (">") in front of the database connect information. Immediately after that sign the database host name must be given, a comma, the database name, another comma, the database user, a comma and then the user's password. If a specific template is to be used, a semicolon followed by the template name can follow the connect information. This is as follows: >dbhost,dbname,dbuser,dbpassword;dbtemplatehIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]r(haXThis allows logging of the message to a database table. Currently, only MySQL databases are supported. However, other database drivers will most probably be developed as plugins. By default, a rr}r(hHXThis allows logging of the message to a database table. Currently, only MySQL databases are supported. However, other database drivers will most probably be developed as plugins. By default, a hIjubj)r}r(hHX,`MonitorWare `_hN}r(UnameX MonitorWarejXhttp://www.monitorware.com/rhS]hR]hP]hQ]hU]uhIjhC]rhaX MonitorWarerr}r(hHUhIjubahLjubhq)r}r(hHX jKhIjhLhthN}r(UrefurijhS]rh1ahR]hP]hQ]hU]rhauhC]ubhaX-compatible schema is required for this to work. You can create that schema with the createDB.SQL file that came with the rsyslog package. You can also use any other schema of your liking - you just need to define a proper template and assign this template to the action. The database writer is called by specifying a greater-then sign (">") in front of the database connect information. Immediately after that sign the database host name must be given, a comma, the database name, another comma, the database user, a comma and then the user's password. If a specific template is to be used, a semicolon followed by the template name can follow the connect information. This is as follows: >dbhost,dbname,dbuser,dbpassword;dbtemplaterr}r(hHX-compatible schema is required for this to work. You can create that schema with the createDB.SQL file that came with the rsyslog package. You can also use any other schema of your liking - you just need to define a proper template and assign this template to the action. The database writer is called by specifying a greater-then sign (">") in front of the database connect information. Immediately after that sign the database host name must be given, a comma, the database name, another comma, the database user, a comma and then the user's password. If a specific template is to be used, a semicolon followed by the template name can follow the connect information. This is as follows: >dbhost,dbname,dbuser,dbpassword;dbtemplatehIjubeubh})r}r(hHX**Important: to use the database functionality, the MySQL output module must be loaded in the config file** BEFORE the first database table action is used. This is done by placing thehIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]r(j)r}r(hHXk**Important: to use the database functionality, the MySQL output module must be loaded in the config file**hN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaXgImportant: to use the database functionality, the MySQL output module must be loaded in the config filerr}r(hHUhIjubahLjubhaXL BEFORE the first database table action is used. This is done by placing therr}r(hHXL BEFORE the first database table action is used. This is done by placing thehIjubeubj)r}r(hHX$ModLoad ommysqlhIjxhJhKhLjhN}r(jjhS]hR]hP]hQ]hU]uhWMhXhhC]rhaX$ModLoad ommysqlrr}r(hHUhIjubaubh})r}r(hHX|directive some place above the first use of the database write (we recommend doing at the the beginning of the config file).rhIjxhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX|directive some place above the first use of the database write (we recommend doing at the the beginning of the config file).rr}r(hHjhIjubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh@ahU]rhauhWMhXhhC]r(hZ)r}r(hHXDiscardrhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXDiscardrr}r(hHjhIjubaubh})r}r(hHXIf the discard action is carried out, the received message is immediately discarded. No further processing of it occurs. Discard has primarily been added to filter out messages before carrying on any further processing. For obvious reasons, the results of "discard" are depending on where in the configuration file it is being used. Please note that once a message has been discarded there is no way to retrieve it in later configuration file lines.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXIf the discard action is carried out, the received message is immediately discarded. No further processing of it occurs. Discard has primarily been added to filter out messages before carrying on any further processing. For obvious reasons, the results of "discard" are depending on where in the configuration file it is being used. Please note that once a message has been discarded there is no way to retrieve it in later configuration file lines.rr}r(hHjhIjubaubh})r}r(hHX)Discard can be highly effective if you want to filter out some annoying messages that otherwise would fill your log files. To do that, place the discard actions early in your log files. This often plays well with property-based filters, giving you great freedom in specifying what you do not want.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX)Discard can be highly effective if you want to filter out some annoying messages that otherwise would fill your log files. To do that, place the discard actions early in your log files. This often plays well with property-based filters, giving you great freedom in specifying what you do not want.rr}r(hHjhIjubaubh})r}r(hHXFDiscard is just the single tilde character with no further parameters:rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXFDiscard is just the single tilde character with no further parameters:rr}r(hHjhIjubaubh})r}r(hHX~hIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX~r}r(hHX~hIjubaubh})r}r(hHX For example,rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX For example,rr}r(hHjhIjubaubh})r}r(hHX \*.\*   ~rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX *.*   ~rr}r(hHX \*.\*   ~hIjubaubh})r}r(hHXTdiscards everything (ok, you can achive the same by not running rsyslogd at all...).rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXTdiscards everything (ok, you can achive the same by not running rsyslogd at all...).rr}r(hHjhIjubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rh6ahU]rhauhWMhXhhC]r(hZ)r}r(hHXOutput ChannelrhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaXOutput Channelr r }r (hHjhIjubaubh})r }r (hHX/Binds an output channel definition (see there for details) to this action. Output channel actions must start with a $-sign, e.g. if you would like to bind your output channel definition "mychannel" to the action, use "$mychannel". Output channels support template definitions like all all other actions.rhIjhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX/Binds an output channel definition (see there for details) to this action. Output channel actions must start with a $-sign, e.g. if you would like to bind your output channel definition "mychannel" to the action, use "$mychannel". Output channels support template definitions like all all other actions.rr}r(hHjhIj ubaubeubhE)r}r(hHUhIjxhJhKhLhMhN}r(hP]hQ]hR]hS]rhAahU]rhauhWMhXhhC]r(hZ)r}r(hHX Shell ExecuterhIjhJhKhLh^hN}r(hP]hQ]hR]hS]hU]uhWMhXhhC]rhaX Shell Executerr }r!(hHjhIjubaubh})r"}r#(hHX**NOTE: This action is only supported for backwards compatibility. For new configs, use** :doc:`omprog ` **instead. It provides a more solid and secure solution with higher performance.**hIjhJhKhLhhN}r$(hP]hQ]hR]hS]hU]uhWMhXhhC]r%(j)r&}r'(hHXY**NOTE: This action is only supported for backwards compatibility. For new configs, use**hN}r((hP]hQ]hR]hS]hU]uhIj"hC]r)haXUNOTE: This action is only supported for backwards compatibility. For new configs, user*r+}r,(hHUhIj&ubahLjubhaX r-}r.(hHX hIj"ubh)r/}r0(hHX:doc:`omprog `r1hIj"hJhKhLhhN}r2(UreftypeXdocr3hhXmodules/omprogU refdomainUhS]hR]U refexplicithP]hQ]hU]hhuhWMhC]r4h)r5}r6(hHj1hN}r7(hP]hQ]r8(hj3ehR]hS]hU]uhIj/hC]r9haXomprogr:r;}r<(hHUhIj5ubahLhubaubhaX r=}r>(hHX hIj"ubj)r?}r@(hHXR**instead. It provides a more solid and secure solution with higher performance.**hN}rA(hP]hQ]hR]hS]hU]uhIj"hC]rBhaXNinstead. It provides a more solid and secure solution with higher performance.rCrD}rE(hHUhIj?ubahLjubeubh})rF}rG(hHXThis executes a program in a subshell. The program is passed the template-generated message as the only command line parameter. Rsyslog waits until the program terminates and only then continues to run.rHhIjhJhKhLhhN}rI(hP]hQ]hR]hS]hU]uhWMhXhhC]rJhaXThis executes a program in a subshell. The program is passed the template-generated message as the only command line parameter. Rsyslog waits until the program terminates and only then continues to run.rKrL}rM(hHjHhIjFubaubh})rN}rO(hHX^program-to-execute;templaterPhIjhJhKhLhhN}rQ(hP]hQ]hR]hS]hU]uhWMhXhhC]rRhaX^program-to-execute;templaterSrT}rU(hHjPhIjNubaubh})rV}rW(hHXtThe program-to-execute can be any valid executable. It receives the template string as a single parameter (argv[1]).rXhIjhJhKhLhhN}rY(hP]hQ]hR]hS]hU]uhWM hXhhC]rZhaXtThe program-to-execute can be any valid executable. It receives the template string as a single parameter (argv[1]).r[r\}r](hHjXhIjVubaubh})r^}r_(hHX**WARNING:** The Shell Execute action was added to serve an urgent need. While it is considered reasonable save when used with some thinking, its implications must be considered. The current implementation uses a system() call to execute the command. This is not the best way to do it (and will hopefully changed in further releases). Also, proper escaping of special characters is done to prevent command injection. However, attackers always find smart ways to circumvent escaping, so we can not say if the escaping applied will really safe you from all hassles. Lastly, rsyslog will wait until the shell command terminates. Thus, a program error in it (e.g. an infinite loop) can actually disable rsyslog. Even without that, during the programs run-time no messages are processed by rsyslog. As the IP stacks buffers are quickly overflowed, this bears an increased risk of message loss. You must be aware of these implications. Even though they are severe, there are several cases where the "shell execute" action is very useful. This is the reason why we have included it in its current form. To mitigate its risks, always a) test your program thoroughly, b) make sure its runtime is as short as possible (if it requires a longer run-time, you might want to spawn your own sub-shell asynchronously), c) apply proper firewalling so that only known senders can send syslog messages to rsyslog. Point c) is especially important: if rsyslog is accepting message from any hosts, chances are much higher that an attacker might try to exploit the "shell execute" action.hIjhJhKhLhhN}r`(hP]hQ]hR]hS]hU]uhWM hXhhC]ra(j)rb}rc(hHX **WARNING:**hN}rd(hP]hQ]hR]hS]hU]uhIj^hC]rehaXWARNING:rfrg}rh(hHUhIjbubahLjubhaX The Shell Execute action was added to serve an urgent need. While it is considered reasonable save when used with some thinking, its implications must be considered. The current implementation uses a system() call to execute the command. This is not the best way to do it (and will hopefully changed in further releases). Also, proper escaping of special characters is done to prevent command injection. However, attackers always find smart ways to circumvent escaping, so we can not say if the escaping applied will really safe you from all hassles. Lastly, rsyslog will wait until the shell command terminates. Thus, a program error in it (e.g. an infinite loop) can actually disable rsyslog. Even without that, during the programs run-time no messages are processed by rsyslog. As the IP stacks buffers are quickly overflowed, this bears an increased risk of message loss. You must be aware of these implications. Even though they are severe, there are several cases where the "shell execute" action is very useful. This is the reason why we have included it in its current form. To mitigate its risks, always a) test your program thoroughly, b) make sure its runtime is as short as possible (if it requires a longer run-time, you might want to spawn your own sub-shell asynchronously), c) apply proper firewalling so that only known senders can send syslog messages to rsyslog. Point c) is especially important: if rsyslog is accepting message from any hosts, chances are much higher that an attacker might try to exploit the "shell execute" action.rirj}rk(hHX The Shell Execute action was added to serve an urgent need. While it is considered reasonable save when used with some thinking, its implications must be considered. The current implementation uses a system() call to execute the command. This is not the best way to do it (and will hopefully changed in further releases). Also, proper escaping of special characters is done to prevent command injection. However, attackers always find smart ways to circumvent escaping, so we can not say if the escaping applied will really safe you from all hassles. Lastly, rsyslog will wait until the shell command terminates. Thus, a program error in it (e.g. an infinite loop) can actually disable rsyslog. Even without that, during the programs run-time no messages are processed by rsyslog. As the IP stacks buffers are quickly overflowed, this bears an increased risk of message loss. You must be aware of these implications. Even though they are severe, there are several cases where the "shell execute" action is very useful. This is the reason why we have included it in its current form. To mitigate its risks, always a) test your program thoroughly, b) make sure its runtime is as short as possible (if it requires a longer run-time, you might want to spawn your own sub-shell asynchronously), c) apply proper firewalling so that only known senders can send syslog messages to rsyslog. Point c) is especially important: if rsyslog is accepting message from any hosts, chances are much higher that an attacker might try to exploit the "shell execute" action.hIj^ubeubeubhE)rl}rm(hHUhIjxhJhKhLhMhN}rn(hP]hQ]hR]hS]roh9ahU]rphauhWM%hXhhC]rq(hZ)rr}rs(hHX Template NamerthIjlhJhKhLh^hN}ru(hP]hQ]hR]hS]hU]uhWM%hXhhC]rvhaX Template Namerwrx}ry(hHjthIjrubaubh})rz}r{(hHXEvery ACTION can be followed by a template name. If so, that template is used for message formatting. If no name is given, a hard-coded default template is used for the action. There can only be one template name for each given action. The default template is specific to each action. For a description of what a template is and what you can do with it, see the :doc:`template` documentation.hIjlhJhKhLhhN}r|(hP]hQ]hR]hS]hU]uhWM'hXhhC]r}(haXjEvery ACTION can be followed by a template name. If so, that template is used for message formatting. If no name is given, a hard-coded default template is used for the action. There can only be one template name for each given action. The default template is specific to each action. For a description of what a template is and what you can do with it, see the r~r}r(hHXjEvery ACTION can be followed by a template name. If so, that template is used for message formatting. If no name is given, a hard-coded default template is used for the action. There can only be one template name for each given action. The default template is specific to each action. For a description of what a template is and what you can do with it, see the hIjzubh)r}r(hHX:doc:`template`rhIjzhJhKhLhhN}r(UreftypeXdocrhhX templatesU refdomainUhS]hR]U refexplicithP]hQ]hU]hhuhWM'hC]rh)r}r(hHjhN}r(hP]hQ]r(hjehR]hS]hU]uhIjhC]rhaXtemplaterr}r(hHUhIjubahLhubaubhaX documentation.rr}r(hHX documentation.hIjzubeubh})r}r(hHXThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hIjlhJhKhLhhN}r(hP]hQ]hR]hS]hU]uhWM.hXhhC]r(haX"This documentation is part of the rr}r(hHX"This documentation is part of the hIjubj)r}r(hHX$`rsyslog `_hN}r(Unameh jXhttp://www.rsyslog.com/rhS]hR]hP]hQ]hU]uhIjhC]rhaXrsyslogrr}r(hHUhIjubahLjubhq)r}r(hHX jKhIjhLhthN}r(UrefurijhS]rh-ahR]hP]hQ]hU]rh auhC]ubhaX$ project. Copyright © 2008-2014 by rr}r(hHX$ project. Copyright © 2008-2014 by hIjubj)r}r(hHX3`Rainer Gerhards `_hN}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrhS]hR]hP]hQ]hU]uhIjhC]rhaXRainer Gerhardsrr}r(hHUhIjubahLjubhq)r}r(hHX! jKhIjhLhthN}r(UrefurijhS]rh4ahR]hP]hQ]hU]rhauhC]ubhaX and rr}r(hHX and hIjubj)r}r(hHX$`Adiscon `_hN}r(UnameXAdisconjXhttp://www.adiscon.com/rhS]hR]hP]hQ]hU]uhIjhC]rhaXAdisconrr}r(hHUhIjubahLjubhq)r}r(hHX jKhIjhLhthN}r(UrefurijhS]rh?ahR]hP]hQ]hU]rhauhC]ubhaX1. Released under the GNU GPL version 2 or higher.rr}r(hHX1. Released under the GNU GPL version 2 or higher.hIjubeubeubeubeubahHUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rhXhU current_linerNUtransform_messagesr]r(cdocutils.nodes system_message r)r}r(hHUhN}r(hP]UlevelKhS]hR]UsourcehKhQ]hU]UlineKUtypeUINFOruhC]rh})r}r(hHUhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX-Hyperlink target "index-0" is not referenced.rr}r(hHUhIjubahLhubahLUsystem_messagerubj)r}r(hHUhN}r(hP]UlevelKhS]hR]UsourcehKhQ]hU]UlineKUtypejuhC]rh})r}r(hHUhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX2Hyperlink target "cfgobj-input" is not referenced.rr}r(hHUhIjubahLhubahLjubj)r}r(hHUhN}r(hP]UlevelKhS]hR]UsourcehKhQ]hU]UlineKUtypejuhC]rh})r}r(hHUhN}r(hP]hQ]hR]hS]hU]uhIjhC]rhaX9Hyperlink target "legacy-action-order" is not referenced.rr}r(hHUhIjubahLhubahLjubeUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlr Uhttps://tools.ietf.org/html/r U tracebackr Upep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh^NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsr NU docinfo_xformr!KUwarning_streamr"NUpep_file_url_templater#Upep-%04dr$Uexit_status_levelr%KUconfigr&NUstrict_visitorr'NUcloak_email_addressesr(Utrim_footnote_reference_spacer)Uenvr*NUdump_pseudo_xmlr+NUexpose_internalsr,NUsectsubtitle_xformr-U source_linkr.NUrfc_referencesr/NUoutput_encodingr0Uutf-8r1U source_urlr2NUinput_encodingr3U utf-8-sigr4U_disable_configr5NU id_prefixr6UU tab_widthr7KUerror_encodingr8UUTF-8r9U_sourcer:hKUgettext_compactr;U generatorr<NUdump_internalsr=NU smart_quotesr>U pep_base_urlr?U https://www.python.org/dev/peps/r@Usyntax_highlightrAUlongrBUinput_encoding_error_handlerrCjUauto_id_prefixrDUidrEUdoctitle_xformrFUstrip_elements_with_classesrGNU _config_filesrH]Ufile_insertion_enabledrIU raw_enabledrJKU dump_settingsrKNubUsymbol_footnote_startrLKUidsrM}rN(h+hFh:jh-jh1jh/j%hBjxh3jhmh~h2jxh8j2h.jhAjh9jlh?jh0jh*hh6jh)jh7jNh;jhjh@jh,jh5jsh4juUsubstitution_namesrO}rPhLhXhN}rQ(hP]hS]hR]UsourcehKhQ]hU]uU footnotesrR]rSUrefidsrT}rU(h>]rVjahm]rWhrah<]rXhwauub.build/.doctrees/configuration/action/0000775000175000017500000000000013035122641016646 5ustar rgerrgerbuild/.doctrees/configuration/action/rsconf1_actionresumeinterval.doctree0000664000175000017500000001660713035122641026125 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$actionresumeintervalqNXrainer gerhardsqXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUactionresumeintervalqhUrainer-gerhardsqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXX/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_actionresumeinterval.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$ActionResumeIntervalq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$ActionResumeIntervalq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** 30qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X 30qXqY}qZ(hX 30hhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hXSets the ActionResumeInterval for all following actions. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended).qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5XSets the ActionResumeInterval for all following actions. The interval provided is always in seconds. Thus, multiply by 60 if you need minutes and 3,600 if you need hours (not recommended).qlqm}qn(hhihhgubaubh9)qo}qp(hXWhen an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) \* $ActionResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.hhhhh h=h"}qq(h$]h%]h&]h']h)]uh+Kh,hh]qrh5XWhen an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) * $ActionResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.qsqt}qu(hXWhen an action is suspended (e.g. destination can not be connected), the action is resumed for the configured interval. Thereafter, it is retried. If multiple retries fail, the interval is automatically extended. This is to prevent excessive resource use for retries. After each 10 retries, the interval is extended by itself. To be precise, the actual interval is (numRetries / 10 + 1) \* $ActionResumeInterval. so after the 10th try, it by default is 60 and after the 100th try it is 330.hhoubaubh9)qv}qw(hX **Sample:**qxhhhhh h=h"}qy(h$]h%]h&]h']h)]uh+Kh,hh]qzh@)q{}q|(hhxh"}q}(h$]h%]h&]h']h)]uhhvh]q~h5XSample:qq}q(hUhh{ubah hHubaubh9)q}q(hX$ActionResumeInterval 30qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5X$ActionResumeInterval 30qq}q(hhhhubaubh9)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project.qq}q(hX project.hhubeubh9)q}q(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5XCopyright © 2007 by qq}q(hXCopyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqÅq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.q˅q}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesr Utrim_footnote_reference_spacer Uenvr NUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlr U https://www.python.org/dev/peps/r!Usyntax_highlightr"Ulongr#Uinput_encoding_error_handlerr$hUauto_id_prefixr%Uidr&Udoctitle_xformr'Ustrip_elements_with_classesr(NU _config_filesr)]Ufile_insertion_enabledr*U raw_enabledr+KU dump_settingsr,NubUsymbol_footnote_startr-KUidsr.}r/(hhhhhhhhuUsubstitution_namesr0}r1h h,h"}r2(h$]h']h&]Usourcehh%]h)]uU footnotesr3]r4Urefidsr5}r6ub.build/.doctrees/configuration/action/rsconf1_gssmode.doctree0000664000175000017500000001543213035122641023316 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$gssmodeqNXrainer gerhardsqXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUgssmodeqhUrainer-gerhardsqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXK/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_gssmode.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$GssModeq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$GssModeq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** encryptionqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X encryptionqXqY}qZ(hX encryptionhhLubeubh9)q[}q\(hX**Provided by:** *omgssapi*q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_(h@)q`}qa(hX**Provided by:**h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Provided by:qdqe}qf(hUhh`ubah hHubh5X qg}qh(hX hh[ubcdocutils.nodes emphasis qi)qj}qk(hX *omgssapi*h"}ql(h$]h%]h&]h']h)]uhh[h]qmh5Xomgssapiqnqo}qp(hUhhjubah Uemphasisqqubeubh9)qr}qs(hX**Description:**qthhhhh h=h"}qu(h$]h%]h&]h']h)]uh+K h,hh]qvh@)qw}qx(hhth"}qy(h$]h%]h&]h']h)]uhhrh]qzh5X Description:q{q|}q}(hUhhwubah hHubaubh9)q~}q(hXSpecifies GSS-API mode to use, which can be "**integrity**\ " - clients are authenticated and messages are checked for integrity, "**encryption**\ " - same as "integrity", but messages are also encrypted if both sides support it.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K h,hh]q(h5X-Specifies GSS-API mode to use, which can be "qq}q(hX-Specifies GSS-API mode to use, which can be "hh~ubh@)q}q(hX **integrity**h"}q(h$]h%]h&]h']h)]uhh~h]qh5X integrityqq}q(hUhhubah hHubh5XG" - clients are authenticated and messages are checked for integrity, "qq}q(hXI\ " - clients are authenticated and messages are checked for integrity, "hh~ubh@)q}q(hX**encryption**h"}q(h$]h%]h&]h']h)]uhh~h]qh5X encryptionqq}q(hUhhubah hHubh5XR" - same as "integrity", but messages are also encrypted if both sides support it.qq}q(hXT\ " - same as "integrity", but messages are also encrypted if both sides support it.hh~ubeubh9)q}q(hX **Sample:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XSample:qq}q(hUhhubah hHubaubh9)q}q(hX``$GssMode Encryption``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X$GssMode Encryptionqq}q(hUhhubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qͅq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer GerhardsqՅq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and q݅q}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconq允q}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.q텁q}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values r or }r (Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh2NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerr Ustrictr!U sectnum_xformr"KUdump_transformsr#NU docinfo_xformr$KUwarning_streamr%NUpep_file_url_templater&Upep-%04dr'Uexit_status_levelr(KUconfigr)NUstrict_visitorr*NUcloak_email_addressesr+Utrim_footnote_reference_spacer,Uenvr-NUdump_pseudo_xmlr.NUexpose_internalsr/NUsectsubtitle_xformr0U source_linkr1NUrfc_referencesr2NUoutput_encodingr3Uutf-8r4U source_urlr5NUinput_encodingr6U utf-8-sigr7U_disable_configr8NU id_prefixr9UU tab_widthr:KUerror_encodingr;UUTF-8r<U_sourcer=hUgettext_compactr>U generatorr?NUdump_internalsr@NU smart_quotesrAU pep_base_urlrBU https://www.python.org/dev/peps/rCUsyntax_highlightrDUlongrEUinput_encoding_error_handlerrFj!Uauto_id_prefixrGUidrHUdoctitle_xformrIUstrip_elements_with_classesrJNU _config_filesrK]Ufile_insertion_enabledrLU raw_enabledrMKU dump_settingsrNNubUsymbol_footnote_startrOKUidsrP}rQ(hhhhhhhhuUsubstitution_namesrR}rSh h,h"}rT(h$]h']h&]Usourcehh%]h)]uU footnotesrU]rVUrefidsrW}rXub.build/.doctrees/configuration/action/rsconf1_repeatedmsgreduction.doctree0000664000175000017500000004014013035122641026064 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X descriptionqNXrainer gerhardsqX discussionqNXadisconq Xsampleq NXwhat is a repeated messageq NXrsyslogq X$repeatedmsgreductionq NXtesting rsyslog ratelimitingquUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU descriptionqhUrainer-gerhardsqhU discussionqh Uadisconqh Usampleqh Uwhat-is-a-repeated-messageqh Ursyslogqh UrepeatedmsgreductionqhUtesting-rsyslog-ratelimitingq uUchildrenq!]q"cdocutils.nodes section q#)q$}q%(U rawsourceq&UUparentq'hUsourceq(XX/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_repeatedmsgreduction.rstq)Utagnameq*Usectionq+U attributesq,}q-(Udupnamesq.]Uclassesq/]Ubackrefsq0]Uidsq1]q2haUnamesq3]q4h auUlineq5KUdocumentq6hh!]q7(cdocutils.nodes title q8)q9}q:(h&X$RepeatedMsgReductionq;h'h$h(h)h*Utitleqcdocutils.nodes Text q?X$RepeatedMsgReductionq@qA}qB(h&h;h'h9ubaubcdocutils.nodes paragraph qC)qD}qE(h&X(**Type:** global configuration directiveqFh'h$h(h)h*U paragraphqGh,}qH(h.]h/]h0]h1]h3]uh5Kh6hh!]qI(cdocutils.nodes strong qJ)qK}qL(h&X **Type:**h,}qM(h.]h/]h0]h1]h3]uh'hDh!]qNh?XType:qOqP}qQ(h&Uh'hKubah*UstrongqRubh?X global configuration directiveqSqT}qU(h&X global configuration directiveh'hDubeubhC)qV}qW(h&X**Default:** offqXh'h$h(h)h*hGh,}qY(h.]h/]h0]h1]h3]uh5Kh6hh!]qZ(hJ)q[}q\(h&X **Default:**h,}q](h.]h/]h0]h1]h3]uh'hVh!]q^h?XDefault:q_q`}qa(h&Uh'h[ubah*hRubh?X offqbqc}qd(h&X offh'hVubeubh#)qe}qf(h&Uh'h$h(h)h*h+h,}qg(h.]h/]h0]h1]qhhah3]qihauh5K h6hh!]qj(h8)qk}ql(h&X Descriptionqmh'heh(h)h*h`_ for some extra information on the per-process ratelimiting.h'hh(h)h*hGh,}r(h.]h/]h0]h1]h3]uh5K$h6hh!]r(h?XYou may want to check out rr}r(h&XYou may want to check out h'jubcdocutils.nodes reference r)r}r(h&XY`testing rsyslog ratelimiting `_h,}r(UnameXtesting rsyslog ratelimitingUrefurirX7http://www.rsyslog.com/first-try-to-test-rate-limiting/r h1]h0]h.]h/]h3]uh'jh!]r!h?Xtesting rsyslog ratelimitingr"r#}r$(h&Uh'jubah*U referencer%ubcdocutils.nodes target r&)r'}r((h&X: U referencedr)Kh'jh*Utargetr*h,}r+(Urefurij h1]r,h ah0]h.]h/]h3]r-hauh!]ubh?X< for some extra information on the per-process ratelimiting.r.r/}r0(h&X< for some extra information on the per-process ratelimiting.h'jubeubeubh#)r1}r2(h&Uh'h$h(h)h*h+h,}r3(h.]h/]h0]h1]r4hah3]r5hauh5K)h6hh!]r6(h8)r7}r8(h&X Discussionr9h'j1h(h)h*h(h&j9h'j7ubaubh)r?}r@(h&Uh'j1h(h)h*hh,}rA(hX*h1]h0]h.]h/]h3]uh5K+h6hh!]rB(h)rC}rD(h&XxVery old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message. h'j?h(h)h*hh,}rE(h.]h/]h0]h1]h3]uh5Nh6hh!]rFhC)rG}rH(h&XwVery old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message.rIh'jCh(h)h*hGh,}rJ(h.]h/]h0]h1]h3]uh5K+h!]rKh?XwVery old versions of rsyslog did not have the ability to include the repeated message itself within the repeat message.rLrM}rN(h&jIh'jGubaubaubh)rO}rP(h&XVersions before 7.3.2 applied repeat message reduction to the output side. This had some implications: - they did not account for the actual message origin, so two processes emitting an equally-looking messsage triggered the repeated message reduction code - repeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and above h'j?h(Nh*hh,}rQ(h.]h/]h0]h1]h3]uh5Nh6hh!]rR(hC)rS}rT(h&XfVersions before 7.3.2 applied repeat message reduction to the output side. This had some implications:rUh'jOh(h)h*hGh,}rV(h.]h/]h0]h1]h3]uh5K.h!]rWh?XfVersions before 7.3.2 applied repeat message reduction to the output side. This had some implications:rXrY}rZ(h&jUh'jSubaubh)r[}r\(h&Uh,}r](hX-h1]h0]h.]h/]h3]uh'jOh!]r^(h)r_}r`(h&Xthey did not account for the actual message origin, so two processes emitting an equally-looking messsage triggered the repeated message reduction code h,}ra(h.]h/]h0]h1]h3]uh'j[h!]rbhC)rc}rd(h&Xthey did not account for the actual message origin, so two processes emitting an equally-looking messsage triggered the repeated message reduction codereh'j_h(h)h*hGh,}rf(h.]h/]h0]h1]h3]uh5K1h!]rgh?Xthey did not account for the actual message origin, so two processes emitting an equally-looking messsage triggered the repeated message reduction coderhri}rj(h&jeh'jcubaubah*hubh)rk}rl(h&Xxrepeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and above h,}rm(h.]h/]h0]h1]h3]uh'j[h!]rnhC)ro}rp(h&Xwrepeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and aboverqh'jkh(h)h*hGh,}rr(h.]h/]h0]h1]h3]uh5K5h!]rsh?Xwrepeat message processing could be set on a per-action basis, which has switched to per-input basis for 7.3.2 and abovertru}rv(h&jqh'joubaubah*hubeh*hubeubh)rw}rx(h&XWhile turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can't handle the "last message repeated" format.h'j?h(h)h*hh,}ry(h.]h/]h0]h1]h3]uh5Nh6hh!]rzhC)r{}r|(h&XWhile turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can't handle the "last message repeated" format.r}h'jwh(h)h*hGh,}r~(h.]h/]h0]h1]h3]uh5K8h!]rh?XWhile turning this feature on can save some space in logs, most log analysis tools need to see the repeated messages, they can't handle the "last message repeated" format.rr}r(h&j}h'j{ubaubaubh)r}r(h&XThis is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools. h'j?h(h)h*hh,}r(h.]h/]h0]h1]h3]uh5Nh6hh!]rhC)r}r(h&XThis is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools.rh'jh(h)h*hGh,}r(h.]h/]h0]h1]h3]uh5K;h!]rh?XThis is a feature that worked decades ago when logs were small and reviewed by a human, it fails badly on high volume logs processed by tools.rr}r(h&jh'jubaubaubeubeubh#)r}r(h&Uh'h$h(h)h*h+h,}r(h.]h/]h0]h1]rhah3]rh auh5K?h6hh!]r(h8)r}r(h&XSamplerh'jh(h)h*h`_ project. Copyright © 2007-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h'jh(h)h*hGh,}r(h.]h/]h0]h1]h3]uh5KGh6hh!]r(h?X"This documentation is part of the rr}r(h&X"This documentation is part of the h'jubj)r}r(h&X$`rsyslog `_h,}r(Unameh jXhttp://www.rsyslog.com/rh1]h0]h.]h/]h3]uh'jh!]rh?Xrsyslogrr}r(h&Uh'jubah*j%ubj&)r}r(h&X j)Kh'jh*j*h,}r(Urefurijh1]rhah0]h.]h/]h3]rh auh!]ubh?X$ project. Copyright © 2007-2014 by rr}r(h&X$ project. Copyright © 2007-2014 by h'jubj)r}r(h&X3`Rainer Gerhards `_h,}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrh1]h0]h.]h/]h3]uh'jh!]rh?XRainer Gerhardsrr}r(h&Uh'jubah*j%ubj&)r}r(h&X! j)Kh'jh*j*h,}r(Urefurijh1]rhah0]h.]h/]h3]rhauh!]ubh?X and rr}r(h&X and h'jubj)r}r(h&X$`Adiscon `_h,}r(UnameXAdisconjXhttp://www.adiscon.com/rh1]h0]h.]h/]h3]uh'jh!]rh?XAdisconrr}r(h&Uh'jubah*j%ubj&)r}r(h&X j)Kh'jh*j*h,}r(Urefurijh1]rhah0]h.]h/]h3]rh auh!]ubh?X1. Released under the GNU GPL version 2 or higher.rr}r(h&X1. Released under the GNU GPL version 2 or higher.h'jubeubeubeubah&UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh6hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr (cdocutils.frontend Values r or }r (Ufootnote_backlinksr KUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhh)Ugettext_compactr?U generatorr@NUdump_internalsrANU smart_quotesrBU pep_base_urlrCU https://www.python.org/dev/peps/rDUsyntax_highlightrEUlongrFUinput_encoding_error_handlerrGj"Uauto_id_prefixrHUidrIUdoctitle_xformrJUstrip_elements_with_classesrKNU _config_filesrL]Ufile_insertion_enabledrMU raw_enabledrNKU dump_settingsrONubUsymbol_footnote_startrPKUidsrQ}rR(hhhhehj1hjhjhjhh$h j'hjuUsubstitution_namesrS}rTh*h6h,}rU(h.]h1]h0]Usourceh)h/]h3]uU footnotesrV]rWUrefidsrX}rYub.build/.doctrees/configuration/action/rsconf1_dirgroup.doctree0000664000175000017500000001362713035122641023514 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXadisconqXrsyslogqX $dirgroupq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUadisconqhUrsyslogqh UdirgroupquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXL/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_dirgroup.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*h auUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX $DirGroupq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X $DirGroupq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX **Default:**qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qPh@)qQ}qR(hhNh"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubaubh9)qX}qY(hX**Description:**qZhhhhh h=h"}q[(h$]h%]h&]h']h)]uh+Kh,hh]q\h@)q]}q^(hhZh"}q_(h$]h%]h&]h']h)]uhhXh]q`h5X Description:qaqb}qc(hUhh]ubah hHubaubh9)qd}qe(hX&Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on during startup processing. Interim changes to the user mapping are not detected.qfhhhhh h=h"}qg(h$]h%]h&]h']h)]uh+K h,hh]qhh5X&Set the group for directories newly created. Please note that this setting does not affect the group of directories already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd on during startup processing. Interim changes to the user mapping are not detected.qiqj}qk(hhfhhdubaubh9)ql}qm(hX **Sample:**qnhhhhh h=h"}qo(h$]h%]h&]h']h)]uh+Kh,hh]qph@)qq}qr(hhnh"}qs(h$]h%]h&]h']h)]uhhlh]qth5XSample:quqv}qw(hUhhqubah hHubaubh9)qx}qy(hX``$DirGroup loggroup``qzhhhhh h=h"}q{(h$]h%]h&]h']h)]uh+Kh,hh]q|cdocutils.nodes literal q})q~}q(hhzh"}q(h$]h%]h&]h']h)]uhhxh]qh5X$DirGroup loggroupqq}q(hUhh~ubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(UnamehUrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingr U utf-8-sigr U_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledr KU dump_settingsr!NubUsymbol_footnote_startr"KUidsr#}r$(hhhhhhhhuUsubstitution_namesr%}r&h h,h"}r'(h$]h']h&]Usourcehh%]h)]uU footnotesr(]r)Urefidsr*}r+ub.build/.doctrees/configuration/action/rsconf1_dynafilecachesize.doctree0000664000175000017500000002023013035122641025317 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXadisconqXrsyslogqX$dynafilecachesizeq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUadisconqhUrsyslogqh UdynafilecachesizequUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXU/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_dynafilecachesize.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*h auUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$DynaFileCacheSizeq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$DynaFileCacheSizeq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** 10qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X 10qXqY}qZ(hX 10hhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hX%This directive specifies the maximum size of the cache for dynamically-generated file names. Selector lines with dynamic files names ('?' indicator) support writing to multiple files with a single selector line. This setting specifies how many open file handles should be cached. If, for example, the file name is generated with the hostname in it and you have 100 different hosts, a cache size of 100 would ensure that files are opened once and then stay open. This can be a great way to increase performance. If the cache size is lower than the number of different files, the least recently used one is discarded (and the file closed). The hardcoded maximum is 10,000 - a value that we assume should already be very extreme. Please note that if you expect to run with a very large number of files, you probably need to reconfigure the kernel to support such a large number. In practice, we do NOT recommend to use a cache of more than 1,000 entries. The cache lookup would probably require more time than the open and close operations. The minimum value is 1.qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5X%This directive specifies the maximum size of the cache for dynamically-generated file names. Selector lines with dynamic files names ('?' indicator) support writing to multiple files with a single selector line. This setting specifies how many open file handles should be cached. If, for example, the file name is generated with the hostname in it and you have 100 different hosts, a cache size of 100 would ensure that files are opened once and then stay open. This can be a great way to increase performance. If the cache size is lower than the number of different files, the least recently used one is discarded (and the file closed). The hardcoded maximum is 10,000 - a value that we assume should already be very extreme. Please note that if you expect to run with a very large number of files, you probably need to reconfigure the kernel to support such a large number. In practice, we do NOT recommend to use a cache of more than 1,000 entries. The cache lookup would probably require more time than the open and close operations. The minimum value is 1.qlqm}qn(hhihhgubaubh9)qo}qp(hXNumbers are always in decimal. Leading zeros should be avoided (in some later version, they may be mis-interpreted as being octal). Multiple directives may be given. They are applied to selector lines based on order of appearance.qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh5XNumbers are always in decimal. Leading zeros should be avoided (in some later version, they may be mis-interpreted as being octal). Multiple directives may be given. They are applied to selector lines based on order of appearance.qtqu}qv(hhqhhoubaubh9)qw}qx(hX **Sample:**qyhhhhh h=h"}qz(h$]h%]h&]h']h)]uh+K h,hh]q{h@)q|}q}(hhyh"}q~(h$]h%]h&]h']h)]uhhwh]qh5XSample:qq}q(hUhh|ubah hHubaubh9)q}q(hX?``$DynaFileCacheSize 100    # a cache of 100 files at most``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K"h,hh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X;$DynaFileCacheSize 100    # a cache of 100 files at mostqq}q(hUhhubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K$h,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(UnamehUrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqÅq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.q˅q}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesr Utrim_footnote_reference_spacer Uenvr NUdump_pseudo_xmlr NUexpose_internalsr NUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlr U https://www.python.org/dev/peps/r!Usyntax_highlightr"Ulongr#Uinput_encoding_error_handlerr$hUauto_id_prefixr%Uidr&Udoctitle_xformr'Ustrip_elements_with_classesr(NU _config_filesr)]Ufile_insertion_enabledr*U raw_enabledr+KU dump_settingsr,NubUsymbol_footnote_startr-KUidsr.}r/(hhhhhhhhuUsubstitution_namesr0}r1h h,h"}r2(h$]h']h&]Usourcehh%]h)]uU footnotesr3]r4Urefidsr5}r6ub.build/.doctrees/configuration/action/rsconf1_gssforwardservicename.doctree0000664000175000017500000001464013035122641026260 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqX$gssforwardservicenameqNXrainer gerhardsqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUgssforwardservicenameqhUrainer-gerhardsqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXY/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_gssforwardservicename.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$GssForwardServiceNameq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$GssForwardServiceNameq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** hostqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X hostqXqY}qZ(hX hosthhLubeubh9)q[}q\(hX**Provided by:** *omgssapi*q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_(h@)q`}qa(hX**Provided by:**h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Provided by:qdqe}qf(hUhh`ubah hHubh5X qg}qh(hX hh[ubcdocutils.nodes emphasis qi)qj}qk(hX *omgssapi*h"}ql(h$]h%]h&]h']h)]uhh[h]qmh5Xomgssapiqnqo}qp(hUhhjubah Uemphasisqqubeubh9)qr}qs(hX**Description:**qthhhhh h=h"}qu(h$]h%]h&]h']h)]uh+K h,hh]qvh@)qw}qx(hhth"}qy(h$]h%]h&]h']h)]uhhrh]qzh5X Description:q{q|}q}(hUhhwubah hHubaubh9)q~}q(hXWSpecifies the service name used by the client when forwarding GSS-API wrapped messages.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K h,hh]qh5XWSpecifies the service name used by the client when forwarding GSS-API wrapped messages.qq}q(hhhh~ubaubh9)q}q(hXjThe GSS-API service names are constructed by appending '@' and a hostname following "@@" in each selector.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5XjThe GSS-API service names are constructed by appending '@' and a hostname following "@@" in each selector.qq}q(hhhhubaubh9)q}q(hX **Sample:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XSample:qq}q(hUhhubah hHubaubh9)q}q(hX"``$GssForwardServiceName rsyslog``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X$GssForwardServiceName rsyslogqq}q(hUhhubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by q…q}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqʅq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and q҅q}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqڅq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.q⅁q}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryr U language_coder Uenr U datestampr NU report_levelr KU _destinationrNU halt_levelrKU strip_classesrNh2NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesr Utrim_footnote_reference_spacer!Uenvr"NUdump_pseudo_xmlr#NUexpose_internalsr$NUsectsubtitle_xformr%U source_linkr&NUrfc_referencesr'NUoutput_encodingr(Uutf-8r)U source_urlr*NUinput_encodingr+U utf-8-sigr,U_disable_configr-NU id_prefixr.UU tab_widthr/KUerror_encodingr0UUTF-8r1U_sourcer2hUgettext_compactr3U generatorr4NUdump_internalsr5NU smart_quotesr6U pep_base_urlr7U https://www.python.org/dev/peps/r8Usyntax_highlightr9Ulongr:Uinput_encoding_error_handlerr;jUauto_id_prefixr<Uidr=Udoctitle_xformr>Ustrip_elements_with_classesr?NU _config_filesr@]Ufile_insertion_enabledrAU raw_enabledrBKU dump_settingsrCNubUsymbol_footnote_startrDKUidsrE}rF(hhhhhhhhuUsubstitution_namesrG}rHh h,h"}rI(h$]h']h&]Usourcehh%]h)]uU footnotesrJ]rKUrefidsrL}rMub.build/.doctrees/configuration/action/rsconf1_actionexeconlywhenpreviousissuspended.doctree0000664000175000017500000002420013035122641031620 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXrainer gerhardsqX&$actionexeconlywhenpreviousissuspendedqNXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUrainer-gerhardsqhU%actionexeconlywhenpreviousissuspendedqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXi/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_actionexeconlywhenpreviousissuspended.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX&$ActionExecOnlyWhenPreviousIsSuspendedq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X&$ActionExecOnlyWhenPreviousIsSuspendedq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** offqNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X offqXqY}qZ(hX offhhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hX[This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder).qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5X[This directive allows to specify if actions should always be executed ("off," the default) or only if the previous action is suspended ("on"). This directive works hand-in-hand with the multiple actions per selector feature. It can be used, for example, to create rules that automatically switch destination servers or databases to a (set of) backup(s), if the primary server fails. Note that this feature depends on proper implementation of the suspend feature in the output module. All built-in output modules properly support it (most importantly the database write and the syslog message forwarder).qlqm}qn(hhihhgubaubh9)qo}qp(hXhThis selector processes all messages it receives (\*.\*). It tries to forward every message to primary-syslog.example.com (via tcp). If it can not reach that server, it tries secondary-1-syslog.example.com, if that fails too, it tries secondary-2-syslog.example.com. If neither of these servers can be connected, the data is stored in /var/log/localbuffer. Please note that the secondaries and the local log buffer are only used if the one before them does not work. So ideally, /var/log/localbuffer will never receive a message. If one of the servers resumes operation, it automatically takes over processing again.hhhhh h=h"}qq(h$]h%]h&]h']h)]uh+Kh,hh]qrh5XfThis selector processes all messages it receives (*.*). It tries to forward every message to primary-syslog.example.com (via tcp). If it can not reach that server, it tries secondary-1-syslog.example.com, if that fails too, it tries secondary-2-syslog.example.com. If neither of these servers can be connected, the data is stored in /var/log/localbuffer. Please note that the secondaries and the local log buffer are only used if the one before them does not work. So ideally, /var/log/localbuffer will never receive a message. If one of the servers resumes operation, it automatically takes over processing again.qsqt}qu(hXhThis selector processes all messages it receives (\*.\*). It tries to forward every message to primary-syslog.example.com (via tcp). If it can not reach that server, it tries secondary-1-syslog.example.com, if that fails too, it tries secondary-2-syslog.example.com. If neither of these servers can be connected, the data is stored in /var/log/localbuffer. Please note that the secondaries and the local log buffer are only used if the one before them does not work. So ideally, /var/log/localbuffer will never receive a message. If one of the servers resumes operation, it automatically takes over processing again.hhoubaubh9)qv}qw(hXWe strongly advise not to use repeated line reduction together with ActionExecOnlyWhenPreviousIsSuspended. It may lead to "interesting" and undesired results (but you can try it if you like).qxhhhhh h=h"}qy(h$]h%]h&]h']h)]uh+Kh,hh]qzh5XWe strongly advise not to use repeated line reduction together with ActionExecOnlyWhenPreviousIsSuspended. It may lead to "interesting" and undesired results (but you can try it if you like).q{q|}q}(hhxhhvubaubh9)q~}q(hX **Sample:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K"h,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhh~h]qh5XSample:qq}q(hUhhubah hHubaubh9)q}q(hX`\*.\* @@primary-syslog.example.com $ActionExecOnlyWhenPreviousIsSuspended on & @@secondary-1-syslog.example.com # & is used to have more than one action for & @@secondary-2-syslog.example.com # the same selector - the mult-action feature & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off # to re-set it for the next selectorqhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K$h,hh]qh5X^*.* @@primary-syslog.example.com $ActionExecOnlyWhenPreviousIsSuspended on & @@secondary-1-syslog.example.com # & is used to have more than one action for & @@secondary-2-syslog.example.com # the same selector - the mult-action feature & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off # to re-set it for the next selectorqq}q(hX`\*.\* @@primary-syslog.example.com $ActionExecOnlyWhenPreviousIsSuspended on & @@secondary-1-syslog.example.com # & is used to have more than one action for & @@secondary-2-syslog.example.com # the same selector - the mult-action feature & /var/log/localbuffer $ActionExecOnlyWhenPreviousIsSuspended off # to re-set it for the next selectorhhubaubh9)q}q(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K&h,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project.qq}q(hX project.hhubeubh9)q}q(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K)h,hh]q(h5XCopyright © 2007 by qq}q(hXCopyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qÅq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconq˅q}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qӅq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelrKU strip_classesrNh2NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsr NU docinfo_xformr KUwarning_streamr NUpep_file_url_templater Upep-%04dr Uexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthr KUerror_encodingr!UUTF-8r"U_sourcer#hUgettext_compactr$U generatorr%NUdump_internalsr&NU smart_quotesr'U pep_base_urlr(U https://www.python.org/dev/peps/r)Usyntax_highlightr*Ulongr+Uinput_encoding_error_handlerr,jUauto_id_prefixr-Uidr.Udoctitle_xformr/Ustrip_elements_with_classesr0NU _config_filesr1]Ufile_insertion_enabledr2U raw_enabledr3KU dump_settingsr4NubUsymbol_footnote_startr5KUidsr6}r7(hhhhhhhhuUsubstitution_namesr8}r9h h,h"}r:(h$]h']h&]Usourcehh%]h)]uU footnotesr;]r<Urefidsr=}r>ub.build/.doctrees/configuration/action/rsconf1_filegroup.doctree0000664000175000017500000001361013035122641023645 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXrainer gerhardsqX $filegroupqNXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUrainer-gerhardsqhU filegroupqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXM/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_filegroup.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX $FileGroupq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X $FileGroupq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX **Default:**qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qPh@)qQ}qR(hhNh"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubaubh9)qX}qY(hX**Description:**qZhhhhh h=h"}q[(h$]h%]h&]h']h)]uh+Kh,hh]q\h@)q]}q^(hhZh"}q_(h$]h%]h&]h']h)]uhhXh]q`h5X Description:qaqb}qc(hUhh]ubah hHubaubh9)qd}qe(hXSet the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qfhhhhh h=h"}qg(h$]h%]h&]h']h)]uh+K h,hh]qhh5XSet the group for dynaFiles newly created. Please note that this setting does not affect the group of files already existing. The parameter is a group name, for which the groupid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qiqj}qk(hhfhhdubaubh9)ql}qm(hX **Sample:**qnhhhhh h=h"}qo(h$]h%]h&]h']h)]uh+Kh,hh]qph@)qq}qr(hhnh"}qs(h$]h%]h&]h']h)]uhhlh]qth5XSample:quqv}qw(hUhhqubah hHubaubh9)qx}qy(hX``$FileGroup loggroup``qzhhhhh h=h"}q{(h$]h%]h&]h']h)]uh+Kh,hh]q|cdocutils.nodes literal q})q~}q(hhzh"}q(h$]h%]h&]h']h)]uhhxh]qh5X$FileGroup loggroupqq}q(hUhh~ubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingr U utf-8-sigr U_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledr KU dump_settingsr!NubUsymbol_footnote_startr"KUidsr#}r$(hhhhhhhhuUsubstitution_namesr%}r&h h,h"}r'(h$]h']h&]Usourcehh%]h)]uU footnotesr(]r)Urefidsr*}r+ub.build/.doctrees/configuration/action/rsconf1_dirowner.doctree0000664000175000017500000001362513035122641023510 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqX $dirownerqNXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUdirownerqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXL/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_dirowner.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX $DirOwnerq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X $DirOwnerq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX **Default:**qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qPh@)qQ}qR(hhNh"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubaubh9)qX}qY(hX**Description:**qZhhhhh h=h"}q[(h$]h%]h&]h']h)]uh+Kh,hh]q\h@)q]}q^(hhZh"}q_(h$]h%]h&]h']h)]uhhXh]q`h5X Description:qaqb}qc(hUhh]ubah hHubaubh9)qd}qe(hX&Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qfhhhhh h=h"}qg(h$]h%]h&]h']h)]uh+K h,hh]qhh5X&Set the file owner for directories newly created. Please note that this setting does not affect the owner of directories already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qiqj}qk(hhfhhdubaubh9)ql}qm(hX **Sample:**qnhhhhh h=h"}qo(h$]h%]h&]h']h)]uh+Kh,hh]qph@)qq}qr(hhnh"}qs(h$]h%]h&]h']h)]uhhlh]qth5XSample:quqv}qw(hUhhqubah hHubaubh9)qx}qy(hX``$DirOwner loguser``qzhhhhh h=h"}q{(h$]h%]h&]h']h)]uh+Kh,hh]q|cdocutils.nodes literal q})q~}q(hhzh"}q(h$]h%]h&]h']h)]uhhxh]qh5X$DirOwner loguserqq}q(hUhh~ubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingr U utf-8-sigr U_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledr KU dump_settingsr!NubUsymbol_footnote_startr"KUidsr#}r$(hhhhhhhhuUsubstitution_namesr%}r&h h,h"}r'(h$]h']h&]Usourcehh%]h)]uU footnotesr(]r)Urefidsr*}r+ub.build/.doctrees/configuration/action/index.doctree0000664000175000017500000015521313035122641021333 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X'generic action configuration statementsqNX(omfile-specific configuration statementsqNX'omfwd-specific configuration statementsqNX*omgssapi-specific configuration statementsq NX/legacy action-specific configuration statementsq NX.action-queue specific configuration statementsq NXommailq uUsubstitution_defsq }qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU'generic-action-configuration-statementsqhU(omfile-specific-configuration-statementsqhU'omfwd-specific-configuration-statementsqh U*omgssapi-specific-configuration-statementsqh U/legacy-action-specific-configuration-statementsqh U.action-queue-specific-configuration-statementsqh UommailquUchildrenq]qcdocutils.nodes section q)q }q!(U rawsourceq"UUparentq#hUsourceq$XA/home/rger/proj/rsyslog-doc/source/configuration/action/index.rstq%Utagnameq&Usectionq'U attributesq(}q)(Udupnamesq*]Uclassesq+]Ubackrefsq,]Uidsq-]q.haUnamesq/]q0h auUlineq1KUdocumentq2hh]q3(cdocutils.nodes title q4)q5}q6(h"X/Legacy Action-Specific Configuration Statementsq7h#h h$h%h&Utitleq8h(}q9(h*]h+]h,]h-]h/]uh1Kh2hh]q:cdocutils.nodes Text q;X/Legacy Action-Specific Configuration Statementsq(h"h7h#h5ubaubcdocutils.nodes paragraph q?)q@}qA(h"XStatements modify the next action(s) that is/are defined **via legacy syntax** after the respective statement. Actions defined via the action() object are **not** affected by the legacy statements listed here. Use the action() object properties instead.h#h h$h%h&U paragraphqBh(}qC(h*]h+]h,]h-]h/]uh1Kh2hh]qD(h;X9Statements modify the next action(s) that is/are defined qEqF}qG(h"X9Statements modify the next action(s) that is/are defined h#h@ubcdocutils.nodes strong qH)qI}qJ(h"X**via legacy syntax**h(}qK(h*]h+]h,]h-]h/]uh#h@h]qLh;Xvia legacy syntaxqMqN}qO(h"Uh#hIubah&UstrongqPubh;XM after the respective statement. Actions defined via the action() object are qQqR}qS(h"XM after the respective statement. Actions defined via the action() object are h#h@ubhH)qT}qU(h"X**not**h(}qV(h*]h+]h,]h-]h/]uh#h@h]qWh;XnotqXqY}qZ(h"Uh#hTubah&hPubh;X[ affected by the legacy statements listed here. Use the action() object properties instead.q[q\}q](h"X[ affected by the legacy statements listed here. Use the action() object properties instead.h#h@ubeubh)q^}q_(h"Uh#h h$h%h&h'h(}q`(h*]h+]h,]h-]qahah/]qbhauh1K h2hh]qc(h4)qd}qe(h"X'Generic action configuration Statementsqfh#h^h$h%h&h8h(}qg(h*]h+]h,]h-]h/]uh1K h2hh]qhh;X'Generic action configuration Statementsqiqj}qk(h"hfh#hdubaubh?)ql}qm(h"X7These statements can be used with all types of actions.qnh#h^h$h%h&hBh(}qo(h*]h+]h,]h-]h/]uh1K h2hh]qph;X7These statements can be used with all types of actions.qqqr}qs(h"hnh#hlubaubcdocutils.nodes compound qt)qu}qv(h"Uh#h^h$h%h&Ucompoundqwh(}qx(h*]h+]qyUtoctree-wrapperqzah,]h-]h/]uh1Nh2hh]q{csphinx.addnodes toctree q|)q}}q~(h"Uh#huh$h%h&Utoctreeqh(}q(UnumberedqKU includehiddenqh#Xconfiguration/action/indexqUcaptionqNUglobqh-]h,]U titlesonlyqh*]h+]h/]Uentriesq]q(NXBconfiguration/action/rsconf1_actionexeconlywhenpreviousissuspendedqqNX1configuration/action/rsconf1_actionresumeintervalqqNX1configuration/action/rsconf1_repeatedmsgreductionqqeUhiddenqU includefilesq]q(hhheUmaxdepthqJuh1Kh]ubaubcdocutils.nodes bullet_list q)q}q(h"Uh#h^h$h%h&U bullet_listqh(}q(UbulletqX-h-]h,]h*]h+]h/]uh1Kh2hh]q(cdocutils.nodes list_item q)q}q(h"X**$ActionName** - used primarily for documentation, e.g. when generating a configuration graph. Available sice 4.3.1.h#hh$h%h&U list_itemqh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qh?)q}q(h"X**$ActionName** - used primarily for documentation, e.g. when generating a configuration graph. Available sice 4.3.1.h#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]q(hH)q}q(h"X**$ActionName**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;X $ActionNameqq}q(h"Uh#hubah&hPubh;Xv - used primarily for documentation, e.g. when generating a configuration graph. Available sice 4.3.1.qq}q(h"Xx - used primarily for documentation, e.g. when generating a configuration graph. Available sice 4.3.1.h#hubeubaubh)q}q(h"X**$ActionExecOnlyOnceEveryInterval** - execute action only if the last execute is at last seconds in the past (more info in `ommail `_, but may be used with any action). To disable this setting, use value 0.h#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qh?)q}q(h"X**$ActionExecOnlyOnceEveryInterval** - execute action only if the last execute is at last seconds in the past (more info in `ommail `_, but may be used with any action). To disable this setting, use value 0.h#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]q(hH)q}q(h"X$**$ActionExecOnlyOnceEveryInterval**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;X $ActionExecOnlyOnceEveryIntervalqq}q(h"Uh#hubah&hPubh;Xl - execute action only if the last execute is at last seconds in the past (more info in qq}q(h"Xl - execute action only if the last execute is at last seconds in the past (more info in h#hubcdocutils.nodes reference q)q}q(h"X`ommail `_h(}q(Unameh UrefuriqX ommail.htmlqh-]h,]h*]h+]h/]uh#hh]qh;XommailqDžq}q(h"Uh#hubah&U referencequbcdocutils.nodes target q)q}q(h"X U referencedqKh#hh&Utargetqh(}q(Urefurihh-]qhah,]h*]h+]h/]qh auh]ubh;XI, but may be used with any action). To disable this setting, use value 0.qӅq}q(h"XI, but may be used with any action). To disable this setting, use value 0.h#hubeubaubh)q}q(h"X**$ActionExecOnlyEveryNthTime** - If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on. Note: this setting is automatically re-set when the actual action is defined.h#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qh?)q}q(h"X**$ActionExecOnlyEveryNthTime** - If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on. Note: this setting is automatically re-set when the actual action is defined.h#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1Kh]q(hH)q}q(h"X**$ActionExecOnlyEveryNthTime**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;X$ActionExecOnlyEveryNthTimeq⅁q}q(h"Uh#hubah&hPubh;X - If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on. Note: this setting is automatically re-set when the actual action is defined.q允q}q(h"X - If configured, the next action will only be executed every n-th time. For example, if configured to 3, the first two messages that go into the action will be dropped, the 3rd will actually cause the action to execute, the 4th and 5th will be dropped, the 6th executed under the action, ... and so on. Note: this setting is automatically re-set when the actual action is defined.h#hubeubaubh)q}q(h"X**$ActionExecOnlyEveryNthTimeTimeout** - has a meaning only if $ActionExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. *Why is this option needed?* Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a $ActionExecOnlyEveryNthTimeTimeout 1200 This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.h#hh$h%h&hh(}q(h*]h+]h,]h-]h/]uh1Nh2hh]qh?)q}q(h"X**$ActionExecOnlyEveryNthTimeTimeout** - has a meaning only if $ActionExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. *Why is this option needed?* Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a $ActionExecOnlyEveryNthTimeTimeout 1200 This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.h#hh$h%h&hBh(}q(h*]h+]h,]h-]h/]uh1K!h]q(hH)q}q(h"X&**$ActionExecOnlyEveryNthTimeTimeout**h(}q(h*]h+]h,]h-]h/]uh#hh]qh;X"$ActionExecOnlyEveryNthTimeTimeoutqq}q(h"Uh#hubah&hPubh;X" - has a meaning only if $ActionExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. qq}q(h"X" - has a meaning only if $ActionExecOnlyEveryNthTime is also configured for the same action. If so, the timeout setting specifies after which period the counting of "previous actions" expires and a new action count is begun. Specify 0 (the default) to disable timeouts. h#hubcdocutils.nodes emphasis q)q}q(h"X*Why is this option needed?*h(}q(h*]h+]h,]h-]h/]uh#hh]qh;XWhy is this option needed?qr}r(h"Uh#hubah&Uemphasisrubh;X Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a $ActionExecOnlyEveryNthTimeTimeout 1200 This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.rr}r(h"X Consider this case: a message comes in at, eg., 10am. That's count 1. Then, nothing happens for the next 10 hours. At 8pm, the next one occurs. That's count 2. Another 5 hours later, the next message occurs, bringing the total count to 3. Thus, this message now triggers the rule. The question is if this is desired behavior? Or should the rule only be triggered if the messages occur within an e.g. 20 minute window? If the later is the case, you need a $ActionExecOnlyEveryNthTimeTimeout 1200 This directive will timeout previous messages seen if they are older than 20 minutes. In the example above, the count would now be always 1 and consequently no rule would ever be triggered.h#hubeubaubh)r}r(h"XB**$ActionResumeRetryCount** [default 0, -1 means eternal]rh#hh$h%h&hh(}r (h*]h+]h,]h-]h/]uh1Nh2hh]r h?)r }r (h"jh#jh$h%h&hBh(}r (h*]h+]h,]h-]h/]uh1K2h]r(hH)r}r(h"X**$ActionResumeRetryCount**h(}r(h*]h+]h,]h-]h/]uh#j h]rh;X$ActionResumeRetryCountrr}r(h"Uh#jubah&hPubh;X' [default 0, -1 means eternal]rr}r(h"X' [default 0, -1 means eternal]h#j ubeubaubh)r}r(h"X[**$ActionWriteAllMarkMessages** [on/**off**]- [available since 5.1.5] - normally, mark messages are written to actions only if the action was not recently executed (by default, recently means within the past 20 minutes). If this setting is switched to "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. Note that this option auto-resets to "off", so if you intend to use it with multiple actions, it must be specified in front off **all** selector lines that should provide this functionality. h#hh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"XZ**$ActionWriteAllMarkMessages** [on/**off**]- [available since 5.1.5] - normally, mark messages are written to actions only if the action was not recently executed (by default, recently means within the past 20 minutes). If this setting is switched to "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. Note that this option auto-resets to "off", so if you intend to use it with multiple actions, it must be specified in front off **all** selector lines that should provide this functionality.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K3h]r (hH)r!}r"(h"X**$ActionWriteAllMarkMessages**h(}r#(h*]h+]h,]h-]h/]uh#jh]r$h;X$ActionWriteAllMarkMessagesr%r&}r'(h"Uh#j!ubah&hPubh;X [on/r(r)}r*(h"X [on/h#jubhH)r+}r,(h"X**off**h(}r-(h*]h+]h,]h-]h/]uh#jh]r.h;Xoffr/r0}r1(h"Uh#j+ubah&hPubh;X]- [available since 5.1.5] - normally, mark messages are written to actions only if the action was not recently executed (by default, recently means within the past 20 minutes). If this setting is switched to "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. Note that this option auto-resets to "off", so if you intend to use it with multiple actions, it must be specified in front off r2r3}r4(h"X]- [available since 5.1.5] - normally, mark messages are written to actions only if the action was not recently executed (by default, recently means within the past 20 minutes). If this setting is switched to "on", mark messages are always sent to actions, no matter how recently they have been executed. In this mode, mark messages can be used as a kind of heartbeat. Note that this option auto-resets to "off", so if you intend to use it with multiple actions, it must be specified in front off h#jubhH)r5}r6(h"X**all**h(}r7(h*]h+]h,]h-]h/]uh#jh]r8h;Xallr9r:}r;(h"Uh#j5ubah&hPubh;X7 selector lines that should provide this functionality.r<r=}r>(h"X7 selector lines that should provide this functionality.h#jubeubaubeubeubh)r?}r@(h"Uh#h h$h%h&h'h(}rA(h*]h+]h,]h-]rBhah/]rChauh1K>h2hh]rD(h4)rE}rF(h"X(omfile-specific Configuration StatementsrGh#j?h$h%h&h8h(}rH(h*]h+]h,]h-]h/]uh1K>h2hh]rIh;X(omfile-specific Configuration StatementsrJrK}rL(h"jGh#jEubaubh?)rM}rN(h"X6These statements are specific to omfile-based actions.rOh#j?h$h%h&hBh(}rP(h*]h+]h,]h-]h/]uh1K?h2hh]rQh;X6These statements are specific to omfile-based actions.rRrS}rT(h"jOh#jMubaubht)rU}rV(h"Uh#j?h$h%h&hwh(}rW(h*]h+]rXhzah,]h-]h/]uh1Nh2hh]rYh|)rZ}r[(h"Uh#jUh$h%h&hh(}r\(hKhh#hhNhh-]h,]hh*]h+]h/]h]r](NX-configuration/action/rsconf1_omfileforcechownr^r_NX%configuration/action/rsconf1_dirgroupr`raNX%configuration/action/rsconf1_dirownerrbrcNX.configuration/action/rsconf1_dynafilecachesizerdreNX+configuration/action/rsconf1_filecreatemoderfrgNX&configuration/action/rsconf1_filegrouprhriNX&configuration/action/rsconf1_fileownerrjrkehh]rl(j^j`jbjdjfjhjjehJuh1KAh]ubaubh)rm}rn(h"Uh#j?h$h%h&hh(}ro(hX-h-]h,]h*]h+]h/]uh1KHh2hh]rp(h)rq}rr(h"XG**$CreateDirs** [**on**/off] - create directories on an as-needed basish#jmh$h%h&hh(}rs(h*]h+]h,]h-]h/]uh1Nh2hh]rth?)ru}rv(h"XG**$CreateDirs** [**on**/off] - create directories on an as-needed basish#jqh$h%h&hBh(}rw(h*]h+]h,]h-]h/]uh1KHh]rx(hH)ry}rz(h"X**$CreateDirs**h(}r{(h*]h+]h,]h-]h/]uh#juh]r|h;X $CreateDirsr}r~}r(h"Uh#jyubah&hPubh;X [rr}r(h"X [h#juubhH)r}r(h"X**on**h(}r(h*]h+]h,]h-]h/]uh#juh]rh;Xonrr}r(h"Uh#jubah&hPubh;X0/off] - create directories on an as-needed basisrr}r(h"X0/off] - create directories on an as-needed basish#juubeubaubh)r}r(h"X\**$ActionFileDefaultTemplate** [templateName] - sets a new default template for file actionsh#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X\**$ActionFileDefaultTemplate** [templateName] - sets a new default template for file actionsh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1KJh]r(hH)r}r(h"X**$ActionFileDefaultTemplate**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionFileDefaultTemplaterr}r(h"Uh#jubah&hPubh;X> [templateName] - sets a new default template for file actionsrr}r(h"X> [templateName] - sets a new default template for file actionsh#jubeubaubh)r}r(h"XN**$ActionFileEnableSync [on/off]** - enables file syncing capability of omfileh#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"XN**$ActionFileEnableSync [on/off]** - enables file syncing capability of omfileh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1KLh]r(hH)r}r(h"X"**$ActionFileEnableSync [on/off]**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionFileEnableSync [on/off]rr}r(h"Uh#jubah&hPubh;X, - enables file syncing capability of omfilerr}r(h"X, - enables file syncing capability of omfileh#jubeubaubh)r}r(h"X**$OMFileAsyncWriting** [on/**off**], if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable $OMFileFlushInterval, $OMFileAsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when $OMFileFlushOnTXEnd is "on" but $OMFileAsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.h#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$OMFileAsyncWriting** [on/**off**], if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable $OMFileFlushInterval, $OMFileAsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when $OMFileFlushOnTXEnd is "on" but $OMFileAsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1KNh]r(hH)r}r(h"X**$OMFileAsyncWriting**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$OMFileAsyncWritingrr}r(h"Uh#jubah&hPubh;X [on/rr}r(h"X [on/h#jubhH)r}r(h"X**off**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;Xoffrr}r(h"Uh#jubah&hPubh;Xp], if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable $OMFileFlushInterval, $OMFileAsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when $OMFileFlushOnTXEnd is "on" but $OMFileAsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.rr}r(h"Xp], if turned on, the files will be written in asynchronous mode via a separate thread. In that case, double buffers will be used so that one buffer can be filled while the other buffer is being written. Note that in order to enable $OMFileFlushInterval, $OMFileAsyncWriting must be set to "on". Otherwise, the flush interval will be ignored. Also note that when $OMFileFlushOnTXEnd is "on" but $OMFileAsyncWriting is off, output will only be written when the buffer is full. This may take several hours, or even require a rsyslog shutdown. However, a buffer flush can be forced in that case by sending rsyslogd a HUP signal.h#jubeubaubh)r}r(h"X**$OMFileZipLevel** 0..9 [default 0] - if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.h#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$OMFileZipLevel** 0..9 [default 0] - if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1KXh]r(hH)r}r(h"X**$OMFileZipLevel**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$OMFileZipLevelrr}r(h"Uh#jubah&hPubh;X 0..9 [default 0] - if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.rr}r(h"X 0..9 [default 0] - if greater 0, turns on gzip compression of the output file. The higher the number, the better the compression, but also the more CPU is required for zipping.h#jubeubaubh)r}r(h"X4**$OMFileIOBufferSize** , default 4k, size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)h#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X4**$OMFileIOBufferSize** , default 4k, size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K[h]r(hH)r}r(h"X**$OMFileIOBufferSize**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$OMFileIOBufferSizerr}r(h"Uh#jubah&hPubh;X , default 4k, size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)rr}r(h"X , default 4k, size of the buffer used to writing output data. The larger the buffer, the potentially better performance is. The default of 4k is quite conservative, it is useful to go up to 64k, and 128K if you used gzip compression (then, even higher sizes may make sense)h#jubeubaubh)r}r(h"X**$OMFileFlushOnTXEnd** <[**on**/off]>, default on. Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set $OMFileFlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after **each** log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour. h#jmh$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$OMFileFlushOnTXEnd** <[**on**/off]>, default on. Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set $OMFileFlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after **each** log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K`h]r(hH)r}r(h"X**$OMFileFlushOnTXEnd**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$OMFileFlushOnTXEndrr}r(h"Uh#jubah&hPubh;X <[rr}r(h"X <[h#jubhH)r}r(h"X**on**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;Xonrr}r (h"Uh#jubah&hPubh;Xd/off]>, default on. Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set $OMFileFlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after r r }r (h"Xd/off]>, default on. Omfile has the capability to write output using a buffered writer. Disk writes are only done when the buffer is full. So if an error happens during that write, data is potentially lost. In cases where this is unacceptable, set $OMFileFlushOnTXEnd to on. Then, data is written at the end of each transaction (for pre-v5 this means after h#jubhH)r }r(h"X**each**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;Xeachrr}r(h"Uh#j ubah&hPubh;X. log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.rr}r(h"X. log message) and the usual error recovery thus can handle write errors without data loss. Note that this option severely reduces the effect of zip compression and should be switched to off for that use case. Note that the default -on- is primarily an aid to preserve the traditional syslogd behaviour.h#jubeubaubeubeubh)r}r(h"Uh#h h$h%h&h'h(}r(h*]h+]h,]h-]rhah/]rhauh1Kmh2hh]r(h4)r}r(h"X'omfwd-specific Configuration Statementsrh#jh$h%h&h8h(}r (h*]h+]h,]h-]h/]uh1Kmh2hh]r!h;X'omfwd-specific Configuration Statementsr"r#}r$(h"jh#jubaubh?)r%}r&(h"X5These statements are specific to omfwd-based actions.r'h#jh$h%h&hBh(}r((h*]h+]h,]h-]h/]uh1Knh2hh]r)h;X5These statements are specific to omfwd-based actions.r*r+}r,(h"j'h#j%ubaubh)r-}r.(h"Uh#jh$h%h&hh(}r/(hX-h-]h,]h*]h+]h/]uh1Kph2hh]r0(h)r1}r2(h"Xv**$ActionForwardDefaultTemplate** [templateName] - sets a new default template for UDP and plain TCP forwarding actionh#j-h$h%h&hh(}r3(h*]h+]h,]h-]h/]uh1Nh2hh]r4h?)r5}r6(h"Xv**$ActionForwardDefaultTemplate** [templateName] - sets a new default template for UDP and plain TCP forwarding actionh#j1h$h%h&hBh(}r7(h*]h+]h,]h-]h/]uh1Kph]r8(hH)r9}r:(h"X!**$ActionForwardDefaultTemplate**h(}r;(h*]h+]h,]h-]h/]uh#j5h]r<h;X$ActionForwardDefaultTemplater=r>}r?(h"Uh#j9ubah&hPubh;XU [templateName] - sets a new default template for UDP and plain TCP forwarding actionr@rA}rB(h"XU [templateName] - sets a new default template for UDP and plain TCP forwarding actionh#j5ubeubaubh)rC}rD(h"X**$ActionSendResendLastMsgOnReconnect** <[on/**off**]> specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication.h#j-h$h%h&hh(}rE(h*]h+]h,]h-]h/]uh1Nh2hh]rFh?)rG}rH(h"X**$ActionSendResendLastMsgOnReconnect** <[on/**off**]> specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication.h#jCh$h%h&hBh(}rI(h*]h+]h,]h-]h/]uh1Krh]rJ(hH)rK}rL(h"X'**$ActionSendResendLastMsgOnReconnect**h(}rM(h*]h+]h,]h-]h/]uh#jGh]rNh;X#$ActionSendResendLastMsgOnReconnectrOrP}rQ(h"Uh#jKubah&hPubh;X <[on/rRrS}rT(h"X <[on/h#jGubhH)rU}rV(h"X**off**h(}rW(h*]h+]h,]h-]h/]uh#jGh]rXh;XoffrYrZ}r[(h"Uh#jUubah&hPubh;X]> specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication.r\r]}r^(h"X]> specifies if the last message is to be resend when a connecition breaks and has been reconnected. May increase reliability, but comes at the risk of message duplication.h#jGubeubaubh)r_}r`(h"Xl**$ActionSendStreamDriver** just like $DefaultNetstreamDriver, but for the specific actionh#j-h$h%h&hh(}ra(h*]h+]h,]h-]h/]uh1Nh2hh]rbh?)rc}rd(h"Xl**$ActionSendStreamDriver** just like $DefaultNetstreamDriver, but for the specific actionh#j_h$h%h&hBh(}re(h*]h+]h,]h-]h/]uh1Kvh]rf(hH)rg}rh(h"X**$ActionSendStreamDriver**h(}ri(h*]h+]h,]h-]h/]uh#jch]rjh;X$ActionSendStreamDriverrkrl}rm(h"Uh#jgubah&hPubh;XQ just like $DefaultNetstreamDriver, but for the specific actionrnro}rp(h"XQ just like $DefaultNetstreamDriver, but for the specific actionh#jcubeubaubh)rq}rr(h"Xg**$ActionSendStreamDriverMode** , default 0, mode to use with the stream driver (driver-specific)h#j-h$h%h&hh(}rs(h*]h+]h,]h-]h/]uh1Nh2hh]rth?)ru}rv(h"Xg**$ActionSendStreamDriverMode** , default 0, mode to use with the stream driver (driver-specific)h#jqh$h%h&hBh(}rw(h*]h+]h,]h-]h/]uh1Kxh]rx(hH)ry}rz(h"X**$ActionSendStreamDriverMode**h(}r{(h*]h+]h,]h-]h/]uh#juh]r|h;X$ActionSendStreamDriverModer}r~}r(h"Uh#jyubah&hPubh;XH , default 0, mode to use with the stream driver (driver-specific)rr}r(h"XH , default 0, mode to use with the stream driver (driver-specific)h#juubeubaubh)r}r(h"X**$ActionSendStreamDriverAuthMode** ,  authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)h#j-h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$ActionSendStreamDriverAuthMode** ,  authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kzh]r(hH)r}r(h"X#**$ActionSendStreamDriverAuthMode**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionSendStreamDriverAuthModerr}r(h"Uh#jubah&hPubh;X ,  authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)rr}r(h"X ,  authentication mode to use with the stream driver. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific)h#jubeubaubh)r}r(h"X**$ActionSendStreamDriverPermittedPeer** ,  accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific) - directive may go away!h#j-h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$ActionSendStreamDriverPermittedPeer** ,  accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific) - directive may go away!h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1K~h]r(hH)r}r(h"X(**$ActionSendStreamDriverPermittedPeer**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$$ActionSendStreamDriverPermittedPeerrr}r(h"Uh#jubah&hPubh;X ,  accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific) - directive may go away!rr}r(h"X ,  accepted fingerprint (SHA1) or name of remote peer. Note that this directive requires TLS netstream drivers. For all others, it will be ignored. (driver-specific) - directive may go away!h#jubeubaubh)r}r(h"X0**$ActionSendTCPRebindInterval** nbr- [available since 4.5.1] - instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).h#j-h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X0**$ActionSendTCPRebindInterval** nbr- [available since 4.5.1] - instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X **$ActionSendTCPRebindInterval**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionSendTCPRebindIntervalrr}r(h"Uh#jubah&hPubh;X nbr- [available since 4.5.1] - instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).rr}r(h"X nbr- [available since 4.5.1] - instructs the TCP send action to close and re-open the connection to the remote host every nbr of messages sent. Zero, the default, means that no such processing is done. This directive is useful for use with load-balancers. Note that there is some performance overhead associated with it, so it is advisable to not too often "rebind" the connection (what "too often" actually means depends on your configuration, a rule of thumb is that it should be not be much more often than once per second).h#jubeubaubh)r}r(h"X**$ActionSendUDPRebindInterval** nbr- [available since 4.3.2] - instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers. h#j-h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"X**$ActionSendUDPRebindInterval** nbr- [available since 4.3.2] - instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X **$ActionSendUDPRebindInterval**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionSendUDPRebindIntervalrr}r(h"Uh#jubah&hPubh;X nbr- [available since 4.3.2] - instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers.rr}r(h"X nbr- [available since 4.3.2] - instructs the UDP send action to rebind the send socket every nbr of messages sent. Zero, the default, means that no rebind is done. This directive is useful for use with load-balancers.h#jubeubaubeubeubh)r}r(h"Uh#h h$h%h&h'h(}r(h*]h+]h,]h-]rhah/]rh auh1Kh2hh]r(h4)r}r(h"X*omgssapi-specific Configuration Statementsrh#jh$h%h&h8h(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;X*omgssapi-specific Configuration Statementsrr}r(h"jh#jubaubh?)r}r(h"X2These statements are specific to omgssapi actions.rh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;X2These statements are specific to omgssapi actions.rr}r(h"jh#jubaubht)r}r(h"Uh#jh$h%h&hwh(}r(h*]h+]rhzah,]h-]h/]uh1Nh2hh]rh|)r}r(h"Uh#jh$h%h&hh(}r(hKhh#hhNhh-]h,]hh*]h+]h/]h]r(NX2configuration/action/rsconf1_gssforwardservicenamerrNX$configuration/action/rsconf1_gssmoderrehh]r(jjehJuh1Kh]ubaubeubh)r}r(h"Uh#h h$h%h&h'h(}r(h*]h+]h,]h-]rhah/]rh auh1Kh2hh]r(h4)r}r(h"X.action-queue specific Configuration Statementsrh#jh$h%h&h8h(}r(h*]h+]h,]h-]h/]uh1Kh2hh]rh;X.action-queue specific Configuration Statementsrr}r(h"jh#jubaubh?)r}r(h"XThe following statements specify parameters for the action queue. To understand queue parameters, read :doc:`queues in rsyslog <../../concepts/queues>`.h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]r(h;XgThe following statements specify parameters for the action queue. To understand queue parameters, read rr}r(h"XgThe following statements specify parameters for the action queue. To understand queue parameters, read h#jubcsphinx.addnodes pending_xref r)r}r(h"X0:doc:`queues in rsyslog <../../concepts/queues>`rh#jh$h%h&U pending_xrefrh(}r (UreftypeXdocr Urefwarnr U reftargetr X../../concepts/queuesU refdomainUh-]h,]U refexplicith*]h+]h/]Urefdocr huh1Kh]rcdocutils.nodes literal r)r}r(h"jh(}r(h*]h+]r(Uxrefrj eh,]h-]h/]uh#jh]rh;Xqueues in rsyslogrr}r(h"Uh#jubah&Uliteralrubaubh;X.r}r(h"X.h#jubeubh?)r}r(h"XVAction queue parameters usually affect the next action and auto-reset to defaults thereafter. Most importantly, this means that when a "real" (non-direct) queue type is defined, this affects the immediately following action, only. The next and all other actions will be in "direct" mode (no real queue) if not explicitely specified otherwise.rh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh2hh]r h;XVAction queue parameters usually affect the next action and auto-reset to defaults thereafter. Most importantly, this means that when a "real" (non-direct) queue type is defined, this affects the immediately following action, only. The next and all other actions will be in "direct" mode (no real queue) if not explicitely specified otherwise.r!r"}r#(h"jh#jubaubh)r$}r%(h"Uh#jh$h%h&hh(}r&(hX-h-]h,]h*]h+]h/]uh1Kh2hh]r'(h)r(}r)(h"X+**$ActionQueueCheckpointInterval** r*h#j$h$h%h&hh(}r+(h*]h+]h,]h-]h/]uh1Nh2hh]r,h?)r-}r.(h"j*h#j(h$h%h&hBh(}r/(h*]h+]h,]h-]h/]uh1Kh]r0(hH)r1}r2(h"X"**$ActionQueueCheckpointInterval**h(}r3(h*]h+]h,]h-]h/]uh#j-h]r4h;X$ActionQueueCheckpointIntervalr5r6}r7(h"Uh#j1ubah&hPubh;X r8r9}r:(h"X h#j-ubeubaubh)r;}r<(h"X6**$ActionQueueDequeueBatchSize** [default 16]r=h#j$h$h%h&hh(}r>(h*]h+]h,]h-]h/]uh1Nh2hh]r?h?)r@}rA(h"j=h#j;h$h%h&hBh(}rB(h*]h+]h,]h-]h/]uh1Kh]rC(hH)rD}rE(h"X **$ActionQueueDequeueBatchSize**h(}rF(h*]h+]h,]h-]h/]uh#j@h]rGh;X$ActionQueueDequeueBatchSizerHrI}rJ(h"Uh#jDubah&hPubh;X [default 16]rKrL}rM(h"X [default 16]h#j@ubeubaubh)rN}rO(h"X**$ActionQueueDequeueSlowdown** [number is timeout in *micro*\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h#j$h$h%h&hh(}rP(h*]h+]h,]h-]h/]uh1Nh2hh]rQh?)rR}rS(h"X**$ActionQueueDequeueSlowdown** [number is timeout in *micro*\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h#jNh$h%h&hBh(}rT(h*]h+]h,]h-]h/]uh1Kh]rU(hH)rV}rW(h"X**$ActionQueueDequeueSlowdown**h(}rX(h*]h+]h,]h-]h/]uh#jRh]rYh;X$ActionQueueDequeueSlowdownrZr[}r\(h"Uh#jVubah&hPubh;X [number is timeout in r]r^}r_(h"X [number is timeout in h#jRubh)r`}ra(h"X*micro*h(}rb(h*]h+]h,]h-]h/]uh#jRh]rch;Xmicrordre}rf(h"Uh#j`ubah&jubh;XJseconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]rgrh}ri(h"XL\ seconds (1000000us is 1sec!), default 0 (no delay). Simple rate-limiting!]h#jRubeubaubh)rj}rk(h"X3**$ActionQueueDiscardMark** [default 9750]rlh#j$h$h%h&hh(}rm(h*]h+]h,]h-]h/]uh1Nh2hh]rnh?)ro}rp(h"jlh#jjh$h%h&hBh(}rq(h*]h+]h,]h-]h/]uh1Kh]rr(hH)rs}rt(h"X**$ActionQueueDiscardMark**h(}ru(h*]h+]h,]h-]h/]uh#joh]rvh;X$ActionQueueDiscardMarkrwrx}ry(h"Uh#jsubah&hPubh;X [default 9750]rzr{}r|(h"X [default 9750]h#joubeubaubh)r}}r~(h"XV**$ActionQueueDiscardSeverity** [\*numerical\* severity! default 4 (warning)]h#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"XV**$ActionQueueDiscardSeverity** [\*numerical\* severity! default 4 (warning)]h#j}h$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueDiscardSeverity**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueDiscardSeverityrr}r(h"Uh#jubah&hPubh;X5 [*numerical* severity! default 4 (warning)]rr}r(h"X7 [\*numerical\* severity! default 4 (warning)]h#jubeubaubh)r}r(h"X**$ActionQueueFileName** rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueFileName**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueFileNamerr}r(h"Uh#jubah&hPubh;X rr}r(h"X h#jubeubaubh)r}r(h"X5**$ActionQueueHighWaterMark** [default 8000]rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueHighWaterMark**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueHighWaterMarkrr}r(h"Uh#jubah&hPubh;X [default 8000]rr}r(h"X [default 8000]h#jubeubaubh)r}r(h"X.**$ActionQueueImmediateShutdown** [on/**off**]rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X!**$ActionQueueImmediateShutdown**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueImmediateShutdownrr}r(h"Uh#jubah&hPubh;X [on/rr}r(h"X [on/h#jubhH)r}r(h"X**off**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;Xoffrr}r(h"Uh#jubah&hPubh;X]r}r(h"X]h#jubeubaubh)r}r(h"X**$ActionQueueSize** rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueSize**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueSizerr}r(h"Uh#jubah&hPubh;X rr}r(h"X h#jubeubaubh)r}r(h"X4**$ActionQueueLowWaterMark** [default 2000]rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueLowWaterMark**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueLowWaterMarkrr}r(h"Uh#jubah&hPubh;X [default 2000]rr}r(h"X [default 2000]h#jubeubaubh)r}r(h"X3**$ActionQueueMaxFileSize** , default 1mrh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueMaxFileSize**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueMaxFileSizerr}r(h"Uh#jubah&hPubh;X , default 1mrr}r (h"X , default 1mh#jubeubaubh)r }r (h"X~**$ActionQueueTimeoutActionCompletion** [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h#j$h$h%h&hh(}r (h*]h+]h,]h-]h/]uh1Nh2hh]r h?)r}r(h"X~**$ActionQueueTimeoutActionCompletion** [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h#j h$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X'**$ActionQueueTimeoutActionCompletion**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X#$ActionQueueTimeoutActionCompletionrr}r(h"Uh#jubah&hPubh;XW [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]rr}r(h"XW [number is timeout in ms (1000ms is 1sec!), default 1000, 0 means immediate!]h#jubeubaubh)r}r(h"X~**$ActionQueueTimeoutEnqueue** [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r }r!(h"X~**$ActionQueueTimeoutEnqueue** [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h#jh$h%h&hBh(}r"(h*]h+]h,]h-]h/]uh1Kh]r#(hH)r$}r%(h"X**$ActionQueueTimeoutEnqueue**h(}r&(h*]h+]h,]h-]h/]uh#j h]r'h;X$ActionQueueTimeoutEnqueuer(r)}r*(h"Uh#j$ubah&hPubh;X` [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]r+r,}r-(h"X` [number is timeout in ms (1000ms is 1sec!), default 2000, 0 means discard immediately]h#j ubeubaubh)r.}r/(h"Xl**$ActionQueueTimeoutShutdown** [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h#j$h$h%h&hh(}r0(h*]h+]h,]h-]h/]uh1Nh2hh]r1h?)r2}r3(h"Xl**$ActionQueueTimeoutShutdown** [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h#j.h$h%h&hBh(}r4(h*]h+]h,]h-]h/]uh1Kh]r5(hH)r6}r7(h"X**$ActionQueueTimeoutShutdown**h(}r8(h*]h+]h,]h-]h/]uh#j2h]r9h;X$ActionQueueTimeoutShutdownr:r;}r<(h"Uh#j6ubah&hPubh;XM [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]r=r>}r?(h"XM [number is timeout in ms (1000ms is 1sec!), default 0 (indefinite)]h#j2ubeubaubh)r@}rA(h"Xz**$ActionQueueWorkerTimeoutThreadShutdown** [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h#j$h$h%h&hh(}rB(h*]h+]h,]h-]h/]uh1Nh2hh]rCh?)rD}rE(h"Xz**$ActionQueueWorkerTimeoutThreadShutdown** [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h#j@h$h%h&hBh(}rF(h*]h+]h,]h-]h/]uh1Kh]rG(hH)rH}rI(h"X+**$ActionQueueWorkerTimeoutThreadShutdown**h(}rJ(h*]h+]h,]h-]h/]uh#jDh]rKh;X'$ActionQueueWorkerTimeoutThreadShutdownrLrM}rN(h"Uh#jHubah&hPubh;XO [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]rOrP}rQ(h"XO [number is timeout in ms (1000ms is 1sec!), default 60000 (1 minute)]h#jDubeubaubh)rR}rS(h"X<**$ActionQueueType** [FixedArray/LinkedList/**Direct**/Disk]rTh#j$h$h%h&hh(}rU(h*]h+]h,]h-]h/]uh1Nh2hh]rVh?)rW}rX(h"jTh#jRh$h%h&hBh(}rY(h*]h+]h,]h-]h/]uh1Kh]rZ(hH)r[}r\(h"X**$ActionQueueType**h(}r](h*]h+]h,]h-]h/]uh#jWh]r^h;X$ActionQueueTyper_r`}ra(h"Uh#j[ubah&hPubh;X [FixedArray/LinkedList/rbrc}rd(h"X [FixedArray/LinkedList/h#jWubhH)re}rf(h"X **Direct**h(}rg(h*]h+]h,]h-]h/]uh#jWh]rhh;XDirectrirj}rk(h"Uh#jeubah&hPubh;X/Disk]rlrm}rn(h"X/Disk]h#jWubeubaubh)ro}rp(h"X-**$ActionQueueSaveOnShutdown**  [on/**off**]rqh#j$h$h%h&hh(}rr(h*]h+]h,]h-]h/]uh1Nh2hh]rsh?)rt}ru(h"jqh#joh$h%h&hBh(}rv(h*]h+]h,]h-]h/]uh1Kh]rw(hH)rx}ry(h"X**$ActionQueueSaveOnShutdown**h(}rz(h*]h+]h,]h-]h/]uh#jth]r{h;X$ActionQueueSaveOnShutdownr|r}}r~(h"Uh#jxubah&hPubh;X  [on/rr}r(h"X  [on/h#jtubhH)r}r(h"X**off**h(}r(h*]h+]h,]h-]h/]uh#jth]rh;Xoffrr}r(h"Uh#jubah&hPubh;X]r}r(h"X]h#jtubeubaubh)r}r(h"XT**$ActionQueueWorkerThreads** , num worker threads, default 1, recommended 1h#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"XT**$ActionQueueWorkerThreads** , num worker threads, default 1, recommended 1h#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X**$ActionQueueWorkerThreads**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X$ActionQueueWorkerThreadsrr}r(h"Uh#jubah&hPubh;X7 , num worker threads, default 1, recommended 1rr}r(h"X7 , num worker threads, default 1, recommended 1h#jubeubaubh)r}r(h"X=$ActionQueueWorkerThreadMinumumMessages , default 100rh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"jh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]rh;X=$ActionQueueWorkerThreadMinumumMessages , default 100rr}r(h"jh#jubaubaubh)r}r(h"Xo**$ActionGSSForwardDefaultTemplate** [templateName] - sets a new default template for GSS-API forwarding actionh#j$h$h%h&hh(}r(h*]h+]h,]h-]h/]uh1Nh2hh]rh?)r}r(h"Xo**$ActionGSSForwardDefaultTemplate** [templateName] - sets a new default template for GSS-API forwarding actionh#jh$h%h&hBh(}r(h*]h+]h,]h-]h/]uh1Kh]r(hH)r}r(h"X$**$ActionGSSForwardDefaultTemplate**h(}r(h*]h+]h,]h-]h/]uh#jh]rh;X $ActionGSSForwardDefaultTemplaterr}r(h"Uh#jubah&hPubh;XK [templateName] - sets a new default template for GSS-API forwarding actionrr}r(h"XK [templateName] - sets a new default template for GSS-API forwarding actionh#jubeubaubeubeubeubah"UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh2hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh8NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh%Ugettext_compactr U generatorr NUdump_internalsr NU smart_quotesr U pep_base_urlr U https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrjUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hh hj?hjhjhhhh^hjuUsubstitution_namesr}rh&h2h(}r(h*]h-]h,]Usourceh%h+]h/]uU footnotesr ]r!Urefidsr"}r#ub.build/.doctrees/configuration/action/rsconf1_filecreatemode.doctree0000664000175000017500000002103013035122641024614 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X$filecreatemodeqNXrainer gerhardsqXadisconqXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUfilecreatemodeqhUrainer-gerhardsqhUadisconqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXR/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_filecreatemode.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$FileCreateModeq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$FileCreateModeq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX**Default:** 0644qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX **Default:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubh5X 0644qXqY}qZ(hX 0644hhLubeubh9)q[}q\(hX**Description:**q]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_h@)q`}qa(hh]h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Description:qdqe}qf(hUhh`ubah hHubaubh9)qg}qh(hX)The $FileCreateMode directive allows to specify the creation mode with which rsyslogd creates new files. If not specified, the value 0644 is used (which retains backward-compatibility with earlier releases). The value given must always be a 4-digit octal number, with the initial digit being zero.qihhhhh h=h"}qj(h$]h%]h&]h']h)]uh+K h,hh]qkh5X)The $FileCreateMode directive allows to specify the creation mode with which rsyslogd creates new files. If not specified, the value 0644 is used (which retains backward-compatibility with earlier releases). The value given must always be a 4-digit octal number, with the initial digit being zero.qlqm}qn(hhihhgubaubh9)qo}qp(hXPlease note that the actual permission depend on rsyslogd's process umask. If in doubt, use "$umask 0000" right at the beginning of the configuration file to remove any restrictions.qqhhhhh h=h"}qr(h$]h%]h&]h']h)]uh+Kh,hh]qsh5XPlease note that the actual permission depend on rsyslogd's process umask. If in doubt, use "$umask 0000" right at the beginning of the configuration file to remove any restrictions.qtqu}qv(hhqhhoubaubh9)qw}qx(hX$FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important.qyhhhhh h=h"}qz(h$]h%]h&]h']h)]uh+Kh,hh]q{h5X$FileCreateMode may be specified multiple times. If so, it specifies the creation mode for all selector lines that follow until the next $FileCreateMode directive. Order of lines is vitally important.q|q}}q~(hhyhhwubaubh9)q}q(hX **Sample:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XSample:qq}q(hUhhubah hHubaubh9)q}q(hX``$FileCreateMode 0600``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qcdocutils.nodes literal q)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X$FileCreateMode 0600qq}q(hUhhubah Uliteralqubaubh9)q}q(hXbThis sample lets rsyslog create files with read and write access only for the users it runs under.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5XbThis sample lets rsyslog create files with read and write access only for the users it runs under.qq}q(hhhhubaubh9)q}q(hX=The following sample is deemed to be a complete rsyslog.conf:qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5X=The following sample is deemed to be a complete rsyslog.conf:qq}q(hhhhubaubh9)q}q(hX``$umask 0000 # make sure nothing interferes with the following definitions *.* /var/log/file-with-0644-default $FileCreateMode 0600 *.* /var/log/file-with-0600 $FileCreateMode 0644 *.* /var/log/file-with-0644``qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K!h,hh]qh)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X$umask 0000 # make sure nothing interferes with the following definitions *.* /var/log/file-with-0644-default $FileCreateMode 0600 *.* /var/log/file-with-0600 $FileCreateMode 0644 *.* /var/log/file-with-0644qq}q(hUhhubah hubaubh9)q}q(hXAs you can see, open modes depend on position in the config file. Note the first line, which is created with the hardcoded default creation mode.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K#h,hh]qh5XAs you can see, open modes depend on position in the config file. Note the first line, which is created with the hardcoded default creation mode.qq}q(hhhhubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K'h,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogq˅q}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qׅq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsq߅q}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and q煁q}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 3 or higher.qq}q(hX1. Released under the GNU GPL version 3 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh,hU current_linerNUtransform_messagesr]r Ureporterr NUid_startr KU autofootnotesr ]r U citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenr U datestampr!NU report_levelr"KU _destinationr#NU halt_levelr$KU strip_classesr%Nh2NUerror_encoding_error_handlerr&Ubackslashreplacer'Udebugr(NUembed_stylesheetr)Uoutput_encoding_error_handlerr*Ustrictr+U sectnum_xformr,KUdump_transformsr-NU docinfo_xformr.KUwarning_streamr/NUpep_file_url_templater0Upep-%04dr1Uexit_status_levelr2KUconfigr3NUstrict_visitorr4NUcloak_email_addressesr5Utrim_footnote_reference_spacer6Uenvr7NUdump_pseudo_xmlr8NUexpose_internalsr9NUsectsubtitle_xformr:U source_linkr;NUrfc_referencesr<NUoutput_encodingr=Uutf-8r>U source_urlr?NUinput_encodingr@U utf-8-sigrAU_disable_configrBNU id_prefixrCUU tab_widthrDKUerror_encodingrEUUTF-8rFU_sourcerGhUgettext_compactrHU generatorrINUdump_internalsrJNU smart_quotesrKU pep_base_urlrLU https://www.python.org/dev/peps/rMUsyntax_highlightrNUlongrOUinput_encoding_error_handlerrPj+Uauto_id_prefixrQUidrRUdoctitle_xformrSUstrip_elements_with_classesrTNU _config_filesrU]Ufile_insertion_enabledrVU raw_enabledrWKU dump_settingsrXNubUsymbol_footnote_startrYKUidsrZ}r[(hhhhhhhhuUsubstitution_namesr\}r]h h,h"}r^(h$]h']h&]Usourcehh%]h)]uU footnotesr_]r`Urefidsra}rbub.build/.doctrees/configuration/action/rsconf1_fileowner.doctree0000664000175000017500000001361413035122641023647 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXrainer gerhardsqX $fileownerqNXrsyslogq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUrainer-gerhardsqhU fileownerqh UrsyslogquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXM/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_fileowner.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*hauUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX $FileOwnerq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X $FileOwnerq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX **Default:**qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qPh@)qQ}qR(hhNh"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XDefault:qUqV}qW(hUhhQubah hHubaubh9)qX}qY(hX**Description:**qZhhhhh h=h"}q[(h$]h%]h&]h']h)]uh+Kh,hh]q\h@)q]}q^(hhZh"}q_(h$]h%]h&]h']h)]uhhXh]q`h5X Description:qaqb}qc(hUhh]ubah hHubaubh9)qd}qe(hXSet the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qfhhhhh h=h"}qg(h$]h%]h&]h']h)]uh+K h,hh]qhh5XSet the file owner for dynaFiles newly created. Please note that this setting does not affect the owner of files already existing. The parameter is a user name, for which the userid is obtained by rsyslogd during startup processing. Interim changes to the user mapping are not detected.qiqj}qk(hhfhhdubaubh9)ql}qm(hX **Sample:**qnhhhhh h=h"}qo(h$]h%]h&]h']h)]uh+Kh,hh]qph@)qq}qr(hhnh"}qs(h$]h%]h&]h']h)]uhhlh]qth5XSample:quqv}qw(hUhhqubah hHubaubh9)qx}qy(hX``$FileOwner loguser``qzhhhhh h=h"}q{(h$]h%]h&]h']h)]uh+Kh,hh]q|cdocutils.nodes literal q})q~}q(hhzh"}q(h$]h%]h&]h']h)]uhhxh]qh5X$FileOwner loguserqq}q(hUhh~ubah Uliteralqubaubh9)q}q(hXThis documentation is part of the `rsyslog `_ project. Copyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5X"This documentation is part of the qq}q(hX"This documentation is part of the hhubcdocutils.nodes reference q)q}q(hX$`rsyslog `_h"}q(Unameh UrefuriqXhttp://www.rsyslog.com/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslogqq}q(hUhhubah U referencequbcdocutils.nodes target q)q}q(hX U referencedqKhhh Utargetqh"}q(Urefurihh']qhah&]h$]h%]h)]qh auh]ubh5X project. Copyright © 2007 by qq}q(hX project. Copyright © 2007 by hhubh)q}q(hX3`Rainer Gerhards `_h"}q(UnameXRainer GerhardshXhttp://www.gerhards.net/rainerqh']h&]h$]h%]h)]uhhh]qh5XRainer Gerhardsqq}q(hUhhubah hubh)q}q(hX! hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X and qq}q(hX and hhubh)q}q(hX$`Adiscon `_h"}q(UnameXAdisconhXhttp://www.adiscon.com/qh']h&]h$]h%]h)]uhhh]qh5XAdisconqq}q(hUhhubah hubh)q}q(hX hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh,hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh2NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingrUutf-8rU source_urlrNUinput_encodingr U utf-8-sigr U_disable_configr NU id_prefixr UU tab_widthr KUerror_encodingrUUTF-8rU_sourcerhUgettext_compactrU generatorrNUdump_internalsrNU smart_quotesrU pep_base_urlrU https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledr KU dump_settingsr!NubUsymbol_footnote_startr"KUidsr#}r$(hhhhhhhhuUsubstitution_namesr%}r&h h,h"}r'(h$]h']h&]Usourcehh%]h)]uU footnotesr(]r)Urefidsr*}r+ub.build/.doctrees/configuration/action/rsconf1_omfileforcechown.doctree0000664000175000017500000003621613035122641025211 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrainer gerhardsqXadisconqXrsyslogqX$omfileforcechownq NuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUrainer-gerhardsqhUadisconqhUrsyslogqh UomfileforcechownquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXT/home/rger/proj/rsyslog-doc/source/configuration/action/rsconf1_omfileforcechown.rstqUtagnameq Usectionq!U attributesq"}q#(Udupnamesq$]Uclassesq%]Ubackrefsq&]Uidsq']q(haUnamesq)]q*h auUlineq+KUdocumentq,hh]q-(cdocutils.nodes title q.)q/}q0(hX$omfileForceChownq1hhhhh Utitleq2h"}q3(h$]h%]h&]h']h)]uh+Kh,hh]q4cdocutils.nodes Text q5X$omfileForceChownq6q7}q8(hh1hh/ubaubcdocutils.nodes paragraph q9)q:}q;(hX(**Type:** global configuration directiveq(h$]h%]h&]h']h)]uh+Kh,hh]q?(cdocutils.nodes strong q@)qA}qB(hX **Type:**h"}qC(h$]h%]h&]h']h)]uhh:h]qDh5XType:qEqF}qG(hUhhAubah UstrongqHubh5X global configuration directiveqIqJ}qK(hX global configuration directivehh:ubeubh9)qL}qM(hX.**Parameter Values:** boolean (on/off, yes/no)qNhhhhh h=h"}qO(h$]h%]h&]h']h)]uh+Kh,hh]qP(h@)qQ}qR(hX**Parameter Values:**h"}qS(h$]h%]h&]h']h)]uhhLh]qTh5XParameter Values:qUqV}qW(hUhhQubah hHubh5X boolean (on/off, yes/no)qXqY}qZ(hX boolean (on/off, yes/no)hhLubeubh9)q[}q\(hXH**Available:** 4.7.0+, 5.3.0-5.8.x, **NOT** available in 5.9.x or higherq]hhhhh h=h"}q^(h$]h%]h&]h']h)]uh+Kh,hh]q_(h@)q`}qa(hX**Available:**h"}qb(h$]h%]h&]h']h)]uhh[h]qch5X Available:qdqe}qf(hUhh`ubah hHubh5X 4.7.0+, 5.3.0-5.8.x, qgqh}qi(hX 4.7.0+, 5.3.0-5.8.x, hh[ubh@)qj}qk(hX**NOT**h"}ql(h$]h%]h&]h']h)]uhh[h]qmh5XNOTqnqo}qp(hUhhjubah hHubh5X available in 5.9.x or higherqqqr}qs(hX available in 5.9.x or higherhh[ubeubh9)qt}qu(hX**Note: this directive has been removed and is no longer available. The documentation is currently being retained for historical reaons.** Expect it to go away at some later stage as well.hhhhh h=h"}qv(h$]h%]h&]h']h)]uh+K h,hh]qw(h@)qx}qy(hX**Note: this directive has been removed and is no longer available. The documentation is currently being retained for historical reaons.**h"}qz(h$]h%]h&]h']h)]uhhth]q{h5XNote: this directive has been removed and is no longer available. The documentation is currently being retained for historical reaons.q|q}}q~(hUhhxubah hHubh5X2 Expect it to go away at some later stage as well.qq}q(hX2 Expect it to go away at some later stage as well.hhtubeubh9)q}q(hX**Default:** offqhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h@)q}q(hX **Default:**h"}q(h$]h%]h&]h']h)]uhhh]qh5XDefault:qq}q(hUhhubah hHubh5X offqq}q(hX offhhubeubh9)q}q(hX**Description:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5X Description:qq}q(hUhhubah hHubaubh9)q}q(hXForces rsyslogd to change the ownership for output files that already exist. Please note that this tries to fix a potential problem that exists outside the scope of rsyslog. Actually, it tries to fix invalid ownership/permission settings set by the original file creator.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5XForces rsyslogd to change the ownership for output files that already exist. Please note that this tries to fix a potential problem that exists outside the scope of rsyslog. Actually, it tries to fix invalid ownership/permission settings set by the original file creator.qq}q(hhhhubaubh9)q}q(hX[Rsyslog changes the ownership during initial execution with root privileges. When a privelege drop is configured, privileges are dropped after the file owner ship is changed. Not that this currently is a limitation in rsyslog's privilege drop code, which is on the TODO list to be removed. See Caveats section below for the important implications.qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh5X[Rsyslog changes the ownership during initial execution with root privileges. When a privelege drop is configured, privileges are dropped after the file owner ship is changed. Not that this currently is a limitation in rsyslog's privilege drop code, which is on the TODO list to be removed. See Caveats section below for the important implications.qq}q(hhhhubaubh9)q}q(hX **Caveats:**qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]qh@)q}q(hhh"}q(h$]h%]h&]h']h)]uhhh]qh5XCaveats:qq}q(hUhhubah hHubaubh9)q}q(hX0This directive tries to fix a problem that actually is outside the scope of rsyslog. As such, there are a couple of restrictions and situations in which it will not work. **Users are strongly encouraged to fix their system instead of turning this directive on** - it should only be used as a last resort.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+Kh,hh]q(h5XThis directive tries to fix a problem that actually is outside the scope of rsyslog. As such, there are a couple of restrictions and situations in which it will not work. qq}q(hXThis directive tries to fix a problem that actually is outside the scope of rsyslog. As such, there are a couple of restrictions and situations in which it will not work. hhubh@)q}q(hXZ**Users are strongly encouraged to fix their system instead of turning this directive on**h"}q(h$]h%]h&]h']h)]uhhh]qh5XVUsers are strongly encouraged to fix their system instead of turning this directive onqąq}q(hUhhubah hHubh5X+ - it should only be used as a last resort.qDžq}q(hX+ - it should only be used as a last resort.hhubeubh9)q}q(hXHAt least in the following scenario, this directive will fail expectedly:qhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K%h,hh]qh5XHAt least in the following scenario, this directive will fail expectedly:qυq}q(hhhhubaubh9)q}q(hXIt does not address the situation that someone changes the ownership \*after\* rsyslogd has started. Let's, for example, consider a log rotation script.hhhhh h=h"}q(h$]h%]h&]h']h)]uh+K'h,hh]qh5XIt does not address the situation that someone changes the ownership *after* rsyslogd has started. Let's, for example, consider a log rotation script.qօq}q(hXIt does not address the situation that someone changes the ownership \*after\* rsyslogd has started. Let's, for example, consider a log rotation script.hhubaubcdocutils.nodes bullet_list q)q}q(hUhhhhh U bullet_listqh"}q(UbulletqX-h']h&]h$]h%]h)]uh+K+h,hh]q(cdocutils.nodes list_item q)q}q(hXrsyslog is startedqhhhhh U list_itemqh"}q(h$]h%]h&]h']h)]uh+Nh,hh]qh9)q}q(hhhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K+h]qh5Xrsyslog is startedq녁q}q(hhhhubaubaubh)q}q(hXownership is changedqhhhhh hh"}q(h$]h%]h&]h']h)]uh+Nh,hh]qh9)q}q(hhhhhhh h=h"}q(h$]h%]h&]h']h)]uh+K,h]qh5Xownership is changedqq}q(hhhhubaubaubh)q}q(hXprivileges droppedqhhhhh hh"}q(h$]h%]h&]h']h)]uh+Nh,hh]qh9)q}r(hhhhhhh h=h"}r(h$]h%]h&]h']h)]uh+K-h]rh5Xprivileges droppedrr}r(hhhhubaubaubh)r}r(hXlog rotation (lr) script startsrhhhhh hh"}r (h$]h%]h&]h']h)]uh+Nh,hh]r h9)r }r (hjhjhhh h=h"}r (h$]h%]h&]h']h)]uh+K.h]rh5Xlog rotation (lr) script startsrr}r(hjhj ubaubaubh)r}r(hXlr removes filesrhhhhh hh"}r(h$]h%]h&]h']h)]uh+Nh,hh]rh9)r}r(hjhjhhh h=h"}r(h$]h%]h&]h']h)]uh+K/h]rh5Xlr removes filesrr}r(hjhjubaubaubh)r}r(hX5lr creates new files with root:adm (or whatever else)r hhhhh hh"}r!(h$]h%]h&]h']h)]uh+Nh,hh]r"h9)r#}r$(hj hjhhh h=h"}r%(h$]h%]h&]h']h)]uh+K0h]r&h5X5lr creates new files with root:adm (or whatever else)r'r(}r)(hj hj#ubaubaubh)r*}r+(hXlr HUPs rsyslogdr,hhhhh hh"}r-(h$]h%]h&]h']h)]uh+Nh,hh]r.h9)r/}r0(hj,hj*hhh h=h"}r1(h$]h%]h&]h']h)]uh+K1h]r2h5Xlr HUPs rsyslogdr3r4}r5(hj,hj/ubaubaubh)r6}r7(hXrsyslogd closes filesr8hhhhh hh"}r9(h$]h%]h&]h']h)]uh+Nh,hh]r:h9)r;}r<(hj8hj6hhh h=h"}r=(h$]h%]h&]h']h)]uh+K2h]r>h5Xrsyslogd closes filesr?r@}rA(hj8hj;ubaubaubh)rB}rC(hXrsyslogd tries to open filesrDhhhhh hh"}rE(h$]h%]h&]h']h)]uh+Nh,hh]rFh9)rG}rH(hjDhjBhhh h=h"}rI(h$]h%]h&]h']h)]uh+K3h]rJh5Xrsyslogd tries to open filesrKrL}rM(hjDhjGubaubaubh)rN}rO(hXBrsyslogd tries to change ownership --> fail as we are non-root nowrPhhhhh hh"}rQ(h$]h%]h&]h']h)]uh+Nh,hh]rRh9)rS}rT(hjPhjNhhh h=h"}rU(h$]h%]h&]h']h)]uh+K4h]rVh5XBrsyslogd tries to change ownership --> fail as we are non-root nowrWrX}rY(hjPhjSubaubaubh)rZ}r[(hXfile open fails hhhhh hh"}r\(h$]h%]h&]h']h)]uh+Nh,hh]r]h9)r^}r_(hXfile open failsr`hjZhhh h=h"}ra(h$]h%]h&]h']h)]uh+K5h]rbh5Xfile open failsrcrd}re(hj`hj^ubaubaubeubh9)rf}rg(hXPlease note that once the privilege drop code is refactored, this directive will no longer work, because then privileges will be dropped before any action is performed, and thus we will no longer be able to chown files that do not belong to the user rsyslogd is configured to run under.rhhhhhh h=h"}ri(h$]h%]h&]h']h)]uh+K7h,hh]rjh5XPlease note that once the privilege drop code is refactored, this directive will no longer work, because then privileges will be dropped before any action is performed, and thus we will no longer be able to chown files that do not belong to the user rsyslogd is configured to run under.rkrl}rm(hjhhjfubaubh9)rn}ro(hXSo **expect the directive to go away**. It will not be removed in version 4, but may disappear at any time for any version greater than 4.hhhhh h=h"}rp(h$]h%]h&]h']h)]uh+K=h,hh]rq(h5XSo rrrs}rt(hXSo hjnubh@)ru}rv(hX#**expect the directive to go away**h"}rw(h$]h%]h&]h']h)]uhjnh]rxh5Xexpect the directive to go awayryrz}r{(hUhjuubah hHubh5Xd. It will not be removed in version 4, but may disappear at any time for any version greater than 4.r|r}}r~(hXd. It will not be removed in version 4, but may disappear at any time for any version greater than 4.hjnubeubh9)r}r(hX **Sample:**rhhhhh h=h"}r(h$]h%]h&]h']h)]uh+K@h,hh]rh@)r}r(hjh"}r(h$]h%]h&]h']h)]uhjh]rh5XSample:rr}r(hUhjubah hHubaubh9)r}r(hX+``$FileOwner loguser $omfileForceChown on``rhhhhh h=h"}r(h$]h%]h&]h']h)]uh+KBh,hh]rcdocutils.nodes literal r)r}r(hjh"}r(h$]h%]h&]h']h)]uhjh]rh5X'$FileOwner loguser $omfileForceChown onrr}r(hUhjubah Uliteralrubaubh9)r}r(hXOThis documentation is part of the `rsyslog `_ project.hhhhh h=h"}r(h$]h%]h&]h']h)]uh+KDh,hh]r(h5X"This documentation is part of the rr}r(hX"This documentation is part of the hjubcdocutils.nodes reference r)r}r(hX$`rsyslog `_h"}r(UnamehUrefurirXhttp://www.rsyslog.com/rh']h&]h$]h%]h)]uhjh]rh5Xrsyslogrr}r(hUhjubah U referencerubcdocutils.nodes target r)r}r(hX U referencedrKhjh Utargetrh"}r(Urefurijh']rhah&]h$]h%]h)]rhauh]ubh5X project.rr}r(hX project.hjubeubh9)r}r(hXCopyright © 2007 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhhhh h=h"}r(h$]h%]h&]h']h)]uh+KGh,hh]r(h5XCopyright © 2007 by rr}r(hXCopyright © 2007 by hjubj)r}r(hX3`Rainer Gerhards `_h"}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrh']h&]h$]h%]h)]uhjh]rh5XRainer Gerhardsrr}r(hUhjubah jubj)r}r(hX! jKhjh jh"}r(Urefurijh']rhah&]h$]h%]h)]rhauh]ubh5X and rr}r(hX and hjubj)r}r(hX$`Adiscon `_h"}r(UnameXAdisconjXhttp://www.adiscon.com/rh']h&]h$]h%]h)]uhjh]rh5XAdisconrr}r(hUhjubah jubj)r}r(hX jKhjh jh"}r(Urefurijh']rhah&]h$]h%]h)]rhauh]ubh5X1. Released under the GNU GPL version 2 or higher.rr}r(hX1. Released under the GNU GPL version 2 or higher.hjubeubeubahUU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh,hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh2NUerror_encoding_error_handlerr Ubackslashreplacer Udebugr NUembed_stylesheetr Uoutput_encoding_error_handlerr UstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04drUexit_status_levelrKUconfigrNUstrict_visitorrNUcloak_email_addressesrUtrim_footnote_reference_spacerUenvrNUdump_pseudo_xmlrNUexpose_internalsrNUsectsubtitle_xformrU source_linkrNUrfc_referencesrNUoutput_encodingr Uutf-8r!U source_urlr"NUinput_encodingr#U utf-8-sigr$U_disable_configr%NU id_prefixr&UU tab_widthr'KUerror_encodingr(UUTF-8r)U_sourcer*hUgettext_compactr+U generatorr,NUdump_internalsr-NU smart_quotesr.U pep_base_urlr/U https://www.python.org/dev/peps/r0Usyntax_highlightr1Ulongr2Uinput_encoding_error_handlerr3jUauto_id_prefixr4Uidr5Udoctitle_xformr6Ustrip_elements_with_classesr7NU _config_filesr8]Ufile_insertion_enabledr9U raw_enabledr:KU dump_settingsr;NubUsymbol_footnote_startr<KUidsr=}r>(hhhjhjhjuUsubstitution_namesr?}r@h h,h"}rA(h$]h']h&]Usourcehh%]h)]uU footnotesrB]rCUrefidsrD}rEub.build/.doctrees/configuration/output_channels.doctree0000664000175000017500000003364113035122643022164 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(XadisconqXoutput channelsqNXrsyslogqXlog rotation scriptq Xrainer gerhardsq uUsubstitution_defsq }q Uparse_messagesq ]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUadisconqhUoutput-channelsqhUrsyslogqh Ulog-rotation-scriptqh Urainer-gerhardsquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceq XD/home/rger/proj/rsyslog-doc/source/configuration/output_channels.rstq!Utagnameq"Usectionq#U attributesq$}q%(Udupnamesq&]Uclassesq']Ubackrefsq(]Uidsq)]q*haUnamesq+]q,hauUlineq-KUdocumentq.hh]q/(cdocutils.nodes title q0)q1}q2(hXOutput Channelsq3hhh h!h"Utitleq4h$}q5(h&]h']h(]h)]h+]uh-Kh.hh]q6cdocutils.nodes Text q7XOutput Channelsq8q9}q:(hh3hh1ubaubcdocutils.nodes paragraph q;)q<}q=(hXOutput Channels are a new concept first introduced in rsyslog 0.9.0. **As of this writing, it is most likely that they will be replaced by something different in the future.** So if you use them, be prepared to change you configuration file syntax when you upgrade to a later release. The idea behind output channel definitions is that it shall provide an umbrella for any type of output that the user might want. In essence, this is the "file" part of selector lines (and this is why we are not sure output channel syntax will stay after the next review). There is a difference, though: selector channels both have filter conditions (currently facility and severity) as well as the output destination. they can only be used to write to files - not pipes, ttys or whatever Output channels define the output definition, only. As of this build, else. If we stick with output channels, this will change over time.hhh h!h"U paragraphq>h$}q?(h&]h']h(]h)]h+]uh-Kh.hh]q@(h7XEOutput Channels are a new concept first introduced in rsyslog 0.9.0. qAqB}qC(hXEOutput Channels are a new concept first introduced in rsyslog 0.9.0. hhh$}qS(h&]h']h(]h)]h+]uh-Kh.hh]qTh7XNIn concept, an output channel includes everything needed to know about an output actions. In practice, the current implementation only carries a filename, a maximum file size and a command to be issued when this file size is reached. More things might be present in future version, which might also change the syntax of the directive.qUqV}qW(hhRhhPubaubh;)qX}qY(hXOutput channels are defined via an $outchannel directive. It's syntax is as follows: $outchannel name,file-name,max-size,action-on-max-size name is the name of the output channel (not the file), file-name is the file name to be written to, max-size the maximum allowed size and action-on-max-size a command to be issued when the max size is reached. This command always has exactly one parameter. The binary is that part of action-on-max-size before the first space, its parameter is everything behind that space. Please note that max-size is queried BEFORE writing the log message to the file. So be sure to set this limit reasonably low so that any message might fit. For the current release, setting it 1k lower than you expected is helpful. The max-size must always be specified in bytes - there are no special symbols (like 1k, 1m,...) at this point of development. Keep in mind that $outchannel just defines a channel with "name". It does not activate it. To do so, you must use a selector line (see below). That selector line includes the channel name plus an $ sign in front of it. A sample might be: \*.\* :omfile:$mychannel In its current form, output channels primarily provide the ability to size-limit an output file. To do so, specify a maximum size. When this size is reached, rsyslogd will execute the action-on-max-size command and then reopen the file and retry. The command should be something like a `log rotation script `_ or a similar thing.hhh h!h"h>h$}qZ(h&]h']h(]h)]h+]uh-Kh.hh]q[(h7XOutput channels are defined via an $outchannel directive. It's syntax is as follows: $outchannel name,file-name,max-size,action-on-max-size name is the name of the output channel (not the file), file-name is the file name to be written to, max-size the maximum allowed size and action-on-max-size a command to be issued when the max size is reached. This command always has exactly one parameter. The binary is that part of action-on-max-size before the first space, its parameter is everything behind that space. Please note that max-size is queried BEFORE writing the log message to the file. So be sure to set this limit reasonably low so that any message might fit. For the current release, setting it 1k lower than you expected is helpful. The max-size must always be specified in bytes - there are no special symbols (like 1k, 1m,...) at this point of development. Keep in mind that $outchannel just defines a channel with "name". It does not activate it. To do so, you must use a selector line (see below). That selector line includes the channel name plus an $ sign in front of it. A sample might be: *.* :omfile:$mychannel In its current form, output channels primarily provide the ability to size-limit an output file. To do so, specify a maximum size. When this size is reached, rsyslogd will execute the action-on-max-size command and then reopen the file and retry. The command should be something like a q\q]}q^(hXOutput channels are defined via an $outchannel directive. It's syntax is as follows: $outchannel name,file-name,max-size,action-on-max-size name is the name of the output channel (not the file), file-name is the file name to be written to, max-size the maximum allowed size and action-on-max-size a command to be issued when the max size is reached. This command always has exactly one parameter. The binary is that part of action-on-max-size before the first space, its parameter is everything behind that space. Please note that max-size is queried BEFORE writing the log message to the file. So be sure to set this limit reasonably low so that any message might fit. For the current release, setting it 1k lower than you expected is helpful. The max-size must always be specified in bytes - there are no special symbols (like 1k, 1m,...) at this point of development. Keep in mind that $outchannel just defines a channel with "name". It does not activate it. To do so, you must use a selector line (see below). That selector line includes the channel name plus an $ sign in front of it. A sample might be: \*.\* :omfile:$mychannel In its current form, output channels primarily provide the ability to size-limit an output file. To do so, specify a maximum size. When this size is reached, rsyslogd will execute the action-on-max-size command and then reopen the file and retry. The command should be something like a hhXubcdocutils.nodes reference q_)q`}qa(hX3`log rotation script `_h$}qb(UnameXlog rotation scriptUrefuriqcXlog_rotation_fix_size.htmlqdh)]h(]h&]h']h+]uhhXh]qeh7Xlog rotation scriptqfqg}qh(hUhh`ubah"U referenceqiubcdocutils.nodes target qj)qk}ql(hX U referencedqmKhhXh"Utargetqnh$}qo(Urefurihdh)]qphah(]h&]h']h+]qqh auh]ubh7X or a similar thing.qrqs}qt(hX or a similar thing.hhXubeubh;)qu}qv(hXBIf there is no action-on-max-size command or the command did not resolve the situation, the file is closed and never reopened by rsyslogd (except, of course, by huping it). This logic was integrated when we first experienced severe issues with files larger 2gb, which could lead to rsyslogd dumping core. In such cases, it is more appropriate to stop writing to a single file. Meanwhile, rsyslogd has been fixed to support files larger 2gb, but obviously only on file systems and operating system versions that do so. So it can still make sense to enforce a 2gb file size limit.qwhhh h!h"h>h$}qx(h&]h']h(]h)]h+]uh-K4h.hh]qyh7XBIf there is no action-on-max-size command or the command did not resolve the situation, the file is closed and never reopened by rsyslogd (except, of course, by huping it). This logic was integrated when we first experienced severe issues with files larger 2gb, which could lead to rsyslogd dumping core. In such cases, it is more appropriate to stop writing to a single file. Meanwhile, rsyslogd has been fixed to support files larger 2gb, but obviously only on file systems and operating system versions that do so. So it can still make sense to enforce a 2gb file size limit.qzq{}q|(hhwhhuubaubh;)q}}q~(hXOThis documentation is part of the `rsyslog `_ project.hhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-K>h.hh]q(h7X"This documentation is part of the qq}q(hX"This documentation is part of the hh}ubh_)q}q(hX$`rsyslog `_h$}q(UnamehhcXhttp://www.rsyslog.com/qh)]h(]h&]h']h+]uhh}h]qh7Xrsyslogqq}q(hUhhubah"hiubhj)q}q(hX hmKhh}h"hnh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X project.qq}q(hX project.hh}ubeubh;)q}q(hXCopyright © 2008 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.hhh h!h"h>h$}q(h&]h']h(]h)]h+]uh-KAh.hh]q(h7XCopyright © 2008 by qq}q(hXCopyright © 2008 by hhubh_)q}q(hX3`Rainer Gerhards `_h$}q(UnameXRainer GerhardshcXhttp://www.gerhards.net/rainerqh)]h(]h&]h']h+]uhhh]qh7XRainer Gerhardsqq}q(hUhhubah"hiubhj)q}q(hX! hmKhhh"hnh$}q(Urefurihh)]qhah(]h&]h']h+]qh auh]ubh7X and qq}q(hX and hhubh_)q}q(hX$`Adiscon `_h$}q(UnameXAdisconhcXhttp://www.adiscon.com/qh)]h(]h&]h']h+]uhhh]qh7XAdisconqq}q(hUhhubah"hiubhj)q}q(hX hmKhhh"hnh$}q(Urefurihh)]qhah(]h&]h']h+]qhauh]ubh7X1. Released under the GNU GPL version 2 or higher.qq}q(hX1. Released under the GNU GPL version 2 or higher.hhubeubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh.hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqۈUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh4NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlrNUinput_encodingrU utf-8-sigrU_disable_configrNU id_prefixrUU tab_widthrKUerror_encodingrUUTF-8rU_sourcerh!Ugettext_compactr U generatorr NUdump_internalsr NU smart_quotesr U pep_base_urlr U https://www.python.org/dev/peps/rUsyntax_highlightrUlongrUinput_encoding_error_handlerrhUauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhkhhhhhhuUsubstitution_namesr}rh"h.h$}r(h&]h)]h(]Usourceh!h']h+]uU footnotesr ]r!Urefidsr"}r#ub.build/.doctrees/configuration/ipv6.doctree0000664000175000017500000002375713035122641017642 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X!notes on ipv6 handling in rsyslogqNX libloggingquUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hU!notes-on-ipv6-handling-in-rsyslogqhU libloggingquUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqX9/home/rger/proj/rsyslog-doc/source/configuration/ipv6.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq ]Uclassesq!]Ubackrefsq"]Uidsq#]q$haUnamesq%]q&hauUlineq'KUdocumentq(hh]q)(cdocutils.nodes title q*)q+}q,(hX!Notes on IPv6 Handling in Rsyslogq-hhhhhUtitleq.h}q/(h ]h!]h"]h#]h%]uh'Kh(hh]q0cdocutils.nodes Text q1X!Notes on IPv6 Handling in Rsyslogq2q3}q4(hh-hh+ubaubcdocutils.nodes paragraph q5)q6}q7(hXN**Rsyslog fully\* supports sending and receiving syslog messages via both IPv4 and IPv6.** IPv6 is natively supported for both UDP and TCP. However, there are some options that control handling of IPv6 operations. I thought it is is a good idea to elaborate a little about them, so that you can probably find your way somewhat easier.hhhhhU paragraphq8h}q9(h ]h!]h"]h#]h%]uh'Kh(hh]q:(cdocutils.nodes strong q;)q<}q=(hXZ**Rsyslog fully\* supports sending and receiving syslog messages via both IPv4 and IPv6.**h}q>(h ]h!]h"]h#]h%]uhh6h]q?h1XURsyslog fully* supports sending and receiving syslog messages via both IPv4 and IPv6.q@qA}qB(hUhh`_, supports IPv4, only. Currently, there are no plans to update either rsyslog to another RFC 3195 stack or update liblogging. There is simply no demand for 3195 solutions.hhhhhh8h}qg(h ]h!]h"]h#]h%]uh'K*h(hh]qh(h;)qi}qj(hX**\***h}qk(h ]h!]h"]h#]h%]uhheh]qlh1X*qm}qn(hUhhiubahhCubh1XVrsyslog does not support RFC 3195 over IPv6. The reason is that the RFC 3195 library, qoqp}qq(hXX\ rsyslog does not support RFC 3195 over IPv6. The reason is that the RFC 3195 library, hheubcdocutils.nodes reference qr)qs}qt(hX*`liblogging `_h}qu(UnamehUrefuriqvXhttp://www.liblogging.org/qwh#]h"]h ]h!]h%]uhheh]qxh1X libloggingqyqz}q{(hUhhsubahU referenceq|ubcdocutils.nodes target q})q~}q(hX U referencedqKhhehUtargetqh}q(Urefurihwh#]qhah"]h ]h!]h%]qhauh]ubh1X, supports IPv4, only. Currently, there are no plans to update either rsyslog to another RFC 3195 stack or update liblogging. There is simply no demand for 3195 solutions.qq}q(hX, supports IPv4, only. Currently, there are no plans to update either rsyslog to another RFC 3195 stack or update liblogging. There is simply no demand for 3195 solutions.hheubeubh5)q}q(hXfLast Updated: 2007-07-02 Copyright © 2007 by Rainer Gerhards, released under the GNU GPL V2 or later.qhhhhhh8h}q(h ]h!]h"]h#]h%]uh'K0h(hh]qh1XfLast Updated: 2007-07-02 Copyright © 2007 by Rainer Gerhards, released under the GNU GPL V2 or later.qq}q(hhhhubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh(hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh.NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqˈUtrim_footnote_reference_spaceq̉UenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqЉU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqވU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}q(hh~hhuUsubstitution_namesq}qhh(h}q(h ]h#]h"]Usourcehh!]h%]uU footnotesq]qUrefidsq}qub.build/.doctrees/configuration/index.doctree0000664000175000017500000002432013035122641020050 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X<configuration file examples can be found in the rsyslog wikiqX configurationqNXrsyslog config snippetsqXrsyslog configuration builderq uUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU(cdocutils.nodes strong q?)q@}qA(hX4**Rsyslogd is configured via the rsyslog.conf file**h"}qB(h$]h%]h&]h']h)]uhh:h]qCh5X0Rsyslogd is configured via the rsyslog.conf fileqDqE}qF(hUhh@ubah UstrongqGubh5X, typically found in qHqI}qJ(hX, typically found in hh:ubcdocutils.nodes literal qK)qL}qM(hX``/etc``h"}qN(h$]h%]h&]h']h)]uhh:h]qOh5X/etcqPqQ}qR(hUhhLubah UliteralqSubh5X&. By default, rsyslogd reads the file qTqU}qV(hX&. By default, rsyslogd reads the file hh:ubhK)qW}qX(hX``/etc/rsyslog.conf``h"}qY(h$]h%]h&]h']h)]uhh:h]qZh5X/etc/rsyslog.confq[q\}q](hUhhWubah hSubh5X/. This can be changed by a command line option.q^q_}q`(hX/. This can be changed by a command line option.hh:ubeubh9)qa}qb(hXNote that **configurations can be built interactively** via the online `rsyslog configuration builder `_ tool.hhhhh h`_h"}qu(UnameXrsyslog configuration builderUrefuriqvX5http://www.rsyslog.com/rsyslog-configuration-builder/qwh']h&]h$]h%]h)]uhhah]qxh5Xrsyslog configuration builderqyqz}q{(hUhhsubah U referenceq|ubcdocutils.nodes target q})q~}q(hX8 U referencedqKhhah Utargetqh"}q(Urefurihwh']qhah&]h$]h%]h)]qh auh]ubh5X tool.qq}q(hX tool.hhaubeubcdocutils.nodes compound q)q}q(hUhhhhh Ucompoundqh"}q(h$]h%]qUtoctree-wrapperqah&]h']h)]uh+Nh,hh]qcsphinx.addnodes toctree q)q}q(hUhhhhh Utoctreeqh"}q(UnumberedqKU includehiddenqhXconfiguration/indexqUcaptionqNUglobqh']h&]U titlesonlyqh$]h%]h)]Uentriesq]q(NXconfiguration/basic_structureqqNXconfiguration/templatesqqNXconfiguration/propertiesqqNXconfiguration/property_replacerqqNXconfiguration/filtersqqNXrainerscript/indexqqNXconfiguration/actionsqqNXconfiguration/inputqqNXconfiguration/parserqqNXconfiguration/timezoneqqNXconfiguration/examplesqqNXconfiguration/index_directivesqqNXconfiguration/modules/indexqqNXconfiguration/output_channelsqqNXconfiguration/dropprivqqNXconfiguration/ipv6qqNXconfiguration/cryprov_gcryqqNXconfiguration/dyn_statsqqNXconfiguration/lookup_tablesqqeUhiddenqÉU includefilesq]q(hhhhhhhhhhhhhhhhhhheUmaxdepthqKuh+K h]ubaubh9)q}q(hX"`Configuration file examples can be found in the rsyslog wiki `_. Also keep the `rsyslog config snippets `_ on your mind. These are ready-to-use real building blocks for rsyslog configuration.hhhhh h`_h"}q(UnameX<Configuration file examples can be found in the rsyslog wikihvX7http://wiki.rsyslog.com/index.php/Configuration_Samplesqh']h&]h$]h%]h)]uhhh]qh5X<Configuration file examples can be found in the rsyslog wikiqЅq}q(hUhhubah h|ubh})q}q(hX: hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5X. Also keep the q؅q}q(hX. Also keep the hhubhr)q}q(hXD`rsyslog config snippets `_h"}q(UnameXrsyslog config snippetshvX'http://www.rsyslog.com/config-snippets/qh']h&]h$]h%]h)]uhhh]qh5Xrsyslog config snippetsqq}q(hUhhubah h|ubh})q}q(hX* hKhhh hh"}q(Urefurihh']qhah&]h$]h%]h)]qhauh]ubh5XU on your mind. These are ready-to-use real building blocks for rsyslog configuration.q腁q}q(hXU on your mind. These are ready-to-use real building blocks for rsyslog configuration.hhubeubh9)q}q(hXThere is also one sample file provided together with the documentation set. If you do not like to read, be sure to have at least a quick look at :download:`rsyslog-example.conf `.hhhhh h`qhhhhh Udownload_referenceqh"}q(UreftypeXdownloadqUrefwarnqU reftargetqXrsyslog-example.confU refdomainUh']h&]U refexplicith$]h%]h)]UrefdocqhUfilenameqXrsyslog-example.confquh+K(h]qhK)q}r(hhh"}r(h$]h%]r(Uxrefrheh&]h']h)]uhhh]rh5Xrsyslog-example.confrr}r(hUhhubah hSubaubh5X.r}r (hX.hhubeubh9)r }r (hXWhile rsyslogd contains enhancements over standard syslogd, efforts have been made to keep the configuration file as compatible as possible. While, for obvious reasons, :doc:`enhanced features <../features>` require a different config file syntax, rsyslogd should be able to work with a standard syslog.conf file. This is especially useful while you are migrating from syslogd to rsyslogd.hhhhh h`rhj hhh U pending_xrefrh"}r(UreftypeXdocrhhX ../featuresU refdomainUh']h&]U refexplicith$]h%]h)]hhuh+K,h]rhK)r}r(hjh"}r(h$]h%]r(jjeh&]h']h)]uhjh]rh5Xenhanced featuresrr}r (hUhjubah hSubaubh5X require a different config file syntax, rsyslogd should be able to work with a standard syslog.conf file. This is especially useful while you are migrating from syslogd to rsyslogd.r!r"}r#(hX require a different config file syntax, rsyslogd should be able to work with a standard syslog.conf file. This is especially useful while you are migrating from syslogd to rsyslogd.hj ubeubeubahUU transformerr$NU footnote_refsr%}r&Urefnamesr'}r(Usymbol_footnotesr)]r*Uautofootnote_refsr+]r,Usymbol_footnote_refsr-]r.U citationsr/]r0h,hU current_liner1NUtransform_messagesr2]r3Ureporterr4NUid_startr5KU autofootnotesr6]r7U citation_refsr8}r9Uindirect_targetsr:]r;Usettingsr<(cdocutils.frontend Values r=or>}r?(Ufootnote_backlinksr@KUrecord_dependenciesrANU rfc_base_urlrBUhttps://tools.ietf.org/html/rCU tracebackrDUpep_referencesrENUstrip_commentsrFNU toc_backlinksrGUentryrHU language_coderIUenrJU datestamprKNU report_levelrLKU _destinationrMNU halt_levelrNKU strip_classesrONh2NUerror_encoding_error_handlerrPUbackslashreplacerQUdebugrRNUembed_stylesheetrSUoutput_encoding_error_handlerrTUstrictrUU sectnum_xformrVKUdump_transformsrWNU docinfo_xformrXKUwarning_streamrYNUpep_file_url_templaterZUpep-%04dr[Uexit_status_levelr\KUconfigr]NUstrict_visitorr^NUcloak_email_addressesr_Utrim_footnote_reference_spacer`UenvraNUdump_pseudo_xmlrbNUexpose_internalsrcNUsectsubtitle_xformrdU source_linkreNUrfc_referencesrfNUoutput_encodingrgUutf-8rhU source_urlriNUinput_encodingrjU utf-8-sigrkU_disable_configrlNU id_prefixrmUU tab_widthrnKUerror_encodingroUUTF-8rpU_sourcerqhUgettext_compactrrU generatorrsNUdump_internalsrtNU smart_quotesruU pep_base_urlrvU https://www.python.org/dev/peps/rwUsyntax_highlightrxUlongryUinput_encoding_error_handlerrzjUUauto_id_prefixr{Uidr|Udoctitle_xformr}Ustrip_elements_with_classesr~NU _config_filesr]rUfile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhhh~uUsubstitution_namesr}rh h,h"}r(h$]h']h&]Usourcehh%]h)]uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/filters.doctree0000664000175000017500000014600313035122641020414 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xproperty replacer documentationqXbsd-style blocksqNXexpression documentationqXcompare-operationsq NXadisconq X selectorsq NX value partq NXfilter conditionsq NXproperty-based filtersqNXrainer gerhardsqXexamplesqNXrsyslogqXexpression-based filtersqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUproperty-replacer-documentationqhUbsd-style-blocksqhUexpression-documentationqh Ucompare-operationsqh Uadisconq h U selectorsq!h U value-partq"h Ufilter-conditionsq#hUproperty-based-filtersq$hUrainer-gerhardsq%hUexamplesq&hUrsyslogq'hUexpression-based-filtersq(uUchildrenq)]q*cdocutils.nodes section q+)q,}q-(U rawsourceq.UUparentq/hUsourceq0X</home/rger/proj/rsyslog-doc/source/configuration/filters.rstq1Utagnameq2Usectionq3U attributesq4}q5(Udupnamesq6]Uclassesq7]Ubackrefsq8]Uidsq9]q:h#aUnamesq;]qhh)]q?(cdocutils.nodes title q@)qA}qB(h.XFilter ConditionsqCh/h,h0h1h2UtitleqDh4}qE(h6]h7]h8]h9]h;]uh=Kh>hh)]qFcdocutils.nodes Text qGXFilter ConditionsqHqI}qJ(h.hCh/hAubaubcdocutils.nodes paragraph qK)qL}qM(h.X8Rsyslog offers four different types "filter conditions":qNh/h,h0h1h2U paragraphqOh4}qP(h6]h7]h8]h9]h;]uh=Kh>hh)]qQhGX8Rsyslog offers four different types "filter conditions":qRqS}qT(h.hNh/hLubaubcdocutils.nodes bullet_list qU)qV}qW(h.Uh/h,h0h1h2U bullet_listqXh4}qY(UbulletqZX-h9]h8]h6]h7]h;]uh=Kh>hh)]q[(cdocutils.nodes list_item q\)q]}q^(h.X3"traditional" severity and facility based selectorsq_h/hVh0h1h2U list_itemq`h4}qa(h6]h7]h8]h9]h;]uh=Nh>hh)]qbhK)qc}qd(h.h_h/h]h0h1h2hOh4}qe(h6]h7]h8]h9]h;]uh=Kh)]qfhGX3"traditional" severity and facility based selectorsqgqh}qi(h.h_h/hcubaubaubh\)qj}qk(h.Xproperty-based filtersqlh/hVh0h1h2h`h4}qm(h6]h7]h8]h9]h;]uh=Nh>hh)]qnhK)qo}qp(h.hlh/hjh0h1h2hOh4}qq(h6]h7]h8]h9]h;]uh=Kh)]qrhGXproperty-based filtersqsqt}qu(h.hlh/houbaubaubh\)qv}qw(h.Xexpression-based filtersqxh/hVh0h1h2h`h4}qy(h6]h7]h8]h9]h;]uh=Nh>hh)]qzhK)q{}q|(h.hxh/hvh0h1h2hOh4}q}(h6]h7]h8]h9]h;]uh=Kh)]q~hGXexpression-based filtersqq}q(h.hxh/h{ubaubaubh\)q}q(h.X)BSD-style blocks (not upward compatible) h/hVh0h1h2h`h4}q(h6]h7]h8]h9]h;]uh=Nh>hh)]qhK)q}q(h.X(BSD-style blocks (not upward compatible)qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K h)]qhGX(BSD-style blocks (not upward compatible)qq}q(h.hh/hubaubaubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qh!ah;]qh auh=K h>hh)]q(h@)q}q(h.X Selectorsqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=K h>hh)]qhGX Selectorsqq}q(h.hh/hubaubhK)q}q(h.X**Selectors are the traditional way of filtering syslog messages.** They have been kept in rsyslog with their original syntax, because it is well-known, highly effective and also needed for compatibility with stock syslogd configuration files. If you just need to filter based on priority and facility, you should do this with selector lines. They are **not** second-class citizens in rsyslog and offer the best performance for this job.h/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]q(cdocutils.nodes strong q)q}q(h.XC**Selectors are the traditional way of filtering syslog messages.**h4}q(h6]h7]h8]h9]h;]uh/hh)]qhGX?Selectors are the traditional way of filtering syslog messages.qq}q(h.Uh/hubah2UstrongqubhGX They have been kept in rsyslog with their original syntax, because it is well-known, highly effective and also needed for compatibility with stock syslogd configuration files. If you just need to filter based on priority and facility, you should do this with selector lines. They are qq}q(h.X They have been kept in rsyslog with their original syntax, because it is well-known, highly effective and also needed for compatibility with stock syslogd configuration files. If you just need to filter based on priority and facility, you should do this with selector lines. They are h/hubh)q}q(h.X**not**h4}q(h6]h7]h8]h9]h;]uh/hh)]qhGXnotqq}q(h.Uh/hubah2hubhGXN second-class citizens in rsyslog and offer the best performance for this job.qq}q(h.XN second-class citizens in rsyslog and offer the best performance for this job.h/hubeubhK)q}q(h.X|The selector field itself again consists of two parts, a facility and a priority, separated by a period (".''). Both parts are case insensitive and can also be specified as decimal numbers, but don't do that, you have been warned. Both facilities and priorities are described in syslog(3). The names mentioned below correspond to the similar LOG\_-values in /usr/include/syslog.h.h/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGX{The selector field itself again consists of two parts, a facility and a priority, separated by a period (".''). Both parts are case insensitive and can also be specified as decimal numbers, but don't do that, you have been warned. Both facilities and priorities are described in syslog(3). The names mentioned below correspond to the similar LOG_-values in /usr/include/syslog.h.qq}q(h.X|The selector field itself again consists of two parts, a facility and a priority, separated by a period (".''). Both parts are case insensitive and can also be specified as decimal numbers, but don't do that, you have been warned. Both facilities and priorities are described in syslog(3). The names mentioned below correspond to the similar LOG\_-values in /usr/include/syslog.h.h/hubaubhK)q}q(h.XThe facility is one of the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7. The keyword security should not be used anymore and mark is only for internal use and therefore should not be used in applications. Anyway, you may want to specify and redirect these messages here. The facility specifies the subsystem that produced the message, i.e. all mail programs log with the mail facility (LOG\_MAIL) if they log using syslog.h/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=Kh>hh)]qhGX The facility is one of the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7. The keyword security should not be used anymore and mark is only for internal use and therefore should not be used in applications. Anyway, you may want to specify and redirect these messages here. The facility specifies the subsystem that produced the message, i.e. all mail programs log with the mail facility (LOG_MAIL) if they log using syslog.qq}q(h.XThe facility is one of the following keywords: auth, authpriv, cron, daemon, kern, lpr, mail, mark, news, security (same as auth), syslog, user, uucp and local0 through local7. The keyword security should not be used anymore and mark is only for internal use and therefore should not be used in applications. Anyway, you may want to specify and redirect these messages here. The facility specifies the subsystem that produced the message, i.e. all mail programs log with the mail facility (LOG\_MAIL) if they log using syslog.h/hubaubhK)q}q(h.XAThe priority is one of the following keywords, in ascending order: debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg, panic (same as emerg). The keywords error, warn and panic are deprecated and should not be used anymore. The priority defines the severity of the message.qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K&h>hh)]qhGXAThe priority is one of the following keywords, in ascending order: debug, info, notice, warning, warn (same as warning), err, error (same as err), crit, alert, emerg, panic (same as emerg). The keywords error, warn and panic are deprecated and should not be used anymore. The priority defines the severity of the message.qɅq}q(h.hh/hubaubhK)q}q(h.XThe behavior of the original BSD syslogd is that all messages of the specified priority and higher are logged according to the given action. Rsyslogd behaves the same, but has some extensions.qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K,h>hh)]qhGXThe behavior of the original BSD syslogd is that all messages of the specified priority and higher are logged according to the given action. Rsyslogd behaves the same, but has some extensions.qхq}q(h.hh/hubaubhK)q}q(h.X&In addition to the above mentioned names the rsyslogd(8) understands the following extensions: An asterisk ("\*'') stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility. You can specify multiple facilities with the same priority pattern in one statement using the comma (",'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.h/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K0h>hh)]qhGX%In addition to the above mentioned names the rsyslogd(8) understands the following extensions: An asterisk ("*'') stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility. You can specify multiple facilities with the same priority pattern in one statement using the comma (",'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.q؅q}q(h.X&In addition to the above mentioned names the rsyslogd(8) understands the following extensions: An asterisk ("\*'') stands for all facilities or all priorities, depending on where it is used (before or after the period). The keyword none stands for no priority of the given facility. You can specify multiple facilities with the same priority pattern in one statement using the comma (",'') operator. You may specify as much facilities as you want. Remember that only the facility part from such a statement is taken, a priority part would be skipped.h/hubaubhK)q}q(h.XMultiple selectors may be specified for a single action using the semicolon (";'') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K9h>hh)]qhGXMultiple selectors may be specified for a single action using the semicolon (";'') separator. Remember that each selector in the selector field is capable to overwrite the preceding ones. Using this behavior you can exclude some priorities from the pattern.qq}q(h.hh/hubaubhK)q}q(h.XRsyslogd has a syntax extension to the original BSD source, that makes its use more intuitively. You may precede every priority with an equals sign ("='') to specify only this single priority and not any of the above. You may also (both is valid, too) precede the priority with an exclamation mark ("!'') to ignore all that priorities, either exact this one or this and any higher priority. If you use both extensions than the exclamation mark must occur before the equals sign, just use it intuitively.qh/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=K>h>hh)]qhGXRsyslogd has a syntax extension to the original BSD source, that makes its use more intuitively. You may precede every priority with an equals sign ("='') to specify only this single priority and not any of the above. You may also (both is valid, too) precede the priority with an exclamation mark ("!'') to ignore all that priorities, either exact this one or this and any higher priority. If you use both extensions than the exclamation mark must occur before the equals sign, just use it intuitively.q腁q}q(h.hh/hubaubeubh+)q}q(h.Uh/h,h0h1h2h3h4}q(h6]h7]h8]h9]qh$ah;]qhauh=KHh>hh)]q(h@)q}q(h.XProperty-Based Filtersqh/hh0h1h2hDh4}q(h6]h7]h8]h9]h;]uh=KHh>hh)]qhGXProperty-Based Filtersqq}q(h.hh/hubaubhK)q}q(h.XProperty-based filters are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg. A list of all currently-supported properties can be found in the `property replacer documentation `_ (but keep in mind that only the properties, not the replacer is supported). With this filter, each properties can be checked against a specified value, using a specified compare operation.h/hh0h1h2hOh4}q(h6]h7]h8]h9]h;]uh=KJh>hh)]q(hGXProperty-based filters are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg. A list of all currently-supported properties can be found in the qq}q(h.XProperty-based filters are unique to rsyslogd. They allow to filter on any property, like HOSTNAME, syslogtag and msg. A list of all currently-supported properties can be found in the h/hubcdocutils.nodes reference r)r}r(h.X;`property replacer documentation `_h4}r(UnameXproperty replacer documentationUrefurirXproperty_replacer.htmlrh9]h8]h6]h7]h;]uh/hh)]rhGXproperty replacer documentationrr}r (h.Uh/jubah2U referencer ubcdocutils.nodes target r )r }r (h.X U referencedrKh/hh2Utargetrh4}r(Urefurijh9]rhah8]h6]h7]h;]rhauh)]ubhGX (but keep in mind that only the properties, not the replacer is supported). With this filter, each properties can be checked against a specified value, using a specified compare operation.rr}r(h.X (but keep in mind that only the properties, not the replacer is supported). With this filter, each properties can be checked against a specified value, using a specified compare operation.h/hubeubhK)r}r(h.XA property-based filter must start with a colon **in column 0**. This tells rsyslogd that it is the new filter type. The colon must be followed by the property name, a comma, the name of the compare operation to carry out, another comma and then the value to compare against. This value must be quoted. There can be spaces and tabs between the commas. Property names and compare operations are case-sensitive, so "msg" works, while "MSG" is an invalid property name. In brief, the syntax is as follows:h/hh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=KRh>hh)]r(hGX0A property-based filter must start with a colon rr}r(h.X0A property-based filter must start with a colon h/jubh)r}r(h.X**in column 0**h4}r(h6]h7]h8]h9]h;]uh/jh)]r hGX in column 0r!r"}r#(h.Uh/jubah2hubhGX. This tells rsyslogd that it is the new filter type. The colon must be followed by the property name, a comma, the name of the compare operation to carry out, another comma and then the value to compare against. This value must be quoted. There can be spaces and tabs between the commas. Property names and compare operations are case-sensitive, so "msg" works, while "MSG" is an invalid property name. In brief, the syntax is as follows:r$r%}r&(h.X. This tells rsyslogd that it is the new filter type. The colon must be followed by the property name, a comma, the name of the compare operation to carry out, another comma and then the value to compare against. This value must be quoted. There can be spaces and tabs between the commas. Property names and compare operations are case-sensitive, so "msg" works, while "MSG" is an invalid property name. In brief, the syntax is as follows:h/jubeubhK)r'}r((h.X,``:property, [!]compare-operation, "value"``r)h/hh0h1h2hOh4}r*(h6]h7]h8]h9]h;]uh=K[h>hh)]r+cdocutils.nodes literal r,)r-}r.(h.j)h4}r/(h6]h7]h8]h9]h;]uh/j'h)]r0hGX(:property, [!]compare-operation, "value"r1r2}r3(h.Uh/j-ubah2Uliteralr4ubaubh+)r5}r6(h.Uh/hh0h1h2h3h4}r7(h6]h7]h8]h9]r8hah;]r9h auh=K^h>hh)]r:(h@)r;}r<(h.XCompare-Operationsr=h/j5h0h1h2hDh4}r>(h6]h7]h8]h9]h;]uh=K^h>hh)]r?hGXCompare-Operationsr@rA}rB(h.j=h/j;ubaubhK)rC}rD(h.X=The following **compare-operations** are currently supported:rEh/j5h0h1h2hOh4}rF(h6]h7]h8]h9]h;]uh=K`h>hh)]rG(hGXThe following rHrI}rJ(h.XThe following h/jCubh)rK}rL(h.X**compare-operations**h4}rM(h6]h7]h8]h9]h;]uh/jCh)]rNhGXcompare-operationsrOrP}rQ(h.Uh/jKubah2hubhGX are currently supported:rRrS}rT(h.X are currently supported:h/jCubeubcdocutils.nodes definition_list rU)rV}rW(h.Uh/j5h0h1h2Udefinition_listrXh4}rY(h6]h7]h8]h9]h;]uh=Nh>hh)]rZ(cdocutils.nodes definition_list_item r[)r\}r](h.X**contains** Checks if the string provided in value is contained in the property. There must be an exact match, wildcards are not supported. h/jVh0h1h2Udefinition_list_itemr^h4}r_(h6]h7]h8]h9]h;]uh=Kdh)]r`(cdocutils.nodes term ra)rb}rc(h.X **contains**rdh/j\h0h1h2Utermreh4}rf(h6]h7]h8]h9]h;]uh=Kdh)]rgh)rh}ri(h.jdh4}rj(h6]h7]h8]h9]h;]uh/jbh)]rkhGXcontainsrlrm}rn(h.Uh/jhubah2hubaubcdocutils.nodes definition ro)rp}rq(h.Uh4}rr(h6]h7]h8]h9]h;]uh/j\h)]rshK)rt}ru(h.XChecks if the string provided in value is contained in the property. There must be an exact match, wildcards are not supported.rvh/jph0h1h2hOh4}rw(h6]h7]h8]h9]h;]uh=Kch)]rxhGXChecks if the string provided in value is contained in the property. There must be an exact match, wildcards are not supported.ryrz}r{(h.jvh/jtubaubah2U definitionr|ubeubj[)r}}r~(h.X**isequal** Compares the "value" string provided and the property contents. These two values must be exactly equal to match. The difference to contains is that contains searches for the value anywhere inside the property value, whereas all characters must be identical for isequal. As such, isequal is most useful for fields like syslogtag or FROMHOST, where you probably know the exact contents. h/jVh0h1h2j^h4}r(h6]h7]h8]h9]h;]uh=Klh>hh)]r(ja)r}r(h.X **isequal**rh/j}h0h1h2jeh4}r(h6]h7]h8]h9]h;]uh=Klh)]rh)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXisequalrr}r(h.Uh/jubah2hubaubjo)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/j}h)]rhK)r}r(h.XCompares the "value" string provided and the property contents. These two values must be exactly equal to match. The difference to contains is that contains searches for the value anywhere inside the property value, whereas all characters must be identical for isequal. As such, isequal is most useful for fields like syslogtag or FROMHOST, where you probably know the exact contents.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kgh)]rhGXCompares the "value" string provided and the property contents. These two values must be exactly equal to match. The difference to contains is that contains searches for the value anywhere inside the property value, whereas all characters must be identical for isequal. As such, isequal is most useful for fields like syslogtag or FROMHOST, where you probably know the exact contents.rr}r(h.jh/jubaubah2j|ubeubj[)r}r(h.X **startswith** Checks if the value is found exactly at the beginning of the property value. For example, if you search for "val" with ``:msg, startswith, "val"`` it will be a match if msg contains "values are in this message" but it won't match if the msg contains "There are values in this message" (in the later case, *"contains"* would match). Please note that "startswith" is by far faster than regular expressions. So even once they are implemented, it can make very much sense (performance-wise) to use "startswith". h/jVh0h1h2j^h4}r(h6]h7]h8]h9]h;]uh=Kyh>hh)]r(ja)r}r(h.X**startswith**rh/jh0h1h2jeh4}r(h6]h7]h8]h9]h;]uh=Kyh)]rh)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX startswithrr}r(h.Uh/jubah2hubaubjo)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]r(hK)r}r(h.XvChecks if the value is found exactly at the beginning of the property value. For example, if you search for "val" withrh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Koh)]rhGXvChecks if the value is found exactly at the beginning of the property value. For example, if you search for "val" withrr}r(h.jh/jubaubhK)r}r(h.X``:msg, startswith, "val"``rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Krh)]rj,)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX:msg, startswith, "val"rr}r(h.Uh/jubah2j4ubaubhK)r}r(h.Xhit will be a match if msg contains "values are in this message" but it won't match if the msg contains "There are values in this message" (in the later case, *"contains"* would match). Please note that "startswith" is by far faster than regular expressions. So even once they are implemented, it can make very much sense (performance-wise) to use "startswith".h/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kth)]r(hGXit will be a match if msg contains "values are in this message" but it won't match if the msg contains "There are values in this message" (in the later case, rr}r(h.Xit will be a match if msg contains "values are in this message" but it won't match if the msg contains "There are values in this message" (in the later case, h/jubcdocutils.nodes emphasis r)r}r(h.X *"contains"*h4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX "contains"rr}r(h.Uh/jubah2UemphasisrubhGX would match). Please note that "startswith" is by far faster than regular expressions. So even once they are implemented, it can make very much sense (performance-wise) to use "startswith".rr}r(h.X would match). Please note that "startswith" is by far faster than regular expressions. So even once they are implemented, it can make very much sense (performance-wise) to use "startswith".h/jubeubeh2j|ubeubj[)r}r(h.XS**regex** Compares the property against the provided POSIX BRE regular expression. h/jVh0h1h2j^h4}r(h6]h7]h8]h9]h;]uh=K|h>hh)]r(ja)r}r(h.X **regex**rh/jh0h1h2jeh4}r(h6]h7]h8]h9]h;]uh=K|h)]rh)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXregexrr}r(h.Uh/jubah2hubaubjo)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhK)r}r(h.XHCompares the property against the provided POSIX BRE regular expression.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=K|h)]rhGXHCompares the property against the provided POSIX BRE regular expression.rr}r(h.jh/jubaubah2j|ubeubj[)r}r(h.XV**ereregex** Compares the property against the provided POSIX ERE regular expression. h/jVh0h1h2j^h4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(ja)r}r(h.X **ereregex**rh/jh0h1h2jeh4}r(h6]h7]h8]h9]h;]uh=Kh)]rh)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXereregexrr}r(h.Uh/jubah2hubaubjo)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhK)r}r(h.XHCompares the property against the provided POSIX ERE regular expression.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh)]rhGXHCompares the property against the provided POSIX ERE regular expression.r r }r (h.jh/jubaubah2j|ubeubeubhK)r }r (h.XYou can use the bang-character (!) immediately in front of a compare-operation, the outcome of this operation is negated. For example, if msg contains "This is an informative message", the following sample would not match:rh/j5h0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXYou can use the bang-character (!) immediately in front of a compare-operation, the outcome of this operation is negated. For example, if msg contains "This is an informative message", the following sample would not match:rr}r(h.jh/j ubaubhK)r}r(h.X``:msg, contains, "error"``rh/j5h0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rj,)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX:msg, contains, "error"rr}r(h.Uh/jubah2j4ubaubhK)r }r!(h.Xbut this one matches:r"h/j5h0h1h2hOh4}r#(h6]h7]h8]h9]h;]uh=Kh>hh)]r$hGXbut this one matches:r%r&}r'(h.j"h/j ubaubhK)r(}r)(h.X``:msg, !contains, "error"``r*h/j5h0h1h2hOh4}r+(h6]h7]h8]h9]h;]uh=Kh>hh)]r,j,)r-}r.(h.j*h4}r/(h6]h7]h8]h9]h;]uh/j(h)]r0hGX:msg, !contains, "error"r1r2}r3(h.Uh/j-ubah2j4ubaubhK)r4}r5(h.XUsing negation can be useful if you would like to do some generic processing but exclude some specific events. You can use the discard action in conjunction with that. A sample would be:r6h/j5h0h1h2hOh4}r7(h6]h7]h8]h9]h;]uh=Kh>hh)]r8hGXUsing negation can be useful if you would like to do some generic processing but exclude some specific events. You can use the discard action in conjunction with that. A sample would be:r9r:}r;(h.j6h/j4ubaubcdocutils.nodes literal_block r<)r=}r>(h.X*.* /var/log/allmsgs-including-informational.log :msg, contains, "informational"  ~ *.* /var/log/allmsgs-but-informational.logh/j5h0h1h2U literal_blockr?h4}r@(U xml:spacerAUpreserverBh9]h8]h6]h7]h;]uh=Kh>hh)]rChGX*.* /var/log/allmsgs-including-informational.log :msg, contains, "informational"  ~ *.* /var/log/allmsgs-but-informational.logrDrE}rF(h.Uh/j=ubaubhK)rG}rH(h.XDo not overlook the tilde in line 2! In this sample, all messages are written to the file allmsgs-including-informational.log. Then, all messages containing the string "informational" are discarded. That means the config file lines below the "discard line" (number 2 in our sample) will not be applied to this message. Then, all remaining lines will also be written to the file allmsgs-but-informational.log.rIh/j5h0h1h2hOh4}rJ(h6]h7]h8]h9]h;]uh=Kh>hh)]rKhGXDo not overlook the tilde in line 2! In this sample, all messages are written to the file allmsgs-including-informational.log. Then, all messages containing the string "informational" are discarded. That means the config file lines below the "discard line" (number 2 in our sample) will not be applied to this message. Then, all remaining lines will also be written to the file allmsgs-but-informational.log.rLrM}rN(h.jIh/jGubaubeubh+)rO}rP(h.Uh/hh0h1h2h3h4}rQ(h6]h7]h8]h9]rRh"ah;]rSh auh=Kh>hh)]rT(h@)rU}rV(h.X Value PartrWh/jOh0h1h2hDh4}rX(h6]h7]h8]h9]h;]uh=Kh>hh)]rYhGX Value PartrZr[}r\(h.jWh/jUubaubhK)r]}r^(h.X@**Value** is a quoted string. It supports some escape sequences:r_h/jOh0h1h2hOh4}r`(h6]h7]h8]h9]h;]uh=Kh>hh)]ra(h)rb}rc(h.X **Value**h4}rd(h6]h7]h8]h9]h;]uh/j]h)]rehGXValuerfrg}rh(h.Uh/jbubah2hubhGX7 is a quoted string. It supports some escape sequences:rirj}rk(h.X7 is a quoted string. It supports some escape sequences:h/j]ubeubjU)rl}rm(h.Uh/jOh0h1h2jXh4}rn(h6]h7]h8]h9]h;]uh=Nh>hh)]roj[)rp}rq(h.Xn\\" - the quote character (e.g. "String with \\"Quotes\\"") \\\\ - the backslash character (e.g. "C:\\\\tmp") h/jlh0h1h2j^h4}rr(h6]h7]h8]h9]h;]uh=Kh)]rs(ja)rt}ru(h.X;\\" - the quote character (e.g. "String with \\"Quotes\\"")rvh/jph0h1h2jeh4}rw(h6]h7]h8]h9]h;]uh=Kh)]rxhGX8\" - the quote character (e.g. "String with \"Quotes\"")ryrz}r{(h.X;\\" - the quote character (e.g. "String with \\"Quotes\\"")h/jtubaubjo)r|}r}(h.Uh4}r~(h6]h7]h8]h9]h;]uh/jph)]rhK)r}r(h.X1\\\\ - the backslash character (e.g. "C:\\\\tmp")rh/j|h0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh)]rhGX-\\ - the backslash character (e.g. "C:\\tmp")rr}r(h.X1\\\\ - the backslash character (e.g. "C:\\\\tmp")h/jubaubah2j|ubeubaubhK)r}r(h.XEscape sequences always start with a backslash. Additional escape sequences might be added in the future. Backslash characters **must** be escaped. Any other sequence then those outlined above is invalid and may lead to unpredictable results.h/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(hGXEscape sequences always start with a backslash. Additional escape sequences might be added in the future. Backslash characters rr}r(h.XEscape sequences always start with a backslash. Additional escape sequences might be added in the future. Backslash characters h/jubh)r}r(h.X**must**h4}r(h6]h7]h8]h9]h;]uh/jh)]rhGXmustrr}r(h.Uh/jubah2hubhGXk be escaped. Any other sequence then those outlined above is invalid and may lead to unpredictable results.rr}r(h.Xk be escaped. Any other sequence then those outlined above is invalid and may lead to unpredictable results.h/jubeubhK)r}r(h.XProbably, "msg" is the most prominent use case of property based filters. It is the actual message text. If you would like to filter based on some message content (e.g. the presence of a specific code), this can be done easily by:rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXProbably, "msg" is the most prominent use case of property based filters. It is the actual message text. If you would like to filter based on some message content (e.g. the presence of a specific code), this can be done easily by:rr}r(h.jh/jubaubhK)r}r(h.X``:msg, contains, "ID-4711"``rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rj,)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX:msg, contains, "ID-4711"rr}r(h.Uh/jubah2j4ubaubhK)r}r(h.XThis filter will match when the message contains the string "ID-4711". Please note that the comparison is case-sensitive, so it would not match if "id-4711" would be contained in the message.rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXThis filter will match when the message contains the string "ID-4711". Please note that the comparison is case-sensitive, so it would not match if "id-4711" would be contained in the message.rr}r(h.jh/jubaubhK)r}r(h.X!``:msg, regex, "fatal .* error"``rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rj,)r}r(h.jh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX:msg, regex, "fatal .* error"rr}r(h.Uh/jubah2j4ubaubhK)r}r(h.XThis filter uses a POSIX regular expression. It matches when the string contains the words "fatal" and "error" with anything in between (e.g. "fatal net error" and "fatal lib error" but not "fatal error" as two spaces are required by the regular expression!).rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXThis filter uses a POSIX regular expression. It matches when the string contains the words "fatal" and "error" with anything in between (e.g. "fatal net error" and "fatal lib error" but not "fatal error" as two spaces are required by the regular expression!).rr}r(h.jh/jubaubhK)r}r(h.X&Getting property-based filters right can sometimes be challenging. In order to help you do it with as minimal effort as possible, rsyslogd spits out debug information for all property-based filters during their evaluation. To enable this, run rsyslogd in foreground and specify the "-d" option.rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGX&Getting property-based filters right can sometimes be challenging. In order to help you do it with as minimal effort as possible, rsyslogd spits out debug information for all property-based filters during their evaluation. To enable this, run rsyslogd in foreground and specify the "-d" option.rr}r(h.jh/jubaubhK)r}r(h.X^Boolean operations inside property based filters (like 'message contains "ID17" or message contains "ID18"') are currently not supported (except for "not" as outlined above). Please note that while it is possible to query facility and severity via property-based filters, it is far more advisable to use classic selectors (see above) for those cases.rh/jOh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGX^Boolean operations inside property based filters (like 'message contains "ID17" or message contains "ID18"') are currently not supported (except for "not" as outlined above). Please note that while it is possible to query facility and severity via property-based filters, it is far more advisable to use classic selectors (see above) for those cases.rr}r(h.jh/jubaubeubeubh+)r}r(h.Uh/h,h0h1h2h3h4}r(h6]h7]h8]h9]rh(ah;]rhauh=Kh>hh)]r(h@)r}r(h.XExpression-Based Filtersrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXExpression-Based Filtersrr}r(h.jh/jubaubhK)r}r(h.X"Expression based filters allow filtering on arbitrary complex expressions, which can include boolean, arithmetic and string operations. Expression filters will evolve into a full configuration scripting language. Unfortunately, their syntax will slightly change during that process. So if you use them now, you need to be prepared to change your configuration files some time later. However, we try to implement the scripting facility as soon as possible (also in respect to stage work needed). So the window of exposure is probably not too long.rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGX"Expression based filters allow filtering on arbitrary complex expressions, which can include boolean, arithmetic and string operations. Expression filters will evolve into a full configuration scripting language. Unfortunately, their syntax will slightly change during that process. So if you use them now, you need to be prepared to change your configuration files some time later. However, we try to implement the scripting facility as soon as possible (also in respect to stage work needed). So the window of exposure is probably not too long.rr}r(h.jh/jubaubhK)r}r(h.XlExpression based filters are indicated by the keyword "if" in column 1 of a new line. They have this format:rh/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXlExpression based filters are indicated by the keyword "if" in column 1 of a new line. They have this format:rr}r(h.jh/jubaubj<)r}r(h.X)if expr then action-part-of-selector-lineh/jh0h1h2j?h4}r(jAjBh9]h8]h6]h7]h;]uh=Kh>hh)]rhGX)if expr then action-part-of-selector-linerr}r(h.Uh/jubaubhK)r}r(h.X0"if" and "then" are fixed keywords that mus be present. "expr" is a (potentially quite complex) expression. So the `expression documentation <../rainerscript/expressions.html>`_ for details. "action-part-of-selector-line" is an action, just as you know it (e.g. "/var/log/logfile" to write to that file).h/jh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]r(hGXs"if" and "then" are fixed keywords that mus be present. "expr" is a (potentially quite complex) expression. So the rr}r(h.Xs"if" and "then" are fixed keywords that mus be present. "expr" is a (potentially quite complex) expression. So the h/jubj)r}r(h.X>`expression documentation <../rainerscript/expressions.html>`_h4}r(UnameXexpression documentationjX ../rainerscript/expressions.htmlrh9]h8]h6]h7]h;]uh/jh)]r hGXexpression documentationr r }r (h.Uh/jubah2j ubj )r }r(h.X# <../rainerscript/expressions.html>jKh/jh2jh4}r(Urefurijh9]rhah8]h6]h7]h;]rhauh)]ubhGX for details. "action-part-of-selector-line" is an action, just as you know it (e.g. "/var/log/logfile" to write to that file).rr}r(h.X for details. "action-part-of-selector-line" is an action, just as you know it (e.g. "/var/log/logfile" to write to that file).h/jubeubeubh+)r}r(h.Uh/h,h0h1h2h3h4}r(h6]h7]h8]h9]rhah;]rhauh=Kh>hh)]r(h@)r}r(h.XBSD-style Blocksrh/jh0h1h2hDh4}r(h6]h7]h8]h9]h;]uh=Kh>hh)]rhGXBSD-style Blocksr r!}r"(h.jh/jubaubhK)r#}r$(h.X**Note:** rsyslog v7+ does no longer support BSD-style blocks for technical reasons. So it is strongly recommended **not** to use them.h/jh0h1h2hOh4}r%(h6]h7]h8]h9]h;]uh=Kh>hh)]r&(h)r'}r((h.X **Note:**h4}r)(h6]h7]h8]h9]h;]uh/j#h)]r*hGXNote:r+r,}r-(h.Uh/j'ubah2hubhGXj rsyslog v7+ does no longer support BSD-style blocks for technical reasons. So it is strongly recommended r.r/}r0(h.Xj rsyslog v7+ does no longer support BSD-style blocks for technical reasons. So it is strongly recommended h/j#ubh)r1}r2(h.X**not**h4}r3(h6]h7]h8]h9]h;]uh/j#h)]r4hGXnotr5r6}r7(h.Uh/j1ubah2hubhGX to use them.r8r9}r:(h.X to use them.h/j#ubeubhK)r;}r<(h.XRsyslogd supports BSD-style blocks inside rsyslog.conf. Each block of lines is separated from the previous block by a program or hostname specification. A block will only log messages corresponding to the most recent program and hostname specifications given. Thus, a block which selects ‘ppp’ as the program, directly followed by a block that selects messages from the hostname ‘dialhost’, then the second block will only log messages from the ppp program on dialhost.r=h/jh0h1h2hOh4}r>(h6]h7]h8]h9]h;]uh=Kh>hh)]r?hGXRsyslogd supports BSD-style blocks inside rsyslog.conf. Each block of lines is separated from the previous block by a program or hostname specification. A block will only log messages corresponding to the most recent program and hostname specifications given. Thus, a block which selects ‘ppp’ as the program, directly followed by a block that selects messages from the hostname ‘dialhost’, then the second block will only log messages from the ppp program on dialhost.r@rA}rB(h.j=h/j;ubaubhK)rC}rD(h.X|A program specification is a line beginning with ‘!prog’ and the following blocks will be associated with calls to syslog from that specific program. A program specification for ‘foo’ will also match any message logged by the kernel with the prefix ‘foo: ’. Alternatively, a program specification ‘-foo’ causes the following blocks to be applied to messages from any program but the one specified. A hostname specification of the form ‘+hostname’ and the following blocks will be applied to messages received from the specified hostname. Alternatively, a hostname specification ‘-hostname’ causes the following blocks to be applied to messages from any host but the one specified. If the hostname is given as ‘@’, the local hostname will be used. (NOT YET IMPLEMENTED) A program or hostname specification may be reset by giving the program or hostname as ‘\*’.h/jh0h1h2hOh4}rE(h6]h7]h8]h9]h;]uh=Kh>hh)]rFhGX{A program specification is a line beginning with ‘!prog’ and the following blocks will be associated with calls to syslog from that specific program. A program specification for ‘foo’ will also match any message logged by the kernel with the prefix ‘foo: ’. Alternatively, a program specification ‘-foo’ causes the following blocks to be applied to messages from any program but the one specified. A hostname specification of the form ‘+hostname’ and the following blocks will be applied to messages received from the specified hostname. Alternatively, a hostname specification ‘-hostname’ causes the following blocks to be applied to messages from any host but the one specified. If the hostname is given as ‘@’, the local hostname will be used. (NOT YET IMPLEMENTED) A program or hostname specification may be reset by giving the program or hostname as ‘*’.rGrH}rI(h.X|A program specification is a line beginning with ‘!prog’ and the following blocks will be associated with calls to syslog from that specific program. A program specification for ‘foo’ will also match any message logged by the kernel with the prefix ‘foo: ’. Alternatively, a program specification ‘-foo’ causes the following blocks to be applied to messages from any program but the one specified. A hostname specification of the form ‘+hostname’ and the following blocks will be applied to messages received from the specified hostname. Alternatively, a hostname specification ‘-hostname’ causes the following blocks to be applied to messages from any host but the one specified. If the hostname is given as ‘@’, the local hostname will be used. (NOT YET IMPLEMENTED) A program or hostname specification may be reset by giving the program or hostname as ‘\*’.h/jCubaubhK)rJ}rK(h.XPlease note that the "#!prog", "#+hostname" and "#-hostname" syntax available in BSD syslogd is not supported by rsyslogd. By default, no hostname or program is set.rLh/jh0h1h2hOh4}rM(h6]h7]h8]h9]h;]uh=Kh>hh)]rNhGXPlease note that the "#!prog", "#+hostname" and "#-hostname" syntax available in BSD syslogd is not supported by rsyslogd. By default, no hostname or program is set.rOrP}rQ(h.jLh/jJubaubeubh+)rR}rS(h.Uh/h,h0h1h2h3h4}rT(h6]h7]h8]h9]rUh&ah;]rVhauh=Mh>hh)]rW(h@)rX}rY(h.XExamplesrZh/jRh0h1h2hDh4}r[(h6]h7]h8]h9]h;]uh=Mh>hh)]r\hGXExamplesr]r^}r_(h.jZh/jXubaubj<)r`}ra(h.Xq*.* /var/log/file1 # the traditional way if $msg contains 'error' then /var/log/errlog # the expression-based wayh/jRh0h1h2j?h4}rb(jAjBh9]h8]h6]h7]h;]uh=Mh>hh)]rchGXq*.* /var/log/file1 # the traditional way if $msg contains 'error' then /var/log/errlog # the expression-based wayrdre}rf(h.Uh/j`ubaubhK)rg}rh(h.XRight now, you need to specify numerical values if you would like to check for facilities and severity. These can be found in :rfc:`5424`. If you don't like that, you can of course also use the textual property - just be sure to use the right one. As expression support is enhanced, this will change. For example, if you would like to filter on message that have facility local0, start with "DEVNAME" and have either "error1" or "error0" in their message content, you could use the following filter:h/jRh0h1h2hOh4}ri(h6]h7]h8]h9]h;]uh=M h>hh)]rj(hGX~Right now, you need to specify numerical values if you would like to check for facilities and severity. These can be found in rkrl}rm(h.X~Right now, you need to specify numerical values if you would like to check for facilities and severity. These can be found in h/jgubcsphinx.addnodes index rn)ro}rp(h.Uh4}rq(h9]h8]h6]h7]h;]Uentriesrr]rs(UsinglertX RFC; RFC 5424Uindex-0ruUtrvauh/jgh)]h2Uindexrwubj )rx}ry(h.Uh4}rz(h6]h7]h8]h9]r{juah;]uh/jgh)]h2jubj)r|}r}(h.XRFC 5424h4}r~(UrefuriU(https://tools.ietf.org/html/rfc5424.htmlh9]h8]h6]h7]rXrfcrah;]Uinternaluh/jgh)]rh)r}r(h.XRFC 5424h4}r(h6]h7]h8]h9]h;]uh/j|h)]rhGXRFC 5424rr}r(h.Uh/jubah2hubah2j ubhGXj. If you don't like that, you can of course also use the textual property - just be sure to use the right one. As expression support is enhanced, this will change. For example, if you would like to filter on message that have facility local0, start with "DEVNAME" and have either "error1" or "error0" in their message content, you could use the following filter:rr}r(h.Xj. If you don't like that, you can of course also use the textual property - just be sure to use the right one. As expression support is enhanced, this will change. For example, if you would like to filter on message that have facility local0, start with "DEVNAME" and have either "error1" or "error0" in their message content, you could use the following filter:h/jgubeubj<)r}r(h.Xif $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelogh/jRh0h1h2j?h4}r(jAjBh9]h8]h6]h7]h;]uh=Mh>hh)]rhGXif $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelogrr}r(h.Uh/jubaubhK)r}r(h.XPlease note that the above must all be on one line! And if you would like to store all messages except those that contain "error1" or "error0", you just need to add a "not":rh/jRh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Mh>hh)]rhGXPlease note that the above must all be on one line! And if you would like to store all messages except those that contain "error1" or "error0", you just need to add a "not":rr}r(h.jh/jubaubj<)r}r(h.Xif $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and not ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelogh/jRh0h1h2j?h4}r(jAjBh9]h8]h6]h7]h;]uh=Mh>hh)]rhGXif $syslogfacility-text == 'local0' and $msg startswith 'DEVNAME' and not ($msg contains 'error1' or $msg contains 'error0') then /var/log/somelogrr}r(h.Uh/jubaubhK)r}r(h.XIf you would like to do case-insensitive comparisons, use "contains\_i" instead of "contains" and "startswith\_i" instead of "startswith". Note that regular expressions are currently NOT supported in expression-based filters. These will be added later when function support is added to the expression engine (the reason is that regular expressions will be a separate loadable module, which requires some more prequisites before it can be implemented).h/jRh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=Mh>hh)]rhGXIf you would like to do case-insensitive comparisons, use "contains_i" instead of "contains" and "startswith_i" instead of "startswith". Note that regular expressions are currently NOT supported in expression-based filters. These will be added later when function support is added to the expression engine (the reason is that regular expressions will be a separate loadable module, which requires some more prequisites before it can be implemented).rr}r(h.XIf you would like to do case-insensitive comparisons, use "contains\_i" instead of "contains" and "startswith\_i" instead of "startswith". Note that regular expressions are currently NOT supported in expression-based filters. These will be added later when function support is added to the expression engine (the reason is that regular expressions will be a separate loadable module, which requires some more prequisites before it can be implemented).h/jubaubhK)r}r(h.XThis documentation is part of the `rsyslog `_ project. Copyright © 2008-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 2 or higher.h/jRh0h1h2hOh4}r(h6]h7]h8]h9]h;]uh=M'h>hh)]r(hGX"This documentation is part of the rr}r(h.X"This documentation is part of the h/jubj)r}r(h.X$`rsyslog `_h4}r(UnamehjXhttp://www.rsyslog.com/rh9]h8]h6]h7]h;]uh/jh)]rhGXrsyslogrr}r(h.Uh/jubah2j ubj )r}r(h.X jKh/jh2jh4}r(Urefurijh9]rh'ah8]h6]h7]h;]rhauh)]ubhGX$ project. Copyright © 2008-2014 by rr}r(h.X$ project. Copyright © 2008-2014 by h/jubj)r}r(h.X3`Rainer Gerhards `_h4}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrh9]h8]h6]h7]h;]uh/jh)]rhGXRainer Gerhardsrr}r(h.Uh/jubah2j ubj )r}r(h.X! jKh/jh2jh4}r(Urefurijh9]rh%ah8]h6]h7]h;]rhauh)]ubhGX and rr}r(h.X and h/jubj)r}r(h.X$`Adiscon `_h4}r(UnameXAdisconjXhttp://www.adiscon.com/rh9]h8]h6]h7]h;]uh/jh)]rhGXAdisconrr}r(h.Uh/jubah2j ubj )r}r(h.X jKh/jh2jh4}r(Urefurijh9]rh ah8]h6]h7]h;]rh auh)]ubhGX1. Released under the GNU GPL version 2 or higher.rr}r(h.X1. Released under the GNU GPL version 2 or higher.h/jubeubeubeubah.UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh>hU current_linerNUtransform_messagesr]rcdocutils.nodes system_message r)r}r(h.Uh4}r(h6]UlevelKh9]h8]Usourceh1h7]h;]UlineM UtypeUINFOruh)]rhK)r}r(h.Uh4}r(h6]h7]h8]h9]h;]uh/jh)]rhGX-Hyperlink target "index-0" is not referenced.rr}r(h.Uh/jubah2hOubah2Usystem_messagerubaUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r (Ufootnote_backlinksr KUrecord_dependenciesr NU rfc_base_urlr Uhttps://tools.ietf.org/html/r U tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNhDNUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformr KUdump_transformsr!NU docinfo_xformr"KUwarning_streamr#NUpep_file_url_templater$Upep-%04dr%Uexit_status_levelr&KUconfigr'NUstrict_visitorr(NUcloak_email_addressesr)Utrim_footnote_reference_spacer*Uenvr+NUdump_pseudo_xmlr,NUexpose_internalsr-NUsectsubtitle_xformr.U source_linkr/NUrfc_referencesr0NUoutput_encodingr1Uutf-8r2U source_urlr3NUinput_encodingr4U utf-8-sigr5U_disable_configr6NU id_prefixr7UU tab_widthr8KUerror_encodingr9UUTF-8r:U_sourcer;h1Ugettext_compactr<U generatorr=NUdump_internalsr>NU smart_quotesr?U pep_base_urlr@U https://www.python.org/dev/peps/rAUsyntax_highlightrBUlongrCUinput_encoding_error_handlerrDjUauto_id_prefixrEUidrFUdoctitle_xformrGUstrip_elements_with_classesrHNU _config_filesrI]Ufile_insertion_enabledrJU raw_enabledrKKU dump_settingsrLNubUsymbol_footnote_startrMKUidsrN}rO(h'jhjhj5hj h$hh jh!hh"jOh#h,h&jRh(jjujxhj h%juUsubstitution_namesrP}rQh2h>h4}rR(h6]h9]h8]Usourceh1h7]h;]uU footnotesrS]rTUrefidsrU}rVub.build/.doctrees/configuration/lookup_tables.doctree0000664000175000017500000012675313035122641021621 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(X sparsearrayqNXstringqNX:reload_lookup_table("
", "") (statement)qNXimplementation detailsq NX?lookup_table(name="
" file=""...) (object)q NX$lookup("
", ) (function)q NX lookup tablesq NXarrayq NXlookup table file formatqNXtypesqNXlookup-table configurationqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hU sparsearrayqhUstringqhU.reload-lookup-table-table-stub-value-statementqh Uimplementation-detailsqh U0lookup-table-name-table-file-path-to-file-objectqh Ulookup-table-expr-functionqh U lookup-tablesq h Uarrayq!hUlookup-table-file-formatq"hUtypesq#hUlookup-table-configurationq$uUchildrenq%]q&cdocutils.nodes section q')q(}q)(U rawsourceq*UUparentq+hUsourceq,XB/home/rger/proj/rsyslog-doc/source/configuration/lookup_tables.rstq-Utagnameq.Usectionq/U attributesq0}q1(Udupnamesq2]Uclassesq3]Ubackrefsq4]Uidsq5]q6h aUnamesq7]q8h auUlineq9KUdocumentq:hh%]q;(cdocutils.nodes title q<)q=}q>(h*X Lookup Tablesq?h+h(h,h-h.Utitleq@h0}qA(h2]h3]h4]h5]h7]uh9Kh:hh%]qBcdocutils.nodes Text qCX Lookup TablesqDqE}qF(h*h?h+h=ubaubcdocutils.nodes paragraph qG)qH}qI(h*XLookup tables are a powerful construct to obtain *class* information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).h+h(h,h-h.U paragraphqJh0}qK(h2]h3]h4]h5]h7]uh9Kh:hh%]qL(hCX1Lookup tables are a powerful construct to obtain qMqN}qO(h*X1Lookup tables are a powerful construct to obtain h+hHubcdocutils.nodes emphasis qP)qQ}qR(h*X*class*h0}qS(h2]h3]h4]h5]h7]uh+hHh%]qThCXclassqUqV}qW(h*Uh+hQubah.UemphasisqXubhCX information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).qYqZ}q[(h*X information based on message content. It works on top of a data-file which maps key (to be looked up) to value (the result of lookup).h+hHubeubhG)q\}q](h*XThe idea is to use a message properties (or derivatives of it) as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in.q^h+h(h,h-h.hJh0}q_(h2]h3]h4]h5]h7]uh9Kh:hh%]q`hCXThe idea is to use a message properties (or derivatives of it) as an index into a table which then returns another value. For example, $fromhost-ip could be used as an index, with the table value representing the type of server or the department or remote office it is located in.qaqb}qc(h*h^h+h\ubaubhG)qd}qe(h*XThis can be emulated using if and else-if stack, but implementing it as a dedicated component allows ``lookup`` to be made fast.h+h(h,h-h.hJh0}qf(h2]h3]h4]h5]h7]uh9K h:hh%]qg(hCXeThis can be emulated using if and else-if stack, but implementing it as a dedicated component allows qhqi}qj(h*XeThis can be emulated using if and else-if stack, but implementing it as a dedicated component allows h+hdubcdocutils.nodes literal qk)ql}qm(h*X ``lookup``h0}qn(h2]h3]h4]h5]h7]uh+hdh%]qohCXlookupqpqq}qr(h*Uh+hlubah.UliteralqsubhCX to be made fast.qtqu}qv(h*X to be made fast.h+hdubeubhG)qw}qx(h*XThe lookup tables itself exists in a separate data file (one per table). This file is loaded on Rsyslog startup and when a reload is requested.qyh+h(h,h-h.hJh0}qz(h2]h3]h4]h5]h7]uh9Kh:hh%]q{hCXThe lookup tables itself exists in a separate data file (one per table). This file is loaded on Rsyslog startup and when a reload is requested.q|q}}q~(h*hyh+hwubaubhG)q}q(h*XZThere are different types of lookup tables (identified by "type" field in json data-file).qh+h(h,h-h.hJh0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCXZThere are different types of lookup tables (identified by "type" field in json data-file).qq}q(h*hh+hubaubh')q}q(h*Uh+h(h,h-h.h/h0}q(h2]h3]h4]h5]qh#ah7]qhauh9Kh:hh%]q(h<)q}q(h*XTypesqh+hh,h-h.h@h0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCXTypesqq}q(h*hh+hubaubh')q}q(h*Uh+hh,h-h.h/h0}q(h2]h3]h4]h5]qhah7]qhauh9Kh:hh%]q(h<)q}q(h*Xstringqh+hh,h-h.h@h0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCXstringqq}q(h*hh+hubaubhG)q}q(h*X/The key to be looked up is an arbitrary string.qh+hh,h-h.hJh0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]qhCX/The key to be looked up is an arbitrary string.qq}q(h*hh+hubaubhG)q}q(h*XT**Match criterion**: The key must be exactly equal to index from one of the entries.qh+hh,h-h.hJh0}q(h2]h3]h4]h5]h7]uh9Kh:hh%]q(cdocutils.nodes strong q)q}q(h*X**Match criterion**h0}q(h2]h3]h4]h5]h7]uh+hh%]qhCXMatch criterionqq}q(h*Uh+hubah.UstrongqubhCXA: The key must be exactly equal to index from one of the entries.qq}q(h*XA: The key must be exactly equal to index from one of the entries.h+hubeubeubh')q}q(h*Uh+hh,h-h.h/h0}q(h2]h3]h4]h5]qh!ah7]qh auh9K h:hh%]q(h<)q}q(h*Xarrayqh+hh,h-h.h@h0}q(h2]h3]h4]h5]h7]uh9K h:hh%]qhCXarrayqDžq}q(h*hh+hubaubhG)q}q(h*XThe value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example ``5,6,7,8,9`` would be a valid set of index values, while ``1,2,4,5`` would not be (due to missing ``3``).h+hh,h-h.hJh0}q(h2]h3]h4]h5]h7]uh9K"h:hh%]q(hCXThe value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example q΅q}q(h*XThe value to be looked up is an integer number from a consequtive set. The set does not need to start at zero or one, but there must be no number missing. So, for example h+hubhk)q}q(h*X ``5,6,7,8,9``h0}q(h2]h3]h4]h5]h7]uh+hh%]qhCX 5,6,7,8,9qՅq}q(h*Uh+hubah.hsubhCX- would be a valid set of index values, while q؅q}q(h*X- would be a valid set of index values, while h+hubhk)q}q(h*X ``1,2,4,5``h0}q(h2]h3]h4]h5]h7]uh+hh%]qhCX1,2,4,5q߅q}q(h*Uh+hubah.hsubhCX would not be (due to missing q⅁q}q(h*X would not be (due to missing h+hubhk)q}q(h*X``3``h0}q(h2]h3]h4]h5]h7]uh+hh%]qhCX3q}q(h*Uh+hubah.hsubhCX).q녁q}q(h*X).h+hubeubhG)q}q(h*Xb**Match criterion**: Looked-up number(key) must be exactly equal to index from one of the entries.qh+hh,h-h.hJh0}q(h2]h3]h4]h5]h7]uh9K'h:hh%]q(h)q}q(h*X**Match criterion**h0}q(h2]h3]h4]h5]h7]uh+hh%]qhCXMatch criterionqq}q(h*Uh+hubah.hubhCXO: Looked-up number(key) must be exactly equal to index from one of the entries.qq}q(h*XO: Looked-up number(key) must be exactly equal to index from one of the entries.h+hubeubeubh')q}q(h*Uh+hh,h-h.h/h0}q(h2]h3]h4]h5]rhah7]rhauh9K*h:hh%]r(h<)r}r(h*X sparseArrayrh+hh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9K*h:hh%]rhCX sparseArrayrr }r (h*jh+jubaubhG)r }r (h*XThe value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information.r h+hh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9K,h:hh%]rhCXThe value to be looked up is an integer value, but there may be gaps inside the set of values (usually there are large gaps). A typical use case would be the matching of IPv4 address information.rr}r(h*j h+j ubaubhG)r}r(h*Xh**Match criterion**: A match happens on the first index that is less than or equal to the looked-up key.rh+hh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9K0h:hh%]r(h)r}r(h*X**Match criterion**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXMatch criterionrr}r(h*Uh+jubah.hubhCXU: A match happens on the first index that is less than or equal to the looked-up key.rr }r!(h*XU: A match happens on the first index that is less than or equal to the looked-up key.h+jubeubhG)r"}r#(h*XDNote that index integer numbers are represented by unsigned 32 bits.r$h+hh,h-h.hJh0}r%(h2]h3]h4]h5]h7]uh9K2h:hh%]r&hCXDNote that index integer numbers are represented by unsigned 32 bits.r'r(}r)(h*j$h+j"ubaubeubeubh')r*}r+(h*Uh+h(h,h-h.h/h0}r,(h2]h3]h4]h5]r-h"ah7]r.hauh9K6h:hh%]r/(h<)r0}r1(h*XLookup Table File Formatr2h+j*h,h-h.h@h0}r3(h2]h3]h4]h5]h7]uh9K6h:hh%]r4hCXLookup Table File Formatr5r6}r7(h*j2h+j0ubaubhG)r8}r9(h*XcLookup table files contain a single JSON object. This object contains of a header and a table part.r:h+j*h,h-h.hJh0}r;(h2]h3]h4]h5]h7]uh9K8h:hh%]r<hCXcLookup table files contain a single JSON object. This object contains of a header and a table part.r=r>}r?(h*j:h+j8ubaubhG)r@}rA(h*X **Header**rBh+j*h,h-h.hJh0}rC(h2]h3]h4]h5]h7]uh9K:h:hh%]rDh)rE}rF(h*jBh0}rG(h2]h3]h4]h5]h7]uh+j@h%]rHhCXHeaderrIrJ}rK(h*Uh+jEubah.hubaubhG)rL}rM(h*XTThe header is the top-level json. It has paramters "version", "nomatch", and "type".rNh+j*h,h-h.hJh0}rO(h2]h3]h4]h5]h7]uh9K : Version of table-definition format (so improvements in the future can be managed in a backward compatible way). **nomatch** : Value to be returned for a lookup when match fails. **type** <*string*, *array* or *sparseArray*, default: *string*> : Type of lookup-table (controls how matches are performed). h+jUh,h-h.Udefinition_list_itemr]h0}r^(h2]h3]h4]h5]h7]uh9KDh%]r_(cdocutils.nodes term r`)ra}rb(h*X Parameters:rch+j[h,h-h.Utermrdh0}re(h2]h3]h4]h5]h7]uh9KDh%]rfhCX Parameters:rgrh}ri(h*jch+jaubaubcdocutils.nodes definition rj)rk}rl(h*Uh0}rm(h2]h3]h4]h5]h7]uh+j[h%]rn(hG)ro}rp(h*X**version** : Version of table-definition format (so improvements in the future can be managed in a backward compatible way).h+jkh,h-h.hJh0}rq(h2]h3]h4]h5]h7]uh9K@h%]rr(h)rs}rt(h*X **version**h0}ru(h2]h3]h4]h5]h7]uh+joh%]rvhCXversionrwrx}ry(h*Uh+jsubah.hubhCX : Version of table-definition format (so improvements in the future can be managed in a backward compatible way).rzr{}r|(h*X : Version of table-definition format (so improvements in the future can be managed in a backward compatible way).h+joubeubhG)r}}r~(h*X`**nomatch** : Value to be returned for a lookup when match fails.h+jkh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9KBh%]r(h)r}r(h*X **nomatch**h0}r(h2]h3]h4]h5]h7]uh+j}h%]rhCXnomatchrr}r(h*Uh+jubah.hubhCXU : Value to be returned for a lookup when match fails.rr}r(h*XU : Value to be returned for a lookup when match fails.h+j}ubeubhG)r}r(h*X}**type** <*string*, *array* or *sparseArray*, default: *string*> : Type of lookup-table (controls how matches are performed).h+jkh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9KDh%]r(h)r}r(h*X**type**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXtyperr}r(h*Uh+jubah.hubhCX > : Type of lookup-table (controls how matches are performed).rr}r(h*X>> : Type of lookup-table (controls how matches are performed).h+jubeubeh.U definitionrubeubaubhG)r}r(h*X **Table**rh+j*h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9KFh:hh%]rh)r}r(h*jh0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXTablerr}r(h*Uh+jubah.hubaubhG)r}r(h*XThis must be an array of elements, even if only a single value exists (for obvious reasons, we do not expect this to occur often). Each array element must contain two fields "index" and "value".rh+j*h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9KHh:hh%]rhCXThis must be an array of elements, even if only a single value exists (for obvious reasons, we do not expect this to occur often). Each array element must contain two fields "index" and "value".rr}r(h*jh+jubaubhG)r}r(h*X>This is a sample of how an ip-to-office mapping may look like:rh+j*h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9KLh:hh%]rhCX>This is a sample of how an ip-to-office mapping may look like:rr}r(h*jh+jubaubcdocutils.nodes literal_block r)r}r(h*XQ{ "version" : 1, "nomatch" : "unk", "type" : "string", "table" : [ {"index" : "10.0.1.1", "value" : "A" }, {"index" : "10.0.1.2", "value" : "A" }, {"index" : "10.0.1.3", "value" : "A" }, {"index" : "10.0.2.1", "value" : "B" }, {"index" : "10.0.2.2", "value" : "B" }, {"index" : "10.0.2.3", "value" : "B" }]}h+j*h,h-h.U literal_blockrh0}r(U xml:spacerUpreserverh5]h4]h2]h3]h7]uh9KPh:hh%]rhCXQ{ "version" : 1, "nomatch" : "unk", "type" : "string", "table" : [ {"index" : "10.0.1.1", "value" : "A" }, {"index" : "10.0.1.2", "value" : "A" }, {"index" : "10.0.1.3", "value" : "A" }, {"index" : "10.0.2.1", "value" : "B" }, {"index" : "10.0.2.2", "value" : "B" }, {"index" : "10.0.2.3", "value" : "B" }]}rr}r(h*Uh+jubaubhG)r}r(h*XNote: In the example above, if a different IP comes in, the value "unk" is returend thanks to the nomatch parameter in the first line.rh+j*h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9K\h:hh%]rhCXNote: In the example above, if a different IP comes in, the value "unk" is returend thanks to the nomatch parameter in the first line.rr}r(h*jh+jubaubhG)r}r(h*XLookup tables can be access via the ``lookup()`` built-in function. Common usage pattern is to set a local variable to the lookup result and later use that variable in templates.h+j*h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9K^h:hh%]r(hCX$Lookup tables can be access via the rr}r(h*X$Lookup tables can be access via the h+jubhk)r}r(h*X ``lookup()``h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXlookup()rr}r(h*Uh+jubah.hsubhCX built-in function. Common usage pattern is to set a local variable to the lookup result and later use that variable in templates.rr}r(h*X built-in function. Common usage pattern is to set a local variable to the lookup result and later use that variable in templates.h+jubeubeubh')r}r(h*Uh+h(h,h-h.h/h0}r(h2]h3]h4]h5]rh$ah7]rhauh9Kdh:hh%]r(h<)r}r (h*XLookup-table configurationr h+jh,h-h.h@h0}r (h2]h3]h4]h5]h7]uh9Kdh:hh%]r hCXLookup-table configurationr r}r(h*j h+jubaubhG)r}r(h*XLookup-table configuration involves a **two part setup** (definition and usage(lookup)), with an optional third part, which allows reloading table using internal trigger.h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kfh:hh%]r(hCX&Lookup-table configuration involves a rr}r(h*X&Lookup-table configuration involves a h+jubh)r}r(h*X**two part setup**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXtwo part setuprr}r(h*Uh+jubah.hubhCXr (definition and usage(lookup)), with an optional third part, which allows reloading table using internal trigger.rr}r (h*Xr (definition and usage(lookup)), with an optional third part, which allows reloading table using internal trigger.h+jubeubh')r!}r"(h*Uh+jh,h-h.h/h0}r#(h2]h3]h4]h5]r$hah7]r%h auh9Kjh:hh%]r&(h<)r'}r((h*X?lookup_table(name="
" file=""...) (object)r)h+j!h,h-h.h@h0}r*(h2]h3]h4]h5]h7]uh9Kjh:hh%]r+hCX?lookup_table(name="
" file=""...) (object)r,r-}r.(h*j)h+j'ubaubhG)r/}r0(h*X~**Defines** the table(identified by the table-name) and allows user to set some properties that control behavior of the table.r1h+j!h,h-h.hJh0}r2(h2]h3]h4]h5]h7]uh9Klh:hh%]r3(h)r4}r5(h*X **Defines**h0}r6(h2]h3]h4]h5]h7]uh+j/h%]r7hCXDefinesr8r9}r:(h*Uh+j4ubah.hubhCXs the table(identified by the table-name) and allows user to set some properties that control behavior of the table.r;r<}r=(h*Xs the table(identified by the table-name) and allows user to set some properties that control behavior of the table.h+j/ubeubj)r>}r?(h*Xdyn_stats(name="msg_per_host")h+j!h,h-h.jh0}r@(jjh5]h4]h2]h3]h7]uh9Kph:hh%]rAhCXdyn_stats(name="msg_per_host")rBrC}rD(h*Uh+j>ubaubjT)rE}rF(h*Uh+j!h,h-h.jWh0}rG(h2]h3]h4]h5]h7]uh9Nh:hh%]rHjZ)rI}rJ(h*XParameters: **name** : Name of the table. **file** : Path to external json database file. **reloadOnHUP** : Whether or not table should be reloaded when process receives HUP signal. h+jEh,h-h.j]h0}rK(h2]h3]h4]h5]h7]uh9Kwh%]rL(j`)rM}rN(h*X Parameters:rOh+jIh,h-h.jdh0}rP(h2]h3]h4]h5]h7]uh9Kwh%]rQhCX Parameters:rRrS}rT(h*jOh+jMubaubjj)rU}rV(h*Uh0}rW(h2]h3]h4]h5]h7]uh+jIh%]rX(hG)rY}rZ(h*X:**name** : Name of the table.h+jUh,h-h.hJh0}r[(h2]h3]h4]h5]h7]uh9Ksh%]r\(h)r]}r^(h*X**name**h0}r_(h2]h3]h4]h5]h7]uh+jYh%]r`hCXnamerarb}rc(h*Uh+j]ubah.hubhCX2 : Name of the table.rdre}rf(h*X2 : Name of the table.h+jYubeubhG)rg}rh(h*XW**file** : Path to external json database file.h+jUh,h-h.hJh0}ri(h2]h3]h4]h5]h7]uh9Kuh%]rj(h)rk}rl(h*X**file**h0}rm(h2]h3]h4]h5]h7]uh+jgh%]rnhCXfilerorp}rq(h*Uh+jkubah.hubhCXO : Path to external json database file.rrrs}rt(h*XO : Path to external json database file.h+jgubeubhG)ru}rv(h*Xq**reloadOnHUP** : Whether or not table should be reloaded when process receives HUP signal.h+jUh,h-h.hJh0}rw(h2]h3]h4]h5]h7]uh9Kwh%]rx(h)ry}rz(h*X**reloadOnHUP**h0}r{(h2]h3]h4]h5]h7]uh+juh%]r|hCX reloadOnHUPr}r~}r(h*Uh+jyubah.hubhCXb : Whether or not table should be reloaded when process receives HUP signal.rr}r(h*Xb : Whether or not table should be reloaded when process receives HUP signal.h+juubeubeh.jubeubaubhG)r}r(h*X3A definition setting all the parameters looks like:rh+j!h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kyh:hh%]rhCX3A definition setting all the parameters looks like:rr}r(h*jh+jubaubj)r}r(h*X\lookup_table(name="host_bu" file="/var/lib/host_billing_unit_mapping.json" reloadOnHUP="on")h+j!h,h-h.jh0}r(jjh5]h4]h2]h3]h7]uh9K}h:hh%]rhCX\lookup_table(name="host_bu" file="/var/lib/host_billing_unit_mapping.json" reloadOnHUP="on")rr}r(h*Uh+jubaubeubh')r}r(h*Uh+jh,h-h.h/h0}r(h2]h3]h4]h5]rhah7]rh auh9Kh:hh%]r(h<)r}r(h*X$lookup("
", ) (function)rh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX$lookup("
", ) (function)rr}r(h*jh+jubaubhG)r}r(h*X'**Looks up** and returns the value that is associated with the given key (passed as ) in lookup table identified by table-name. If no match is found (according to table-type matching-criteria specified above), the "nomatch" string is returned (or an empty string if it is not defined).h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(h)r}r(h*X **Looks up**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXLooks uprr}r(h*Uh+jubah.hubhCX and returns the value that is associated with the given key (passed as ) in lookup table identified by table-name. If no match is found (according to table-type matching-criteria specified above), the "nomatch" string is returned (or an empty string if it is not defined).rr}r(h*X and returns the value that is associated with the given key (passed as ) in lookup table identified by table-name. If no match is found (according to table-type matching-criteria specified above), the "nomatch" string is returned (or an empty string if it is not defined).h+jubeubjT)r}r(h*Uh+jh,h-h.jWh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rjZ)r}r(h*XParameters: **name** : Name of the table. **expr** : Key to be looked up. h+jh,h-h.j]h0}r(h2]h3]h4]h5]h7]uh9Kh%]r(j`)r}r(h*X Parameters:rh+jh,h-h.jdh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX Parameters:rr}r(h*jh+jubaubjj)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(hG)r}r(h*X:**name** : Name of the table.h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]r(h)r}r(h*X**name**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXnamerr}r(h*Uh+jubah.hubhCX2 : Name of the table.rr}r(h*X2 : Name of the table.h+jubeubhG)r}r(h*Xt**expr** : Key to be looked up.h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]r(h)r}r(h*X**expr**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXexprrr}r(h*Uh+jubah.hubhCXl : Key to be looked up.rr}r(h*Xl : Key to be looked up.h+jubeubeh.jubeubaubhG)r}r(h*XA ``lookup`` call looks like:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(hCXA rr}r(h*XA h+jubhk)r}r(h*X ``lookup``h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXlookuprr}r(h*Uh+jubah.hsubhCX call looks like:rr}r(h*X call looks like:h+jubeubj)r}r(h*XRset $.bu = lookup("host_bu", $hostname); if ($.bu == "unknown") then { .... }h+jh,h-h.jh0}r(jjh5]h4]h2]h3]h7]uh9Kh:hh%]rhCXRset $.bu = lookup("host_bu", $hostname); if ($.bu == "unknown") then { .... }rr}r(h*Uh+jubaubhG)r}r(h*X3Some examples of different match/no-match senarios:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX3Some examples of different match/no-match senarios:rr}r(h*jh+jubaubhG)r}r(h*X**string table**:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(h)r}r(h*X**string table**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCX string tablerr }r (h*Uh+jubah.hubhCX:r }r (h*X:h+jubeubj)r }r(h*X{ "nomatch" : "none", "type" : "string", "table":[ {"index" : "foo", "value" : "bar" }, {"index" : "baz", "value" : "quux" }]}h+jh,h-h.jh0}r(jjh5]h4]h2]h3]h7]uh9Kh:hh%]rhCX{ "nomatch" : "none", "type" : "string", "table":[ {"index" : "foo", "value" : "bar" }, {"index" : "baz", "value" : "quux" }]}rr}r(h*Uh+j ubaubhG)r}r(h*XMatch/no-Match behaviour:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXMatch/no-Match behaviour:rr}r(h*jh+jubaubcdocutils.nodes table r)r}r(h*Uh+jh,h-h.Utablerh0}r (h2]h3]h4]h5]h7]uh9Nh:hh%]r!cdocutils.nodes tgroup r")r#}r$(h*Uh0}r%(h5]h4]h2]h3]h7]UcolsKuh+jh%]r&(cdocutils.nodes colspec r')r(}r)(h*Uh0}r*(h5]h4]h2]h3]h7]UcolwidthKuh+j#h%]h.Ucolspecr+ubj')r,}r-(h*Uh0}r.(h5]h4]h2]h3]h7]UcolwidthKuh+j#h%]h.j+ubcdocutils.nodes thead r/)r0}r1(h*Uh0}r2(h2]h3]h4]h5]h7]uh+j#h%]r3cdocutils.nodes row r4)r5}r6(h*Uh0}r7(h2]h3]h4]h5]h7]uh+j0h%]r8(cdocutils.nodes entry r9)r:}r;(h*Uh0}r<(h2]h3]h4]h5]h7]uh+j5h%]r=hG)r>}r?(h*Xkeyr@h+j:h,h-h.hJh0}rA(h2]h3]h4]h5]h7]uh9Kh%]rBhCXkeyrCrD}rE(h*j@h+j>ubaubah.UentryrFubj9)rG}rH(h*Uh0}rI(h2]h3]h4]h5]h7]uh+j5h%]rJhG)rK}rL(h*XreturnrMh+jGh,h-h.hJh0}rN(h2]h3]h4]h5]h7]uh9Kh%]rOhCXreturnrPrQ}rR(h*jMh+jKubaubah.jFubeh.UrowrSubah.UtheadrTubcdocutils.nodes tbody rU)rV}rW(h*Uh0}rX(h2]h3]h4]h5]h7]uh+j#h%]rY(j4)rZ}r[(h*Uh0}r\(h2]h3]h4]h5]h7]uh+jVh%]r](j9)r^}r_(h*Uh0}r`(h2]h3]h4]h5]h7]uh+jZh%]rahG)rb}rc(h*Xfoordh+j^h,h-h.hJh0}re(h2]h3]h4]h5]h7]uh9Kh%]rfhCXfoorgrh}ri(h*jdh+jbubaubah.jFubj9)rj}rk(h*Uh0}rl(h2]h3]h4]h5]h7]uh+jZh%]rmhG)rn}ro(h*Xbarrph+jjh,h-h.hJh0}rq(h2]h3]h4]h5]h7]uh9Kh%]rrhCXbarrsrt}ru(h*jph+jnubaubah.jFubeh.jSubj4)rv}rw(h*Uh0}rx(h2]h3]h4]h5]h7]uh+jVh%]ry(j9)rz}r{(h*Uh0}r|(h2]h3]h4]h5]h7]uh+jvh%]r}hG)r~}r(h*Xbazrh+jzh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXbazrr}r(h*jh+j~ubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jvh%]rhG)r}r(h*Xquuxrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXquuxrr}r(h*jh+jubaubah.jFubeh.jSubj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jVh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xcorgerh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXcorgerr}r(h*jh+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xnonerh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXnonerr}r(h*jh+jubaubah.jFubeh.jSubeh.Utbodyrubeh.UtgrouprubaubhG)r}r(h*X**array table**:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(h)r}r(h*X**array table**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCX array tablerr}r(h*Uh+jubah.hubhCX:r}r(h*X:h+jubeubj)r}r(h*X{ "nomatch" : "nothing", "type" : "array", "table":[ {"index" : 9, "value" : "foo" }, {"index" : 10, "value" : "bar" }, {"index" : 11, "value" : "baz" }]}h+jh,h-h.jh0}r(jjh5]h4]h2]h3]h7]uh9Kh:hh%]rhCX{ "nomatch" : "nothing", "type" : "array", "table":[ {"index" : 9, "value" : "foo" }, {"index" : 10, "value" : "bar" }, {"index" : 11, "value" : "baz" }]}rr}r(h*Uh+jubaubhG)r}r(h*XMatch/no-Match behaviour:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXMatch/no-Match behaviour:rr}r(h*jh+jubaubj)r}r(h*Uh+jh,h-h.jh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rj")r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolsKuh+jh%]r(j')r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolwidthKuh+jh%]h.j+ubj')r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolwidthKuh+jh%]h.j+ubj/)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xkeyrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXkeyrr}r(h*jh+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xreturnrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXreturnrr}r(h*jh+jubaubah.jFubeh.jSubah.jTubjU)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X9h+jh,h-h.hJh0}r (h2]h3]h4]h5]h7]uh9Kh%]r hCX9r }r (h*X9h+jubaubah.jFubj9)r }r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xfoorh+j h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXfoorr}r(h*jh+jubaubah.jFubeh.jSubj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r hG)r!}r"(h*X11r#h+jh,h-h.hJh0}r$(h2]h3]h4]h5]h7]uh9Kh%]r%hCX11r&r'}r((h*j#h+j!ubaubah.jFubj9)r)}r*(h*Uh0}r+(h2]h3]h4]h5]h7]uh+jh%]r,hG)r-}r.(h*Xbazr/h+j)h,h-h.hJh0}r0(h2]h3]h4]h5]h7]uh9Kh%]r1hCXbazr2r3}r4(h*j/h+j-ubaubah.jFubeh.jSubj4)r5}r6(h*Uh0}r7(h2]h3]h4]h5]h7]uh+jh%]r8(j9)r9}r:(h*Uh0}r;(h2]h3]h4]h5]h7]uh+j5h%]r<hG)r=}r>(h*X15r?h+j9h,h-h.hJh0}r@(h2]h3]h4]h5]h7]uh9Kh%]rAhCX15rBrC}rD(h*j?h+j=ubaubah.jFubj9)rE}rF(h*Uh0}rG(h2]h3]h4]h5]h7]uh+j5h%]rHhG)rI}rJ(h*XnothingrKh+jEh,h-h.hJh0}rL(h2]h3]h4]h5]h7]uh9Kh%]rMhCXnothingrNrO}rP(h*jKh+jIubaubah.jFubeh.jSubj4)rQ}rR(h*Uh0}rS(h2]h3]h4]h5]h7]uh+jh%]rT(j9)rU}rV(h*Uh0}rW(h2]h3]h4]h5]h7]uh+jQh%]rXhG)rY}rZ(h*X0h+jUh,h-h.hJh0}r[(h2]h3]h4]h5]h7]uh9Kh%]r\hCX0r]}r^(h*X0h+jYubaubah.jFubj9)r_}r`(h*Uh0}ra(h2]h3]h4]h5]h7]uh+jQh%]rbhG)rc}rd(h*Xnothingreh+j_h,h-h.hJh0}rf(h2]h3]h4]h5]h7]uh9Kh%]rghCXnothingrhri}rj(h*jeh+jcubaubah.jFubeh.jSubeh.jubeh.jubaubhG)rk}rl(h*X**sparseArray table**:rmh+jh,h-h.hJh0}rn(h2]h3]h4]h5]h7]uh9Kh:hh%]ro(h)rp}rq(h*X**sparseArray table**h0}rr(h2]h3]h4]h5]h7]uh+jkh%]rshCXsparseArray tablertru}rv(h*Uh+jpubah.hubhCX:rw}rx(h*X:h+jkubeubj)ry}rz(h*X{ "nomatch" : "no_num", "type" : "sparseArray", "table":[ {"index" : "9", "value" : "foo" }, {"index" : "11", "value" : "baz" }]}h+jh,h-h.jh0}r{(jjh5]h4]h2]h3]h7]uh9Kh:hh%]r|hCX{ "nomatch" : "no_num", "type" : "sparseArray", "table":[ {"index" : "9", "value" : "foo" }, {"index" : "11", "value" : "baz" }]}r}r~}r(h*Uh+jyubaubhG)r}r(h*XMatch/no-Match behaviour:rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXMatch/no-Match behaviour:rr}r(h*jh+jubaubj)r}r(h*Uh+jh,h-h.jh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rj")r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolsKuh+jh%]r(j')r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolwidthKuh+jh%]h.j+ubj')r}r(h*Uh0}r(h5]h4]h2]h3]h7]UcolwidthKuh+jh%]h.j+ubj/)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xkeyrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXkeyrr}r(h*jh+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xreturnrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXreturnrr}r(h*jh+jubaubah.jFubeh.jSubah.jTubjU)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X8h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX8r}r(h*X8h+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xno_numrh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXno_numrr}r(h*jh+jubaubah.jFubeh.jSubj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X9h+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX9r}r(h*X9h+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xfoorh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXfoorr}r(h*jh+jubaubah.jFubeh.jSubj4)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*X10rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX10rr}r(h*jh+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]rhG)r}r(h*Xfoorh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCXfoorr}r (h*jh+jubaubah.jFubeh.jSubj4)r }r (h*Uh0}r (h2]h3]h4]h5]h7]uh+jh%]r (j9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+j h%]rhG)r}r(h*X11rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX11rr}r(h*jh+jubaubah.jFubj9)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+j h%]rhG)r}r(h*Xbazr h+jh,h-h.hJh0}r!(h2]h3]h4]h5]h7]uh9Kh%]r"hCXbazr#r$}r%(h*j h+jubaubah.jFubeh.jSubj4)r&}r'(h*Uh0}r((h2]h3]h4]h5]h7]uh+jh%]r)(j9)r*}r+(h*Uh0}r,(h2]h3]h4]h5]h7]uh+j&h%]r-hG)r.}r/(h*X12r0h+j*h,h-h.hJh0}r1(h2]h3]h4]h5]h7]uh9Kh%]r2hCX12r3r4}r5(h*j0h+j.ubaubah.jFubj9)r6}r7(h*Uh0}r8(h2]h3]h4]h5]h7]uh+j&h%]r9hG)r:}r;(h*Xbazr<h+j6h,h-h.hJh0}r=(h2]h3]h4]h5]h7]uh9Kh%]r>hCXbazr?r@}rA(h*j<h+j:ubaubah.jFubeh.jSubj4)rB}rC(h*Uh0}rD(h2]h3]h4]h5]h7]uh+jh%]rE(j9)rF}rG(h*Uh0}rH(h2]h3]h4]h5]h7]uh+jBh%]rIhG)rJ}rK(h*X100rLh+jFh,h-h.hJh0}rM(h2]h3]h4]h5]h7]uh9Kh%]rNhCX100rOrP}rQ(h*jLh+jJubaubah.jFubj9)rR}rS(h*Uh0}rT(h2]h3]h4]h5]h7]uh+jBh%]rUhG)rV}rW(h*XbazrXh+jRh,h-h.hJh0}rY(h2]h3]h4]h5]h7]uh9Kh%]rZhCXbazr[r\}r](h*jXh+jVubaubah.jFubeh.jSubeh.jubeh.jubaubeubh')r^}r_(h*Uh+jh,h-h.h/h0}r`(h2]h3]h4]h5]rahah7]rbhauh9Kh:hh%]rc(h<)rd}re(h*X:reload_lookup_table("
", "") (statement)rfh+j^h,h-h.h@h0}rg(h2]h3]h4]h5]h7]uh9Kh:hh%]rhhCX:reload_lookup_table("
", "") (statement)rirj}rk(h*jfh+jdubaubhG)rl}rm(h*Xt**Reloads** lookup table identified by given table name **asynchronously** (by internal trigger, as opposed to HUP).rnh+j^h,h-h.hJh0}ro(h2]h3]h4]h5]h7]uh9Kh:hh%]rp(h)rq}rr(h*X **Reloads**h0}rs(h2]h3]h4]h5]h7]uh+jlh%]rthCXReloadsrurv}rw(h*Uh+jqubah.hubhCX- lookup table identified by given table name rxry}rz(h*X- lookup table identified by given table name h+jlubh)r{}r|(h*X**asynchronously**h0}r}(h2]h3]h4]h5]h7]uh+jlh%]r~hCXasynchronouslyrr}r(h*Uh+j{ubah.hubhCX* (by internal trigger, as opposed to HUP).rr}r(h*X* (by internal trigger, as opposed to HUP).h+jlubeubhG)r}r(h*XThis statement isn't always useful. It needs to be used only when lookup-table-reload needs to be triggered in response to a message.rh+j^h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXThis statement isn't always useful. It needs to be used only when lookup-table-reload needs to be triggered in response to a message.rr}r(h*jh+jubaubhG)r}r(h*XNMessages will continue to be processed while table is asynchronously reloaded.rh+j^h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXNMessages will continue to be processed while table is asynchronously reloaded.rr}r(h*jh+jubaubhG)r}r(h*XjNote: For performance reasons, message that triggers reload should be accepted only from a trusted source.rh+j^h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXjNote: For performance reasons, message that triggers reload should be accepted only from a trusted source.rr}r(h*jh+jubaubjT)r}r(h*Uh+j^h,h-h.jWh0}r(h2]h3]h4]h5]h7]uh9Nh:hh%]rjZ)r}r(h*XParameters: **name** : Name of the table. **stub value** : Value to stub the table in-case reload-attempt fails. h+jh,h-h.j]h0}r(h2]h3]h4]h5]h7]uh9Kh%]r(j`)r}r(h*X Parameters:rh+jh,h-h.jdh0}r(h2]h3]h4]h5]h7]uh9Kh%]rhCX Parameters:rr}r(h*jh+jubaubjj)r}r(h*Uh0}r(h2]h3]h4]h5]h7]uh+jh%]r(hG)r}r(h*X:**name** : Name of the table.rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]r(h)r}r(h*X**name**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXnamerr}r(h*Uh+jubah.hubhCX2 : Name of the table.rr}r(h*X2 : Name of the table.h+jubeubhG)r}r(h*Xb**stub value** : Value to stub the table in-case reload-attempt fails.rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh%]r(h)r}r(h*X**stub value**h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCX stub valuerr}r(h*Uh+jubah.hubhCXT : Value to stub the table in-case reload-attempt fails.rr}r(h*XT : Value to stub the table in-case reload-attempt fails.h+jubeubeh.jubeubaubhG)r}r(h*X0A ``reload_lookup_table`` invocation looks like:rh+j^h,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]r(hCXA rr}r(h*XA h+jubhk)r}r(h*X``reload_lookup_table``h0}r(h2]h3]h4]h5]h7]uh+jh%]rhCXreload_lookup_tablerr}r(h*Uh+jubah.hsubhCX invocation looks like:rr}r(h*X invocation looks like:h+jubeubj)r}r(h*XNif ($.do_reload == "y") then { reload_lookup_table("host_bu", "unknown") }h+j^h,h-h.jh0}r(jjh5]h4]h2]h3]h7]uh9Kh:hh%]rhCXNif ($.do_reload == "y") then { reload_lookup_table("host_bu", "unknown") }rr}r(h*Uh+jubaubeubeubh')r}r(h*Uh+h(h,h-h.h/h0}r(h2]h3]h4]h5]rhah7]rh auh9Kh:hh%]r(h<)r}r(h*XImplementation Detailsrh+jh,h-h.h@h0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXImplementation Detailsrr}r(h*jh+jubaubhG)r}r(h*XGThe lookup table functionality is implemented via efficient algorithms.rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCXGThe lookup table functionality is implemented via efficient algorithms.rr}r(h*jh+jubaubhG)r}r(h*X]The string and sparseArray lookup have O(log(n)) time complexity, while array lookup is O(1).rh+jh,h-h.hJh0}r(h2]h3]h4]h5]h7]uh9Kh:hh%]rhCX]The string and sparseArray lookup have O(log(n)) time complexity, while array lookup is O(1).rr}r(h*jh+jubaubhG)r}r(h*XTo preserve space and, more important, increase cache hit performance, equal data values are only stored once, no matter how often a lookup index points to them.rh+jh,h-h.hJh0}r (h2]h3]h4]h5]h7]uh9Kh:hh%]r hCXTo preserve space and, more important, increase cache hit performance, equal data values are only stored once, no matter how often a lookup index points to them.r r }r (h*jh+jubaubeubeubah*UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh:hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr ]r!U citation_refsr"}r#Uindirect_targetsr$]r%Usettingsr&(cdocutils.frontend Values r'or(}r)(Ufootnote_backlinksr*KUrecord_dependenciesr+NU rfc_base_urlr,Uhttps://tools.ietf.org/html/r-U tracebackr.Upep_referencesr/NUstrip_commentsr0NU toc_backlinksr1jFU language_coder2Uenr3U datestampr4NU report_levelr5KU _destinationr6NU halt_levelr7KU strip_classesr8Nh@NUerror_encoding_error_handlerr9Ubackslashreplacer:Udebugr;NUembed_stylesheetr<Uoutput_encoding_error_handlerr=Ustrictr>U sectnum_xformr?KUdump_transformsr@NU docinfo_xformrAKUwarning_streamrBNUpep_file_url_templaterCUpep-%04drDUexit_status_levelrEKUconfigrFNUstrict_visitorrGNUcloak_email_addressesrHUtrim_footnote_reference_spacerIUenvrJNUdump_pseudo_xmlrKNUexpose_internalsrLNUsectsubtitle_xformrMU source_linkrNNUrfc_referencesrONUoutput_encodingrPUutf-8rQU source_urlrRNUinput_encodingrSU utf-8-sigrTU_disable_configrUNU id_prefixrVUU tab_widthrWKUerror_encodingrXUUTF-8rYU_sourcerZh-Ugettext_compactr[U generatorr\NUdump_internalsr]NU smart_quotesr^U pep_base_urlr_U https://www.python.org/dev/peps/r`Usyntax_highlightraUlongrbUinput_encoding_error_handlerrcj>Uauto_id_prefixrdUidreUdoctitle_xformrfUstrip_elements_with_classesrgNU _config_filesrh]Ufile_insertion_enabledriU raw_enabledrjKU dump_settingsrkNubUsymbol_footnote_startrlKUidsrm}rn(h"j*hhhjhj!hjh h(hj^hhh!hh$jh#huUsubstitution_namesro}rph.h:h0}rq(h2]h5]h4]Usourceh-h3]h7]uU footnotesrr]rsUrefidsrt}ruub.build/.doctrees/configuration/modules/0000775000175000017500000000000013035122643017043 5ustar rgerrgerbuild/.doctrees/configuration/modules/idx_output.doctree0000664000175000017500000001163413035122641022621 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXoutput modulesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUoutput-modulesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXG/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_output.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXOutput Modulesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XOutput Modulesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXOutput modules process messages. With them, message formats can be transformed and messages be transmitted to various different targets. They are generally defined via :doc:`action <../actions>` configuration objects.hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(h/XOutput modules process messages. With them, message formats can be transformed and messages be transmitted to various different targets. They are generally defined via q9q:}q;(hXOutput modules process messages. With them, message formats can be transformed and messages be transmitted to various different targets. They are generally defined via hh4ubcsphinx.addnodes pending_xref q<)q=}q>(hX:doc:`action <../actions>`q?hh4hhhU pending_xrefq@h}qA(UreftypeXdocqBUrefwarnqCU reftargetqDX ../actionsU refdomainUh!]h ]U refexplicith]h]h#]UrefdocqEX configuration/modules/idx_outputqFuh%Kh]qGcdocutils.nodes literal qH)qI}qJ(hh?h}qK(h]h]qL(UxrefqMhBeh ]h!]h#]uhh=h]qNh/XactionqOqP}qQ(hUhhIubahUliteralqRubaubh/X configuration objects.qSqT}qU(hX configuration objects.hh4ubeubcdocutils.nodes compound qV)qW}qX(hUhhhhhUcompoundqYh}qZ(h]h]q[Utoctree-wrapperq\ah ]h!]h#]uh%Nh&hh]q]csphinx.addnodes toctree q^)q_}q`(hUhhWhhhUtoctreeqah}qb(UnumberedqcKU includehiddenqdhhFUcaptionqeNUglobqfh!]h ]U titlesonlyqgh]h]h#]Uentriesqh]qi(NXconfiguration/modules/omamqp1qjqkNX%configuration/modules/omelasticsearchqlqmNXconfiguration/modules/omfileqnqoNXconfiguration/modules/omfwdqpqqNXconfiguration/modules/omhdfsqrqsNXconfiguration/modules/omhiredisqtquNXconfiguration/modules/omhttpfsqvqwNXconfiguration/modules/omjournalqxqyNXconfiguration/modules/omkafkaqzq{NXconfiguration/modules/omlibdbiq|q}NXconfiguration/modules/ommailq~qNXconfiguration/modules/ommongodbqqNXconfiguration/modules/ommysqlqqNXconfiguration/modules/omoracleqqNXconfiguration/modules/ompgsqlqqNXconfiguration/modules/ompipeqqNXconfiguration/modules/omprogqqNXconfiguration/modules/omrelpqqNXconfiguration/modules/omrulesetqqNXconfiguration/modules/omsnmpqqNXconfiguration/modules/omstdoutqqNX configuration/modules/omudpspoofqqNXconfiguration/modules/omuxsockqqNX configuration/modules/sigprov_gtqqNX!configuration/modules/sigprov_ksiqqeUhiddenqU includefilesq]q(hjhlhnhphrhthvhxhzh|h~hhhhhhhhhhhhhheUmaxdepthqKuh%K h]ubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqωUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqۈUtrim_footnote_reference_spaceq܉UenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]qUfile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startrKUidsr}rhhsUsubstitution_namesr}rhh&h}r(h]h!]h ]Usourcehh]h#]uU footnotesr]rUrefidsr}r ub.build/.doctrees/configuration/modules/idx_messagemod.doctree0000664000175000017500000001014313035122641023377 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXmessage modification modulesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUmessage-modification-modulesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXK/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_messagemod.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXMessage Modification Modulesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/XMessage Modification Modulesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX6Message modification modules are used to change the content of messages being processed. They can be implemented using either the output module or the parser module interface. From the rsyslog core's point of view, they actually are output or parser modules, it is their implementation that makes them special.q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9h/X6Message modification modules are used to change the content of messages being processed. They can be implemented using either the output module or the parser module interface. From the rsyslog core's point of view, they actually are output or parser modules, it is their implementation that makes them special.q:q;}q<(hh6hh4ubaubcdocutils.nodes compound q=)q>}q?(hUhhhhhUcompoundq@h}qA(h]h]qBUtoctree-wrapperqCah ]h!]h#]uh%Nh&hh]qDcsphinx.addnodes toctree qE)qF}qG(hUhh>hhhUtoctreeqHh}qI(UnumberedqJKU includehiddenqKhX$configuration/modules/idx_messagemodqLUcaptionqMNUglobqNh!]h ]U titlesonlyqOh]h]h#]UentriesqP]qQ(NXconfiguration/modules/mmanonqRqSNXconfiguration/modules/mmcountqTqUNX configuration/modules/mmdblookupqVqWNX configuration/modules/mmexternalqXqYNXconfiguration/modules/mmfieldsqZq[NX!configuration/modules/mmjsonparseq\q]NX!configuration/modules/mmnormalizeq^q_NX"configuration/modules/mmpstrucdataq`qaNX&configuration/modules/mmrfc5424addhmacqbqcNX"configuration/modules/mmrm1stspaceqdqeNX configuration/modules/mmsequenceqfqgNX!configuration/modules/mmsnmptrapdqhqiNXconfiguration/modules/mmutf8fixqjqkeUhiddenqlU includefilesqm]qn(hRhThVhXhZh\h^h`hbhdhfhhhjeUmaxdepthqoJuh%K h]ubaubeubahUU transformerqpNU footnote_refsqq}qrUrefnamesqs}qtUsymbol_footnotesqu]qvUautofootnote_refsqw]qxUsymbol_footnote_refsqy]qzU citationsq{]q|h&hU current_lineq}NUtransform_messagesq~]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqUtrim_footnote_reference_spaceqUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqU generatorqNUdump_internalsqNU smart_quotesqU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqɉUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledq̈U raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/configuration/modules/imjournal.doctree0000664000175000017500000007671513035122642022431 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xrsyslog journal integrationqXimuxsockqX'imjournal: systemd journal input moduleqNuUsubstitution_defsq }q Uparse_messagesq ]q Ucurrent_sourceq NU decorationqNUautofootnote_startqKUnameidsq}q(hUrsyslog-journal-integrationqhUimuxsockqhU&imjournal-systemd-journal-input-modulequUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXF/home/rger/proj/rsyslog-doc/source/configuration/modules/imjournal.rstqUtagnameqUsectionqU attributesq }q!(Udupnamesq"]Uclassesq#]Ubackrefsq$]Uidsq%]q&haUnamesq']q(hauUlineq)KUdocumentq*hh]q+(cdocutils.nodes title q,)q-}q.(hX'imjournal: Systemd Journal Input Moduleq/hhhhhUtitleq0h }q1(h"]h#]h$]h%]h']uh)Kh*hh]q2cdocutils.nodes Text q3X'imjournal: Systemd Journal Input Moduleq4q5}q6(hh/hh-ubaubcdocutils.nodes paragraph q7)q8}q9(hX**Module Name:** imjournalq:hhhhhU paragraphq;h }q<(h"]h#]h$]h%]h']uh)Kh*hh]q=(cdocutils.nodes strong q>)q?}q@(hX**Module Name:**h }qA(h"]h#]h$]h%]h']uhh8h]qBh3X Module Name:qCqD}qE(hUhh?ubahUstrongqFubh3X imjournalqGqH}qI(hX imjournalhh8ubeubh7)qJ}qK(hXX**Author:** Milan Bartos (This module is **not** project-supported)hhhhhh;h }qL(h"]h#]h$]h%]h']uh)Kh*hh]qM(h>)qN}qO(hX **Author:**h }qP(h"]h#]h$]h%]h']uhhJh]qQh3XAuthor:qRqS}qT(hUhhNubahhFubh3X Milan Bartos (This module is qaqb}qc(hX> (This module is hhJubh>)qd}qe(hX**not**h }qf(h"]h#]h$]h%]h']uhhJh]qgh3Xnotqhqi}qj(hUhhdubahhFubh3X project-supported)qkql}qm(hX project-supported)hhJubeubh7)qn}qo(hX**Available since**: 7.3.11qphhhhhh;h }qq(h"]h#]h$]h%]h']uh)K h*hh]qr(h>)qs}qt(hX**Available since**h }qu(h"]h#]h$]h%]h']uhhnh]qvh3XAvailable sinceqwqx}qy(hUhhsubahhFubh3X: 7.3.11qzq{}q|(hX: 7.3.11hhnubeubh7)q}}q~(hX**Description**:qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K h*hh]q(h>)q}q(hX**Description**h }q(h"]h#]h$]h%]h']uhh}h]qh3X Descriptionqq}q(hUhhubahhFubh3X:q}q(hX:hh}ubeubh7)q}q(hXVProvides the ability to import structured log messages from systemd journal to syslog.qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K h*hh]qh3XVProvides the ability to import structured log messages from systemd journal to syslog.qq}q(hhhhubaubh7)q}q(hX Note that this module reads the journal database, what is considered a relativly performance-intense operation. As such, the performance of a configuration utilizing this module may be notably slower than when using `imuxsock `_. The journal provides imuxsock with a copy of all "classical" syslog messages, however, it does not provide structured data. Only if that structured data is needed, imjournal must be used. Otherwise, imjournal may simply be replaced by imuxsock, and we highly suggest doing so.hhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh*hh]q(h3XNote that this module reads the journal database, what is considered a relativly performance-intense operation. As such, the performance of a configuration utilizing this module may be notably slower than when using qq}q(hXNote that this module reads the journal database, what is considered a relativly performance-intense operation. As such, the performance of a configuration utilizing this module may be notably slower than when using hhubhX)q}q(hX`imuxsock `_h }q(UnamehUrefuriqX imuxsock.htmlqh%]h$]h"]h#]h']uhhh]qh3Ximuxsockqq}q(hUhhubahh`ubcdocutils.nodes target q)q}q(hX U referencedqKhhhUtargetqh }q(Urefurihh%]qhah$]h"]h#]h']qhauh]ubh3X. The journal provides imuxsock with a copy of all "classical" syslog messages, however, it does not provide structured data. Only if that structured data is needed, imjournal must be used. Otherwise, imjournal may simply be replaced by imuxsock, and we highly suggest doing so.qq}q(hX. The journal provides imuxsock with a copy of all "classical" syslog messages, however, it does not provide structured data. Only if that structured data is needed, imjournal must be used. Otherwise, imjournal may simply be replaced by imuxsock, and we highly suggest doing so.hhubeubh7)q}q(hXWe suggest to check out our short presentation on `rsyslog journal integration `_ to learn more details of anticipated use cases.hhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh*hh]q(h3X2We suggest to check out our short presentation on qq}q(hX2We suggest to check out our short presentation on hhubhX)q}q(hX<`rsyslog journal integration `_h }q(UnameXrsyslog journal integrationhXhttp://youtu.be/GTS7EuSdFKEqh%]h$]h"]h#]h']uhhh]qh3Xrsyslog journal integrationqq}q(hUhhubahh`ubh)q}q(hX hKhhhhh }q(Urefurihh%]qhah$]h"]h#]h']qhauh]ubh3X0 to learn more details of anticipated use cases.q…q}q(hX0 to learn more details of anticipated use cases.hhubeubh7)q}q(hX**Warning:** Some versions of systemd journal have problems with database corruption, which leads to the journal to return the same data endlessly in a tight loop. This results in massive message duplication inside rsyslog probably resulting in a denial-of-service when the system ressouces get exhausted. This can be somewhat mitigated by using proper rate-limiters, but even then there are spikes of old data which are endlessly repeated. By default, ratelimiting is activated and permits to process 20,000 messages within 10 minutes, what should be well enough for most use cases. If insufficient, use the parameters described below to adjust the permitted volume. **It is strongly recommended to use this plugin only if there is hard need to do so.**hhhhhh;h }q(h"]h#]h$]h%]h']uh)Kh*hh]q(h>)q}q(hX **Warning:**h }q(h"]h#]h$]h%]h']uhhh]qh3XWarning:qͅq}q(hUhhubahhFubh3X Some versions of systemd journal have problems with database corruption, which leads to the journal to return the same data endlessly in a tight loop. This results in massive message duplication inside rsyslog probably resulting in a denial-of-service when the system ressouces get exhausted. This can be somewhat mitigated by using proper rate-limiters, but even then there are spikes of old data which are endlessly repeated. By default, ratelimiting is activated and permits to process 20,000 messages within 10 minutes, what should be well enough for most use cases. If insufficient, use the parameters described below to adjust the permitted volume. qЅq}q(hX Some versions of systemd journal have problems with database corruption, which leads to the journal to return the same data endlessly in a tight loop. This results in massive message duplication inside rsyslog probably resulting in a denial-of-service when the system ressouces get exhausted. This can be somewhat mitigated by using proper rate-limiters, but even then there are spikes of old data which are endlessly repeated. By default, ratelimiting is activated and permits to process 20,000 messages within 10 minutes, what should be well enough for most use cases. If insufficient, use the parameters described below to adjust the permitted volume. hhubh>)q}q(hXV**It is strongly recommended to use this plugin only if there is hard need to do so.**h }q(h"]h#]h$]h%]h']uhhh]qh3XRIt is strongly recommended to use this plugin only if there is hard need to do so.qׅq}q(hUhhubahhFubeubh7)q}q(hX**Configuration Directives**:qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K)h*hh]q(h>)q}q(hX**Configuration Directives**h }q(h"]h#]h$]h%]h']uhhh]qh3XConfiguration Directivesqㅁq}q(hUhhubahhFubh3X:q}q(hX:hhubeubh7)q}q(hX**Module Directives**qhhhhhh;h }q(h"]h#]h$]h%]h']uh)K+h*hh]qh>)q}q(hhh }q(h"]h#]h$]h%]h']uhhh]qh3XModule Directivesqq}q(hUhhubahhFubaubcdocutils.nodes bullet_list q)q}q(hUhhhhhU bullet_listqh }q(UbulletqX-h%]h$]h"]h#]h']uh)K-h*hh]q(cdocutils.nodes list_item q)q}q(hX**PersistStateInterval** number-of-messages This is a global setting. It specifies how often should the journal state be persisted. The persists happens after each *number-of-messages*. This option is useful for rsyslog to start reding from the last journal message it read. hhhhhU list_itemqh }q(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX+**PersistStateInterval** number-of-messageshhhhhh;h }r(h"]h#]h$]h%]h']uh)K-h]r(h>)r}r(hX**PersistStateInterval**h }r(h"]h#]h$]h%]h']uhjh]rh3XPersistStateIntervalr r }r (hUhjubahhFubh3X number-of-messagesr r }r(hX number-of-messageshjubeubh7)r}r(hXThis is a global setting. It specifies how often should the journal state be persisted. The persists happens after each *number-of-messages*. This option is useful for rsyslog to start reding from the last journal message it read.hhhhhh;h }r(h"]h#]h$]h%]h']uh)K/h]r(h3XxThis is a global setting. It specifies how often should the journal state be persisted. The persists happens after each rr}r(hXxThis is a global setting. It specifies how often should the journal state be persisted. The persists happens after each hjubcdocutils.nodes emphasis r)r}r(hX*number-of-messages*h }r(h"]h#]h$]h%]h']uhjh]rh3Xnumber-of-messagesrr}r(hUhjubahUemphasisrubh3XZ. This option is useful for rsyslog to start reding from the last journal message it read.rr }r!(hXZ. This option is useful for rsyslog to start reding from the last journal message it read.hjubeubeubh)r"}r#(hX**StateFile** /path/to/file This is a global setting. It specifies where the state file for persisting journal state is located. hhhhhhh }r$(h"]h#]h$]h%]h']uh)Nh*hh]r%(h7)r&}r'(hX**StateFile** /path/to/filehj"hhhh;h }r((h"]h#]h$]h%]h']uh)K4h]r)(h>)r*}r+(hX **StateFile**h }r,(h"]h#]h$]h%]h']uhj&h]r-h3X StateFiler.r/}r0(hUhj*ubahhFubh3X /path/to/filer1r2}r3(hX /path/to/filehj&ubeubh7)r4}r5(hXdThis is a global setting. It specifies where the state file for persisting journal state is located.r6hj"hhhh;h }r7(h"]h#]h$]h%]h']uh)K6h]r8h3XdThis is a global setting. It specifies where the state file for persisting journal state is located.r9r:}r;(hj6hj4ubaubeubh)r<}r=(hX**ratelimit.interval** seconds (default: 600) Specifies the interval in seconds onto which rate-limiting is to be applied. If more than ratelimit.burst messages are read during that interval, further messages up to the end of the interval are discarded. The number of messages discarded is emitted at the end of the interval (if there were any discards). Setting this to value zero turns off ratelimiting. Note that it is **not recommended to turn of ratelimiting**, except that you know for sure journal database entries will never be corrupted. Without ratelimiting, a corrupted systemd journal database may cause a kind of denial of service (we are stressing this point as multiple users have reported us such problems with the journal database - information current as of June 2013). hhhhhhh }r>(h"]h#]h$]h%]h']uh)Nh*hh]r?(h7)r@}rA(hX-**ratelimit.interval** seconds (default: 600)hj<hhhh;h }rB(h"]h#]h$]h%]h']uh)K9h]rC(h>)rD}rE(hX**ratelimit.interval**h }rF(h"]h#]h$]h%]h']uhj@h]rGh3Xratelimit.intervalrHrI}rJ(hUhjDubahhFubh3X seconds (default: 600)rKrL}rM(hX seconds (default: 600)hj@ubeubh7)rN}rO(hXSpecifies the interval in seconds onto which rate-limiting is to be applied. If more than ratelimit.burst messages are read during that interval, further messages up to the end of the interval are discarded. The number of messages discarded is emitted at the end of the interval (if there were any discards). Setting this to value zero turns off ratelimiting. Note that it is **not recommended to turn of ratelimiting**, except that you know for sure journal database entries will never be corrupted. Without ratelimiting, a corrupted systemd journal database may cause a kind of denial of service (we are stressing this point as multiple users have reported us such problems with the journal database - information current as of June 2013).hj<hhhh;h }rP(h"]h#]h$]h%]h']uh)K;h]rQ(h3XxSpecifies the interval in seconds onto which rate-limiting is to be applied. If more than ratelimit.burst messages are read during that interval, further messages up to the end of the interval are discarded. The number of messages discarded is emitted at the end of the interval (if there were any discards). Setting this to value zero turns off ratelimiting. Note that it is rRrS}rT(hXxSpecifies the interval in seconds onto which rate-limiting is to be applied. If more than ratelimit.burst messages are read during that interval, further messages up to the end of the interval are discarded. The number of messages discarded is emitted at the end of the interval (if there were any discards). Setting this to value zero turns off ratelimiting. Note that it is hjNubh>)rU}rV(hX+**not recommended to turn of ratelimiting**h }rW(h"]h#]h$]h%]h']uhjNh]rXh3X'not recommended to turn of ratelimitingrYrZ}r[(hUhjUubahhFubh3XB, except that you know for sure journal database entries will never be corrupted. Without ratelimiting, a corrupted systemd journal database may cause a kind of denial of service (we are stressing this point as multiple users have reported us such problems with the journal database - information current as of June 2013).r\r]}r^(hXB, except that you know for sure journal database entries will never be corrupted. Without ratelimiting, a corrupted systemd journal database may cause a kind of denial of service (we are stressing this point as multiple users have reported us such problems with the journal database - information current as of June 2013).hjNubeubeubh)r_}r`(hX**ratelimit.burst** messages (default: 20000) Specifies the maximum number of messages that can be emitted within the ratelimit.interval interval. For futher information, see description there. hhhhhhh }ra(h"]h#]h$]h%]h']uh)Nh*hh]rb(h7)rc}rd(hX-**ratelimit.burst** messages (default: 20000)hj_hhhh;h }re(h"]h#]h$]h%]h']uh)KHh]rf(h>)rg}rh(hX**ratelimit.burst**h }ri(h"]h#]h$]h%]h']uhjch]rjh3Xratelimit.burstrkrl}rm(hUhjgubahhFubh3X messages (default: 20000)rnro}rp(hX messages (default: 20000)hjcubeubh7)rq}rr(hXSpecifies the maximum number of messages that can be emitted within the ratelimit.interval interval. For futher information, see description there.rshj_hhhh;h }rt(h"]h#]h$]h%]h']uh)KJh]ruh3XSpecifies the maximum number of messages that can be emitted within the ratelimit.interval interval. For futher information, see description there.rvrw}rx(hjshjqubaubeubh)ry}rz(hX**IgnorePreviousMessages** [**off**/on] This option specifies whether imjournal should ignore messages currently in journal and read only new messages. This option is only used when there is no StateFile to avoid message loss. hhhhhhh }r{(h"]h#]h$]h%]h']uh)Nh*hh]r|(h7)r}}r~(hX'**IgnorePreviousMessages** [**off**/on]hjyhhhh;h }r(h"]h#]h$]h%]h']uh)KNh]r(h>)r}r(hX**IgnorePreviousMessages**h }r(h"]h#]h$]h%]h']uhj}h]rh3XIgnorePreviousMessagesrr}r(hUhjubahhFubh3X [rr}r(hX [hj}ubh>)r}r(hX**off**h }r(h"]h#]h$]h%]h']uhj}h]rh3Xoffrr}r(hUhjubahhFubh3X/on]rr}r(hX/on]hj}ubeubh7)r}r(hXThis option specifies whether imjournal should ignore messages currently in journal and read only new messages. This option is only used when there is no StateFile to avoid message loss.rhjyhhhh;h }r(h"]h#]h$]h%]h']uh)KPh]rh3XThis option specifies whether imjournal should ignore messages currently in journal and read only new messages. This option is only used when there is no StateFile to avoid message loss.rr}r(hjhjubaubeubh)r}r(hX1**DefaultSeverity** Some messages comming from journald don't have the SYSLOG_PRIORITY field. These are typically the messages logged through journald's native API. This option specifies the default severity for these messages. Can be given either as a name or a number. Defaults to 'notice'. hhhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX**DefaultSeverity** hjhhhh;h }r(h"]h#]h$]h%]h']uh)KTh]r(h>)r}r(hX**DefaultSeverity**h }r(h"]h#]h$]h%]h']uhjh]rh3XDefaultSeverityrr}r(hUhjubahhFubh3X rr}r(hX hjubeubh7)r}r(hXSome messages comming from journald don't have the SYSLOG_PRIORITY field. These are typically the messages logged through journald's native API. This option specifies the default severity for these messages. Can be given either as a name or a number. Defaults to 'notice'.rhjhhhh;h }r(h"]h#]h$]h%]h']uh)KVh]rh3XSome messages comming from journald don't have the SYSLOG_PRIORITY field. These are typically the messages logged through journald's native API. This option specifies the default severity for these messages. Can be given either as a name or a number. Defaults to 'notice'.rr}r(hjhjubaubeubh)r}r(hX/**DefaultFacility** Some messages comming from journald don't have the SYSLOG_FACILITY field. These are typically the messages logged through journald's native API. This option specifies the default facility for these messages. Can be given either as a name or a number. Defaults to 'user'. hhhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX**DefaultFacility** hjhhhh;h }r(h"]h#]h$]h%]h']uh)K[h]r(h>)r}r(hX**DefaultFacility**h }r(h"]h#]h$]h%]h']uhjh]rh3XDefaultFacilityrr}r(hUhjubahhFubh3X rr}r(hX hjubeubh7)r}r(hXSome messages comming from journald don't have the SYSLOG_FACILITY field. These are typically the messages logged through journald's native API. This option specifies the default facility for these messages. Can be given either as a name or a number. Defaults to 'user'.rhjhhhh;h }r(h"]h#]h$]h%]h']uh)K]h]rh3XSome messages comming from journald don't have the SYSLOG_FACILITY field. These are typically the messages logged through journald's native API. This option specifies the default facility for these messages. Can be given either as a name or a number. Defaults to 'user'.rr}r(hjhjubaubeubh)r}r(hX**usepidfromsystem** [**off**/on] Retrieves the trusted systemd parameter, _PID, instead of the user systemd parameter, SYSLOG_PID, which is the default. hhhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX!**usepidfromsystem** [**off**/on]hjhhhh;h }r(h"]h#]h$]h%]h']uh)Kbh]r(h>)r}r(hX**usepidfromsystem**h }r(h"]h#]h$]h%]h']uhjh]rh3Xusepidfromsystemrr}r(hUhjubahhFubh3X [rr}r(hX [hjubh>)r}r(hX**off**h }r(h"]h#]h$]h%]h']uhjh]rh3Xoffrr}r(hUhjubahhFubh3X/on]rr}r(hX/on]hjubeubh7)r}r(hXwRetrieves the trusted systemd parameter, _PID, instead of the user systemd parameter, SYSLOG_PID, which is the default.rhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kdh]rh3XwRetrieves the trusted systemd parameter, _PID, instead of the user systemd parameter, SYSLOG_PID, which is the default.rr}r(hjhjubaubeubeubh7)r}r(hX**Caveats/Known Bugs:**rhhhhhh;h }r(h"]h#]h$]h%]h']uh)Kgh*hh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3XCaveats/Known Bugs:rr}r(hUhjubahhFubaubh)r}r(hUhhhhhhh }r(hX-h%]h$]h"]h#]h']uh)Kih*hh]r(h)r}r(hXAs stated above, a corrupted systemd journal database can cause major problems, depending on what the corruption results in. This is beyond the control of the rsyslog team. hjhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]rh7)r }r (hXAs stated above, a corrupted systemd journal database can cause major problems, depending on what the corruption results in. This is beyond the control of the rsyslog team.r hjhhhh;h }r (h"]h#]h$]h%]h']uh)Kih]r h3XAs stated above, a corrupted systemd journal database can cause major problems, depending on what the corruption results in. This is beyond the control of the rsyslog team.rr}r(hj hj ubaubaubh)r}r(hXimjournal does not check if messages received actually originated from rsyslog itself (via omjournal or other means). Depending on configuration, this can also lead to a loop. With imuxsock, this problem does not exist. hjhhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]rh7)r}r(hXimjournal does not check if messages received actually originated from rsyslog itself (via omjournal or other means). Depending on configuration, this can also lead to a loop. With imuxsock, this problem does not exist.rhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kmh]rh3Ximjournal does not check if messages received actually originated from rsyslog itself (via omjournal or other means). Depending on configuration, this can also lead to a loop. With imuxsock, this problem does not exist.rr}r(hjhjubaubaubeubh7)r}r(hX**Build Requirements:**rhhhhhh;h }r (h"]h#]h$]h%]h']uh)Krh*hh]r!h>)r"}r#(hjh }r$(h"]h#]h$]h%]h']uhjh]r%h3XBuild Requirements:r&r'}r((hUhj"ubahhFubaubh7)r)}r*(hX0Development headers for systemd, version >= 197.r+hhhhhh;h }r,(h"]h#]h$]h%]h']uh)Kth*hh]r-h3X0Development headers for systemd, version >= 197.r.r/}r0(hj+hj)ubaubh7)r1}r2(hX **Sample:**r3hhhhhh;h }r4(h"]h#]h$]h%]h']uh)Kvh*hh]r5h>)r6}r7(hj3h }r8(h"]h#]h$]h%]h']uhj1h]r9h3XSample:r:r;}r<(hUhj6ubahhFubaubh7)r=}r>(hXgThe following example shows pulling structured imjournal messages and saving them into /var/log/ceelog.r?hhhhhh;h }r@(h"]h#]h$]h%]h']uh)Kxh*hh]rAh3XgThe following example shows pulling structured imjournal messages and saving them into /var/log/ceelog.rBrC}rD(hj?hj=ubaubcdocutils.nodes literal_block rE)rF}rG(hXmodule(load="imjournal" PersistStateInterval="100" StateFile="/path/to/file") #load imjournal module module(load="mmjsonparse") #load mmjsonparse module for structured logs template(name="CEETemplate" type="string" string="%TIMESTAMP% %HOSTNAME% %syslogtag% @cee: %$!all-json%\n" ) #template for messages action(type="mmjsonparse") action(type="omfile" file="/var/log/ceelog" template="CEETemplate")hhhhhU literal_blockrHh }rI(U xml:spacerJUpreserverKh%]h$]h"]h#]h']uh)K}h*hh]rLh3Xmodule(load="imjournal" PersistStateInterval="100" StateFile="/path/to/file") #load imjournal module module(load="mmjsonparse") #load mmjsonparse module for structured logs template(name="CEETemplate" type="string" string="%TIMESTAMP% %HOSTNAME% %syslogtag% @cee: %$!all-json%\n" ) #template for messages action(type="mmjsonparse") action(type="omfile" file="/var/log/ceelog" template="CEETemplate")rMrN}rO(hUhjFubaubh7)rP}rQ(hX$**Legacy Configuration Directives**:rRhhhhhh;h }rS(h"]h#]h$]h%]h']uh)Kh*hh]rT(h>)rU}rV(hX#**Legacy Configuration Directives**h }rW(h"]h#]h$]h%]h']uhjPh]rXh3XLegacy Configuration DirectivesrYrZ}r[(hUhjUubahhFubh3X:r\}r](hX:hjPubeubh)r^}r_(hUhhhhhhh }r`(hX-h%]h$]h"]h#]h']uh)Kh*hh]ra(h)rb}rc(hXH**$imjournalPersistStateInterval** Equivalent to: PersistStateInterval hj^hhhhh }rd(h"]h#]h$]h%]h']uh)Nh*hh]re(h7)rf}rg(hX"**$imjournalPersistStateInterval**rhhjbhhhh;h }ri(h"]h#]h$]h%]h']uh)Kh]rjh>)rk}rl(hjhh }rm(h"]h#]h$]h%]h']uhjfh]rnh3X$imjournalPersistStateIntervalrorp}rq(hUhjkubahhFubaubh7)rr}rs(hX#Equivalent to: PersistStateIntervalrthjbhhhh;h }ru(h"]h#]h$]h%]h']uh)Kh]rvh3X#Equivalent to: PersistStateIntervalrwrx}ry(hjthjrubaubeubh)rz}r{(hX2**$imjournalStateFile** Equivalent to: StateFile hj^hhhhh }r|(h"]h#]h$]h%]h']uh)Nh*hh]r}(h7)r~}r(hX**$imjournalStateFile**rhjzhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhj~h]rh3X$imjournalStateFilerr}r(hUhjubahhFubaubh7)r}r(hXEquivalent to: StateFilerhjzhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh3XEquivalent to: StateFilerr}r(hjhjubaubeubh)r}r(hXC**$imjournalRatelimitInterval** Equivalent to: ratelimit.interval hj^hhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX**$imjournalRatelimitInterval**rhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X$imjournalRatelimitIntervalrr}r(hUhjubahhFubaubh7)r}r(hX!Equivalent to: ratelimit.intervalrhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh3X!Equivalent to: ratelimit.intervalrr}r(hjhjubaubeubh)r}r(hX=**$imjournalRatelimitBurst** Equivalent to: ratelimit.burst hj^hhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX**$imjournalRatelimitBurst**rhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X$imjournalRatelimitBurstrr}r(hUhjubahhFubaubh7)r}r(hXEquivalent to: ratelimit.burstrhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh3XEquivalent to: ratelimit.burstrr}r(hjhjubaubeubh)r}r(hXK**$ImjournalIgnorePreviousMessages** Equivalent to: ignorePreviousMessageshj^hhhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r(h7)r}r(hX$**$ImjournalIgnorePreviousMessages**rhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X $ImjournalIgnorePreviousMessagesrr}r(hUhjubahhFubaubh7)r}r(hX%Equivalent to: ignorePreviousMessagesrhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh3X%Equivalent to: ignorePreviousMessagesrr}r(hjhjubaubeubh)r}r(hX=**$ImjournalDefaultSeverity** Equivalent to: DefaultSeverityhj^hNhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]rcdocutils.nodes definition_list r)r}r(hUh }r(h"]h#]h$]h%]h']uhjh]rcdocutils.nodes definition_list_item r)r}r(hX<**$ImjournalDefaultSeverity** Equivalent to: DefaultSeverityhjhhhUdefinition_list_itemrh }r(h"]h#]h$]h%]h']uh)Kh]r(cdocutils.nodes term r)r}r(hX**$ImjournalDefaultSeverity**rhjhhhUtermrh }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X$ImjournalDefaultSeverityrr}r(hUhjubahhFubaubcdocutils.nodes definition r)r}r(hUh }r(h"]h#]h$]h%]h']uhjh]rh7)r}r(hXEquivalent to: DefaultSeverityrhjhhhh;h }r(h"]h#]h$]h%]h']uh)Kh]rh3XEquivalent to: DefaultSeverityrr}r(hjhjubaubahU definitionrubeubahUdefinition_listrubaubh)r}r(hX=**$ImjournalDefaultFacility** Equivalent to: DefaultFacilityhj^hNhhh }r(h"]h#]h$]h%]h']uh)Nh*hh]r j)r }r (hUh }r (h"]h#]h$]h%]h']uhjh]r j)r}r(hX<**$ImjournalDefaultFacility** Equivalent to: DefaultFacilityhj hhhjh }r(h"]h#]h$]h%]h']uh)Kh]r(j)r}r(hX**$ImjournalDefaultFacility**rhjhhhjh }r(h"]h#]h$]h%]h']uh)Kh]rh>)r}r(hjh }r(h"]h#]h$]h%]h']uhjh]rh3X$ImjournalDefaultFacilityrr}r(hUhjubahhFubaubj)r}r(hUh }r (h"]h#]h$]h%]h']uhjh]r!h7)r"}r#(hXEquivalent to: DefaultFacilityr$hjhhhh;h }r%(h"]h#]h$]h%]h']uh)Kh]r&h3XEquivalent to: DefaultFacilityr'r(}r)(hj$hj"ubaubahjubeubahjubaubeubeubahUU transformerr*NU footnote_refsr+}r,Urefnamesr-}r.Usymbol_footnotesr/]r0Uautofootnote_refsr1]r2Usymbol_footnote_refsr3]r4U citationsr5]r6h*hU current_liner7NUtransform_messagesr8]r9Ureporterr:NUid_startr;KU autofootnotesr<]r=U citation_refsr>}r?Uindirect_targetsr@]rAUsettingsrB(cdocutils.frontend Values rCorD}rE(Ufootnote_backlinksrFKUrecord_dependenciesrGNU rfc_base_urlrHUhttps://tools.ietf.org/html/rIU tracebackrJUpep_referencesrKNUstrip_commentsrLNU toc_backlinksrMUentryrNU language_coderOUenrPU datestamprQNU report_levelrRKU _destinationrSNU halt_levelrTKU strip_classesrUNh0NUerror_encoding_error_handlerrVUbackslashreplacerWUdebugrXNUembed_stylesheetrYUoutput_encoding_error_handlerrZUstrictr[U sectnum_xformr\KUdump_transformsr]NU docinfo_xformr^KUwarning_streamr_NUpep_file_url_templater`Upep-%04draUexit_status_levelrbKUconfigrcNUstrict_visitorrdNUcloak_email_addressesreUtrim_footnote_reference_spacerfUenvrgNUdump_pseudo_xmlrhNUexpose_internalsriNUsectsubtitle_xformrjU source_linkrkNUrfc_referencesrlNUoutput_encodingrmUutf-8rnU source_urlroNUinput_encodingrpU utf-8-sigrqU_disable_configrrNU id_prefixrsUU tab_widthrtKUerror_encodingruUUTF-8rvU_sourcerwhUgettext_compactrxU generatorryNUdump_internalsrzNU smart_quotesr{U pep_base_urlr|U https://www.python.org/dev/peps/r}Usyntax_highlightr~UlongrUinput_encoding_error_handlerrj[Uauto_id_prefixrUidrUdoctitle_xformrUstrip_elements_with_classesrNU _config_filesr]Ufile_insertion_enabledrU raw_enabledrKU dump_settingsrNubUsymbol_footnote_startrKUidsr}r(hhhhhhuUsubstitution_namesr}rhh*h }r(h"]h%]h$]Usourcehh#]h']uU footnotesr]rUrefidsr}rub.build/.doctrees/configuration/modules/idx_input.doctree0000664000175000017500000001037413035122641022420 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qX input modulesqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhU input-modulesqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXF/home/rger/proj/rsyslog-doc/source/configuration/modules/idx_input.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hX Input Modulesq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/X Input Modulesq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hXInput modules are used to gather messages from various sources. They interface to message generators. They are generally defined via the :doc:`input <../input>` configuration object.hhhhhU paragraphq6h}q7(h]h]h ]h!]h#]uh%Kh&hh]q8(h/XInput modules are used to gather messages from various sources. They interface to message generators. They are generally defined via the q9q:}q;(hXInput modules are used to gather messages from various sources. They interface to message generators. They are generally defined via the hh4ubcsphinx.addnodes pending_xref q<)q=}q>(hX:doc:`input <../input>`q?hh4hhhU pending_xrefq@h}qA(UreftypeXdocqBUrefwarnqCU reftargetqDX../inputU refdomainUh!]h ]U refexplicith]h]h#]UrefdocqEXconfiguration/modules/idx_inputqFuh%Kh]qGcdocutils.nodes literal qH)qI}qJ(hh?h}qK(h]h]qL(UxrefqMhBeh ]h!]h#]uhh=h]qNh/XinputqOqP}qQ(hUhhIubahUliteralqRubaubh/X configuration object.qSqT}qU(hX configuration object.hh4ubeubcdocutils.nodes compound qV)qW}qX(hUhhhhhUcompoundqYh}qZ(h]h]q[Utoctree-wrapperq\ah ]h!]h#]uh%Nh&hh]q]csphinx.addnodes toctree q^)q_}q`(hUhhWhhhUtoctreeqah}qb(UnumberedqcKU includehiddenqdhhFUcaptionqeNUglobqfh!]h ]U titlesonlyqgh]h]h#]Uentriesqh]qi(NXconfiguration/modules/im3195qjqkNXconfiguration/modules/imfileqlqmNXconfiguration/modules/imgssapiqnqoNXconfiguration/modules/imjournalqpqqNXconfiguration/modules/imklogqrqsNXconfiguration/modules/imkmsgqtquNXconfiguration/modules/impstatsqvqwNXconfiguration/modules/imptcpqxqyNXconfiguration/modules/imrelpqzq{NXconfiguration/modules/imsolarisq|q}NXconfiguration/modules/imtcpq~qNXconfiguration/modules/imudpqqNXconfiguration/modules/imuxsockqqeUhiddenqU includefilesq]q(hjhlhnhphrhthvhxhzh|h~hheUmaxdepthqKuh%Kh]ubaubeubahUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh&hU current_lineqNUtransform_messagesq]qUreporterqNUid_startqKU autofootnotesq]qU citation_refsq}qUindirect_targetsq]qUsettingsq(cdocutils.frontend Values qoq}q(Ufootnote_backlinksqKUrecord_dependenciesqNU rfc_base_urlqUhttps://tools.ietf.org/html/qU tracebackqUpep_referencesqNUstrip_commentsqNU toc_backlinksqUentryqU language_codeqUenqU datestampqNU report_levelqKU _destinationqNU halt_levelqKU strip_classesqNh,NUerror_encoding_error_handlerqUbackslashreplaceqUdebugqNUembed_stylesheetqUoutput_encoding_error_handlerqUstrictqU sectnum_xformqKUdump_transformsqNU docinfo_xformqKUwarning_streamqNUpep_file_url_templateqUpep-%04dqUexit_status_levelqKUconfigqNUstrict_visitorqNUcloak_email_addressesqÈUtrim_footnote_reference_spaceqĉUenvqNUdump_pseudo_xmlqNUexpose_internalsqNUsectsubtitle_xformqȉU source_linkqNUrfc_referencesqNUoutput_encodingqUutf-8qU source_urlqNUinput_encodingqU utf-8-sigqU_disable_configqNU id_prefixqUU tab_widthqKUerror_encodingqUUTF-8qU_sourceqhUgettext_compactqֈU generatorqNUdump_internalsqNU smart_quotesqىU pep_base_urlqU https://www.python.org/dev/peps/qUsyntax_highlightqUlongqUinput_encoding_error_handlerqhUauto_id_prefixqUidqUdoctitle_xformqUstrip_elements_with_classesqNU _config_filesq]Ufile_insertion_enabledqU raw_enabledqKU dump_settingsqNubUsymbol_footnote_startqKUidsq}qhhsUsubstitution_namesq}qhh&h}q(h]h!]h ]Usourcehh]h#]uU footnotesq]qUrefidsq}qub.build/.doctrees/configuration/modules/omudpspoof.doctree0000664000175000017500000007334513035122643022621 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}q(Xmodule parametersqNXrainer gerhardsqXcaveats/known bugsqNX&omudpspoof: udp spoofing output moduleq NXsampleq NXadisconq Xrsyslogq X legacy sampleq NXaction parametersqNXlegacy configuration directivesqNuUsubstitution_defsq}qUparse_messagesq]qUcurrent_sourceqNU decorationqNUautofootnote_startqKUnameidsq}q(hUmodule-parametersqhUrainer-gerhardsqhUcaveats-known-bugsqh U%omudpspoof-udp-spoofing-output-moduleqh Usampleqh Uadisconqh Ursyslogqh U legacy-sampleq hUaction-parametersq!hUlegacy-configuration-directivesq"uUchildrenq#]q$cdocutils.nodes section q%)q&}q'(U rawsourceq(UUparentq)hUsourceq*XG/home/rger/proj/rsyslog-doc/source/configuration/modules/omudpspoof.rstq+Utagnameq,Usectionq-U attributesq.}q/(Udupnamesq0]Uclassesq1]Ubackrefsq2]Uidsq3]q4haUnamesq5]q6h auUlineq7KUdocumentq8hh#]q9(cdocutils.nodes title q:)q;}q<(h(X&omudpspoof: UDP spoofing output moduleq=h)h&h*h+h,Utitleq>h.}q?(h0]h1]h2]h3]h5]uh7Kh8hh#]q@cdocutils.nodes Text qAX&omudpspoof: UDP spoofing output moduleqBqC}qD(h(h=h)h;ubaubcdocutils.nodes paragraph qE)qF}qG(h(X**Module Name:    omstdout**qHh)h&h*h+h,U paragraphqIh.}qJ(h0]h1]h2]h3]h5]uh7Kh8hh#]qKcdocutils.nodes strong qL)qM}qN(h(hHh.}qO(h0]h1]h2]h3]h5]uh)hFh#]qPhAXModule Name:    omstdoutqQqR}qS(h(Uh)hMubah,UstrongqTubaubhE)qU}qV(h(XR**Author:** David Lang and Rainer Gerhards h)h&h*h+h,hIh.}qW(h0]h1]h2]h3]h5]uh7Kh8hh#]qX(hL)qY}qZ(h(X **Author:**h.}q[(h0]h1]h2]h3]h5]uh)hUh#]q\hAXAuthor:q]q^}q_(h(Uh)hYubah,hTubhAX David Lang and Rainer Gerhards and Rainer Gerhards qv}qw(h(X>h)hUubeubhE)qx}qy(h(X**Available Since**: 5.1.3qzh)h&h*h+h,hIh.}q{(h0]h1]h2]h3]h5]uh7K h8hh#]q|(hL)q}}q~(h(X**Available Since**h.}q(h0]h1]h2]h3]h5]uh)hxh#]qhAXAvailable Sinceqq}q(h(Uh)h}ubah,hTubhAX: 5.1.3qq}q(h(X: 5.1.3h)hxubeubhE)q}q(h(X**Description**:qh)h&h*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7K h8hh#]q(hL)q}q(h(X**Description**h.}q(h0]h1]h2]h3]h5]uh)hh#]qhAX Descriptionqq}q(h(Uh)hubah,hTubhAX:q}q(h(X:h)hubeubhE)q}q(h(XThis module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports.qh)h&h*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7K h8hh#]qhAXThis module is similar to the regular UDP forwarder, but permits to spoof the sender address. Also, it enables to circle through a number of source ports.qq}q(h(hh)hubaubh%)q}q(h(Uh)h&h*h+h,h-h.}q(h0]h1]h2]h3]qhah5]qhauh7Kh8hh#]q(h:)q}q(h(XModule Parametersqh)hh*h+h,h>h.}q(h0]h1]h2]h3]h5]uh7Kh8hh#]qhAXModule Parametersqq}q(h(hh)hubaubcdocutils.nodes bullet_list q)q}q(h(Uh)hh*h+h,U bullet_listqh.}q(UbulletqX-h3]h2]h0]h1]h5]uh7Kh8hh#]qcdocutils.nodes list_item q)q}q(h(X**template** This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely. h)hh*h+h,U list_itemqh.}q(h0]h1]h2]h3]h5]uh7Nh8hh#]q(hE)q}q(h(X**template** h)hh*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7Kh#]q(hL)q}q(h(X **template**h.}q(h0]h1]h2]h3]h5]uh)hh#]qhAXtemplateqq}q(h(Uh)hubah,hTubhAX qÅq}q(h(X h)hubeubhE)q}q(h(XThis setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.qh)hh*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7Kh#]qhAXThis setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.q˅q}q(h(hh)hubaubeubaubeubh%)q}q(h(Uh)h&h*h+h,h-h.}q(h0]h1]h2]h3]qh!ah5]qhauh7Kh8hh#]q(h:)q}q(h(XAction Parametersqh)hh*h+h,h>h.}q(h0]h1]h2]h3]h5]uh7Kh8hh#]qhAXAction Parametersqمq}q(h(hh)hubaubh)q}q(h(Uh)hh*h+h,hh.}q(hX-h3]h2]h0]h1]h5]uh7Kh8hh#]q(h)q}q(h(XH**target** or Host that the messages shall be sent to. h)hh*h+h,hh.}q(h0]h1]h2]h3]h5]uh7Nh8hh#]q(hE)q}q(h(X**target** or h)hh*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7Kh#]q(hL)q}q(h(X **target**h.}q(h0]h1]h2]h3]h5]uh)hh#]qhAXtargetq셁q}q(h(Uh)hubah,hTubhAX or qq}q(h(X or h)hubeubhE)q}q(h(X(Host that the messages shall be sent to.qh)hh*h+h,hIh.}q(h0]h1]h2]h3]h5]uh7Kh#]qhAX(Host that the messages shall be sent to.qq}q(h(hh)hubaubeubh)q}q(h(XQ**port** Remote port that the messages shall be sent to. Default is 514. h)hh*h+h,hh.}q(h0]h1]h2]h3]h5]uh7Nh8hh#]q(hE)q}q(h(X**port** h)hh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7K!h#]r(hL)r}r(h(X**port**h.}r(h0]h1]h2]h3]h5]uh)hh#]rhAXportrr}r(h(Uh)jubah,hTubhAX r r }r (h(X h)hubeubhE)r }r (h(X?Remote port that the messages shall be sent to. Default is 514.rh)hh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7K#h#]rhAX?Remote port that the messages shall be sent to. Default is 514.rr}r(h(jh)j ubaubeubh)r}r(h(Xr**sourcetemplate** This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case. h)hh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]r(hE)r}r(h(X!**sourcetemplate** h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7K%h#]r(hL)r}r(h(X**sourcetemplate**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAXsourcetemplater r!}r"(h(Uh)jubah,hTubhAX r#r$}r%(h(X h)jubeubhE)r&}r'(h(XNThis is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.h)jh*h+h,hIh.}r((h0]h1]h2]h3]h5]uh7K'h#]r)hAXLThis is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.r*r+}r,(h(XNThis is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.h)j&ubaubeubh)r-}r.(h(X**sourceport.start** r/h)hh*h+h,hh.}r0(h0]h1]h2]h3]h5]uh7Nh8hh#]r1hE)r2}r3(h(j/h)j-h*h+h,hIh.}r4(h0]h1]h2]h3]h5]uh7K3h#]r5(hL)r6}r7(h(X**sourceport.start**h.}r8(h0]h1]h2]h3]h5]uh)j2h#]r9hAXsourceport.startr:r;}r<(h(Uh)j6ubah,hTubhAX r=r>}r?(h(X h)j2ubeubaubh)r@}rA(h(X**sourceport.end** Specify the start and end value for circling the source ports. Start must be less than or equal to the end value. Defaults are 32000 and 42000. h)hh*h+h,hh.}rB(h0]h1]h2]h3]h5]uh7Nh8hh#]rC(hE)rD}rE(h(X**sourceport.end** h)j@h*h+h,hIh.}rF(h0]h1]h2]h3]h5]uh7K4h#]rG(hL)rH}rI(h(X**sourceport.end**h.}rJ(h0]h1]h2]h3]h5]uh)jDh#]rKhAXsourceport.endrLrM}rN(h(Uh)jHubah,hTubhAX rOrP}rQ(h(X h)jDubeubhE)rR}rS(h(XSpecify the start and end value for circling the source ports. Start must be less than or equal to the end value. Defaults are 32000 and 42000.rTh)j@h*h+h,hIh.}rU(h0]h1]h2]h3]h5]uh7K6h#]rVhAXSpecify the start and end value for circling the source ports. Start must be less than or equal to the end value. Defaults are 32000 and 42000.rWrX}rY(h(jTh)jRubaubeubh)rZ}r[(h(X**template** This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely. h)hh*h+h,hh.}r\(h0]h1]h2]h3]h5]uh7Nh8hh#]r](hE)r^}r_(h(X**template** h)jZh*h+h,hIh.}r`(h0]h1]h2]h3]h5]uh7K9h#]ra(hL)rb}rc(h(X **template**h.}rd(h0]h1]h2]h3]h5]uh)j^h#]rehAXtemplaterfrg}rh(h(Uh)jbubah,hTubhAX rirj}rk(h(X h)j^ubeubhE)rl}rm(h(XThis setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.rnh)jZh*h+h,hIh.}ro(h0]h1]h2]h3]h5]uh7K;h#]rphAXThis setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.rqrr}rs(h(jnh)jlubaubeubh)rt}ru(h(X?**mtu** Maximum packet length to send, default is 1500. h)hh*h+h,hh.}rv(h0]h1]h2]h3]h5]uh7Nh8hh#]rw(hE)rx}ry(h(X **mtu** h)jth*h+h,hIh.}rz(h0]h1]h2]h3]h5]uh7K?h#]r{(hL)r|}r}(h(X**mtu**h.}r~(h0]h1]h2]h3]h5]uh)jxh#]rhAXmturr}r(h(Uh)j|ubah,hTubhAX rr}r(h(X h)jxubeubhE)r}r(h(X/Maximum packet length to send, default is 1500.rh)jth*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KAh#]rhAX/Maximum packet length to send, default is 1500.rr}r(h(jh)jubaubeubeubeubh%)r}r(h(Uh)h&h*h+h,h-h.}r(h0]h1]h2]h3]rh"ah5]rhauh7KDh8hh#]r(h:)r}r(h(XLegacy Configuration Directivesrh)jh*h+h,h>h.}r(h0]h1]h2]h3]h5]uh7KDh8hh#]rhAXLegacy Configuration Directivesrr}r(h(jh)jubaubh)r}r(h(Uh)jh*h+h,hh.}r(hX-h3]h2]h0]h1]h5]uh7KFh8hh#]r(h)r}r(h(X**$ActionOMOMUDPSpoofSourceNameTemplate** This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(X**$ActionOMOMUDPSpoofSourceNameTemplate** This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KFh#]r(hL)r}r(h(X)**$ActionOMOMUDPSpoofSourceNameTemplate**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX%$ActionOMOMUDPSpoofSourceNameTemplaterr}r(h(Uh)jubah,hTubhAX\ This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.rr}r(h(X^ This is the name of the template that contains a numerical IP address that is to be used as the source system IP address. While it may often be a constant value, it can be generated as usual via the property replacer, as long as it is a valid IPv4 address. If not specified, the build-in default template RSYSLOG\_omudpspoofDfltSourceTpl is used. This template is defined as follows: $template RSYSLOG\_omudpspoofDfltSourceTpl,"%fromhost-ip%" So in essence, the default template spoofs the address of the system the message was received from. This is considered the most important use case.h)jubeubaubh)r}r(h(XS**$ActionOMUDPSpoofTargetHost** Host that the messages shall be sent to.h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(XS**$ActionOMUDPSpoofTargetHost** Host that the messages shall be sent to.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KRh#]r(hL)r}r(h(X**$ActionOMUDPSpoofTargetHost**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX$ActionOMUDPSpoofTargetHostrr}r(h(Uh)jubah,hTubhAX4 Host that the messages shall be sent to.rr}r(h(X4 Host that the messages shall be sent to.h)jubeubaubh)r}r(h(XV**$ActionOMUDPSpoofTargetPort** Remote port that the messages shall be sent to.h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(XV**$ActionOMUDPSpoofTargetPort** Remote port that the messages shall be sent to.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KTh#]r(hL)r}r(h(X**$ActionOMUDPSpoofTargetPort**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX$ActionOMUDPSpoofTargetPortrr}r(h(Uh)jubah,hTubhAX7 Remote port that the messages shall be sent to.rr}r(h(X7 Remote port that the messages shall be sent to.h)jubeubaubh)r}r(h(X**$ActionOMUDPSpoofDefaultTemplate** This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(X**$ActionOMUDPSpoofDefaultTemplate** This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KVh#]r(hL)r}r(h(X$**$ActionOMUDPSpoofDefaultTemplate**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX $ActionOMUDPSpoofDefaultTemplaterr}r(h(Uh)jubah,hTubhAX This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.rr}r(h(X This setting instructs omudpspoof to use a template different from the default template for all of its actions that do not have a template specified explicitely.h)jubeubaubh)r}r(h(X**$ActionOMUDPSpoofSourcePortStart** Specifies the start value for circeling the source ports. Must be less than or equal to the end value. Default is 32000.h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(X**$ActionOMUDPSpoofSourcePortStart** Specifies the start value for circeling the source ports. Must be less than or equal to the end value. Default is 32000.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7KZh#]r(hL)r}r(h(X$**$ActionOMUDPSpoofSourcePortStart**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX $ActionOMUDPSpoofSourcePortStartrr}r(h(Uh)jubah,hTubhAX Specifies the start value for circeling the source ports. Must be less than or equal to the end value. Default is 32000.rr}r(h(X Specifies the start value for circeling the source ports. Must be less than or equal to the end value. Default is 32000.h)jubeubaubh)r}r(h(X**$ActionOMUDPSpoofSourcePortEnd** Specifies the ending value for circeling the source ports. Must be less than or equal to the start value. Default is 42000. h)jh*h+h,hh.}r(h0]h1]h2]h3]h5]uh7Nh8hh#]rhE)r}r(h(X**$ActionOMUDPSpoofSourcePortEnd** Specifies the ending value for circeling the source ports. Must be less than or equal to the start value. Default is 42000.h)jh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7K]h#]r(hL)r}r(h(X"**$ActionOMUDPSpoofSourcePortEnd**h.}r(h0]h1]h2]h3]h5]uh)jh#]rhAX$ActionOMUDPSpoofSourcePortEndrr}r(h(Uh)jubah,hTubhAX Specifies the ending value for circeling the source ports. Must be less than or equal to the start value. Default is 42000.r r }r (h(X Specifies the ending value for circeling the source ports. Must be less than or equal to the start value. Default is 42000.h)jubeubaubeubeubh%)r }r (h(Uh)h&h*h+h,h-h.}r(h0]h1]h2]h3]rhah5]rhauh7Kbh8hh#]r(h:)r}r(h(XCaveats/Known Bugsrh)j h*h+h,h>h.}r(h0]h1]h2]h3]h5]uh7Kbh8hh#]rhAXCaveats/Known Bugsrr}r(h(jh)jubaubh)r}r(h(Uh)j h*h+h,hh.}r(hX-h3]h2]h0]h1]h5]uh7Kdh8hh#]r(h)r}r(h(Xs**IPv6** is currently not supported. If you need this capability, please let us know via the rsyslog mailing list. h)jh*h+h,hh.}r (h0]h1]h2]h3]h5]uh7Nh8hh#]r!hE)r"}r#(h(Xr**IPv6** is currently not supported. If you need this capability, please let us know via the rsyslog mailing list.h)jh*h+h,hIh.}r$(h0]h1]h2]h3]h5]uh7Kdh#]r%(hL)r&}r'(h(X**IPv6**h.}r((h0]h1]h2]h3]h5]uh)j"h#]r)hAXIPv6r*r+}r,(h(Uh)j&ubah,hTubhAXj is currently not supported. If you need this capability, please let us know via the rsyslog mailing list.r-r.}r/(h(Xj is currently not supported. If you need this capability, please let us know via the rsyslog mailing list.h)j"ubeubaubh)r0}r1(h(X9Throughput is MUCH smaller than when using omfwd module. h)jh*h+h,hh.}r2(h0]h1]h2]h3]h5]uh7Nh8hh#]r3hE)r4}r5(h(X8Throughput is MUCH smaller than when using omfwd module.r6h)j0h*h+h,hIh.}r7(h0]h1]h2]h3]h5]uh7Kgh#]r8hAX8Throughput is MUCH smaller than when using omfwd module.r9r:}r;(h(j6h)j4ubaubaubeubeubh%)r<}r=(h(Uh)h&h*h+h,h-h.}r>(h0]h1]h2]h3]r?hah5]r@h auh7Kjh8hh#]rA(h:)rB}rC(h(XSamplerDh)j<h*h+h,h>h.}rE(h0]h1]h2]h3]h5]uh7Kjh8hh#]rFhAXSamplerGrH}rI(h(jDh)jBubaubhE)rJ}rK(h(X[Forward the message to 192.168.1.1, using original source and port between 10000 and 19999.rLh)j<h*h+h,hIh.}rM(h0]h1]h2]h3]h5]uh7Klh8hh#]rNhAX[Forward the message to 192.168.1.1, using original source and port between 10000 and 19999.rOrP}rQ(h(jLh)jJubaubcdocutils.nodes literal_block rR)rS}rT(h(XiAction ( type="omudpspoof" target="192.168.1.1" sourceport.start="10000" sourceport.end="19999" )h)j<h*h+h,U literal_blockrUh.}rV(U xml:spacerWUpreserverXh3]h2]h0]h1]h5]uh7Kph8hh#]rYhAXiAction ( type="omudpspoof" target="192.168.1.1" sourceport.start="10000" sourceport.end="19999" )rZr[}r\(h(Uh)jSubaubhE)r]}r^(h(X[Forward the message to 192.168.1.1, using source address 192.168.111.111 and default ports.r_h)j<h*h+h,hIh.}r`(h0]h1]h2]h3]h5]uh7Kwh8hh#]rahAX[Forward the message to 192.168.1.1, using source address 192.168.111.111 and default ports.rbrc}rd(h(j_h)j]ubaubjR)re}rf(h(XModule ( load="omudpspoof" ) Template ( name="spoofaddr" type="string" string="192.168.111.111" ) Action ( type="omudpspoof" target="192.168.1.1" sourcetemplate="spoofaddr" )h)j<h*h+h,jUh.}rg(jWjXh3]h2]h0]h1]h5]uh7K{h8hh#]rhhAXModule ( load="omudpspoof" ) Template ( name="spoofaddr" type="string" string="192.168.111.111" ) Action ( type="omudpspoof" target="192.168.1.1" sourcetemplate="spoofaddr" )rirj}rk(h(Uh)jeubaubeubh%)rl}rm(h(Uh)h&h*h+h,h-h.}rn(h0]h1]h2]h3]roh ah5]rph auh7Kh8hh#]rq(h:)rr}rs(h(X Legacy Samplerth)jlh*h+h,h>h.}ru(h0]h1]h2]h3]h5]uh7Kh8hh#]rvhAX Legacy Samplerwrx}ry(h(jth)jrubaubhE)rz}r{(h(XThe following sample forwards all syslog messages in standard form to the remote server server.example.com. The original sender's address is used. We do not care about the source port. This example is considered the typical use case for omudpspoof.r|h)jlh*h+h,hIh.}r}(h0]h1]h2]h3]h5]uh7Kh8hh#]r~hAXThe following sample forwards all syslog messages in standard form to the remote server server.example.com. The original sender's address is used. We do not care about the source port. This example is considered the typical use case for omudpspoof.rr}r(h(j|h)jzubaubjR)r}r(h(X]$ModLoad omudpspoof $ActionOMUDPSpoofTargetHost server.example.com *.*      :omudpspoof:h)jlh*h+h,jUh.}r(jWjXh3]h2]h0]h1]h5]uh7Kh8hh#]rhAX]$ModLoad omudpspoof $ActionOMUDPSpoofTargetHost server.example.com *.*      :omudpspoof:rr}r(h(Uh)jubaubhE)r}r(h(XThe following sample forwards all syslog messages in unmodified form to the remote server server.example.com. The sender address 192.0.2.1 with fixed source port 514 is used.rh)jlh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7Kh8hh#]rhAXThe following sample forwards all syslog messages in unmodified form to the remote server server.example.com. The sender address 192.0.2.1 with fixed source port 514 is used.rr}r(h(jh)jubaubjR)r}r(h(X$$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $template spooftemplate,"%rawmsg%" $ActionOMUDPSpoofSourceNameTemplate spoofaddr $ActionOMUDPSpoofTargetHost server.example.com $ActionOMUDPSpoofSourcePortStart 514 $ActionOMUDPSpoofSourcePortEnd 514 *.*      :omudpspoof:;spooftemplateh)jlh*h+h,jUh.}r(jWjXh3]h2]h0]h1]h5]uh7Kh8hh#]rhAX$$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $template spooftemplate,"%rawmsg%" $ActionOMUDPSpoofSourceNameTemplate spoofaddr $ActionOMUDPSpoofTargetHost server.example.com $ActionOMUDPSpoofSourcePortStart 514 $ActionOMUDPSpoofSourcePortEnd 514 *.*      :omudpspoof:;spooftemplaterr}r(h(Uh)jubaubhE)r}r(h(XCThe following sample is similar to the previous, but uses as many defaults as possible. In that sample, a source port in the range 32000..42000 is used. The message is formatted according to rsyslog's canned default forwarding format. Note that if any parameters have been changed, the previously set defaults will be used!rh)jlh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7Kh8hh#]rhAXCThe following sample is similar to the previous, but uses as many defaults as possible. In that sample, a source port in the range 32000..42000 is used. The message is formatted according to rsyslog's canned default forwarding format. Note that if any parameters have been changed, the previously set defaults will be used!rr}r(h(jh)jubaubjR)r}r(h(X$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $ActionOMUDPSpoofSourceNameTemplate spoofaddr $ActionOMUDPSpoofTargetHost server.example.com *.*      :omudpspoof:h)jlh*h+h,jUh.}r(jWjXh3]h2]h0]h1]h5]uh7Kh8hh#]rhAX$ModLoad omudpspoof $template spoofaddr,"192.0.2.1" $ActionOMUDPSpoofSourceNameTemplate spoofaddr $ActionOMUDPSpoofTargetHost server.example.com *.*      :omudpspoof:rr}r(h(Uh)jubaubhE)r}r(h(XOThis documentation is part of the `rsyslog `_ project.h)jlh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7Kh8hh#]r(hAX"This documentation is part of the rr}r(h(X"This documentation is part of the h)jubhc)r}r(h(X$`rsyslog `_h.}r(Unameh UrefurirXhttp://www.rsyslog.com/rh3]h2]h0]h1]h5]uh)jh#]rhAXrsyslogrr}r(h(Uh)jubah,hkubcdocutils.nodes target r)r}r(h(X U referencedrKh)jh,Utargetrh.}r(Urefurijh3]rhah2]h0]h1]h5]rh auh#]ubhAX project.rr}r(h(X project.h)jubeubhE)r}r(h(XCopyright © 2009-2014 by `Rainer Gerhards `_ and `Adiscon `_. Released under the GNU GPL version 3 or higher.h)jlh*h+h,hIh.}r(h0]h1]h2]h3]h5]uh7Kh8hh#]r(hAXCopyright © 2009-2014 by rr}r(h(XCopyright © 2009-2014 by h)jubhc)r}r(h(X3`Rainer Gerhards `_h.}r(UnameXRainer GerhardsjXhttp://www.gerhards.net/rainerrh3]h2]h0]h1]h5]uh)jh#]rhAXRainer Gerhardsrr}r(h(Uh)jubah,hkubj)r}r(h(X! jKh)jh,jh.}r(Urefurijh3]rhah2]h0]h1]h5]rhauh#]ubhAX and rr}r(h(X and h)jubhc)r}r(h(X$`Adiscon `_h.}r(UnameXAdisconjXhttp://www.adiscon.com/rh3]h2]h0]h1]h5]uh)jh#]rhAXAdisconrr}r(h(Uh)jubah,hkubj)r}r(h(X jKh)jh,jh.}r(Urefurijh3]rhah2]h0]h1]h5]rh auh#]ubhAX1. Released under the GNU GPL version 3 or higher.rr}r(h(X1. Released under the GNU GPL version 3 or higher.h)jubeubeubeubah(UU transformerrNU footnote_refsr}rUrefnamesr}rUsymbol_footnotesr]rUautofootnote_refsr]rUsymbol_footnote_refsr]rU citationsr]rh8hU current_linerNUtransform_messagesr]rUreporterrNUid_startrKU autofootnotesr]rU citation_refsr}rUindirect_targetsr]rUsettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttps://tools.ietf.org/html/rU tracebackr Upep_referencesr NUstrip_commentsr NU toc_backlinksr Uentryr U language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelrKU strip_classesrNh>NUerror_encoding_error_handlerrUbackslashreplacerUdebugrNUembed_stylesheetrUoutput_encoding_error_handlerrUstrictrU sectnum_xformrKUdump_transformsrNU docinfo_xformrKUwarning_streamrNUpep_file_url_templaterUpep-%04dr Uexit_status_levelr!KUconfigr"NUstrict_visitorr#NUcloak_email_addressesr$Utrim_footnote_reference_spacer%Uenvr&NUdump_pseudo_xmlr'NUexpose_internalsr(NUsectsubtitle_xformr)U source_linkr*NUrfc_referencesr+NUoutput_encodingr,Uutf-8r-U source_urlr.NUinput_encodingr/U utf-8-sigr0U_disable_configr1NU id_prefixr2UU tab_widthr3KUerror_encodingr4UUTF-8r5U_sourcer6h+Ugettext_compactr7U generatorr8NUdump_internalsr9NU smart_quotesr:U pep_base_urlr;U https://www.python.org/dev/peps/r<Usyntax_highlightr=Ulongr>Uinput_encoding_error_handlerr?jUauto_id_prefixr@UidrAUdoctitle_xformrBUstrip_elements_with_classesrCNU _config_filesrD]Ufile_insertion_enabledrEU raw_enabledrFKU dump_settingsrGNubUsymbol_footnote_startrHKUidsrI}rJ(h jlhh&hhhjhj<h!hhjhj h"jhjuUsubstitution_namesrK}rLh,h8h.}rM(h0]h3]h2]Usourceh+h1]h5]uU footnotesrN]rOUrefidsrP}rQub.build/.doctrees/configuration/modules/omrelp.doctree0000664000175000017500000011122413035122643021711 0ustar rgerrgercdocutils.nodes document q)q}q(U nametypesq}qXomrelp: relp output moduleqNsUsubstitution_defsq}qUparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startq KUnameidsq}qhUomrelp-relp-output-moduleqsUchildrenq]qcdocutils.nodes section q)q}q(U rawsourceqUUparentqhUsourceqXC/home/rger/proj/rsyslog-doc/source/configuration/modules/omrelp.rstqUtagnameqUsectionqU attributesq}q(Udupnamesq]Uclassesq]Ubackrefsq ]Uidsq!]q"haUnamesq#]q$hauUlineq%KUdocumentq&hh]q'(cdocutils.nodes title q()q)}q*(hXomrelp: RELP Output Moduleq+hhhhhUtitleq,h}q-(h]h]h ]h!]h#]uh%Kh&hh]q.cdocutils.nodes Text q/Xomrelp: RELP Output Moduleq0q1}q2(hh+hh)ubaubcdocutils.nodes paragraph q3)q4}q5(hX**Module Name:    omrelp**q6hhhhhU paragraphq7h}q8(h]h]h ]h!]h#]uh%Kh&hh]q9cdocutils.nodes strong q:)q;}q<(hh6h}q=(h]h]h ]h!]h#]uhh4h]q>h/XModule Name:    omrelpq?q@}qA(hUhh;ubahUstrongqBubaubh3)qC}qD(hX4**Author:**\ Rainer Gerhards qEhhhhhh7h}qF(h]h]h ]h!]h#]uh%Kh&hh]qG(h:)qH}qI(hX **Author:**h}qJ(h]h]h ]h!]h#]uhhCh]qKh/XAuthor:qLqM}qN(hUhhHubahhBubh/XRainer Gerhards q[}q\(hX>hhCubeubh3)q]}q^(hX**Description**:q_hhhhhh7h}q`(h]h]h ]h!]h#]uh%Kh&hh]qa(h:)qb}qc(hX**Description**h}qd(h]h]h ]h!]h#]uhh]h]qeh/X Descriptionqfqg}qh(hUhhbubahhBubh/X:qi}qj(hX:hh]ubeubh3)qk}ql(hXThis module supports sending syslog messages over the reliable RELP protocol. For RELP's advantages over plain tcp syslog, please see the documentation for :doc:`imrelp ` (the server counterpart).hhhhhh7h}qm(h]h]h ]h!]h#]uh%K h&hh]qn(h/XThis module supports sending syslog messages over the reliable RELP protocol. For RELP's advantages over plain tcp syslog, please see the documentation for qoqp}qq(hXThis module supports sending syslog messages over the reliable RELP protocol. For RELP's advantages over plain tcp syslog, please see the documentation for hhkubcsphinx.addnodes pending_xref qr)qs}qt(hX:doc:`imrelp `quhhkhhhU pending_xrefqvh}qw(UreftypeXdocqxUrefwarnqyU reftargetqzXimrelpU refdomainUh!]h ]U refexplicith]h]h#]Urefdocq{Xconfiguration/modules/omrelpq|uh%K h]q}cdocutils.nodes literal q~)q}q(hhuh}q(h]h]q(Uxrefqhxeh ]h!]h#]uhhsh]qh/Ximrelpqq}q(hUhhubahUliteralqubaubh/X (the server counterpart).qq}q(hX (the server counterpart).hhkubeubh3)q}q(hXSetupqhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh&hh]qh/XSetupqq}q(hhhhubaubh3)q}q(hXPlease note that `librelp `__ is required for imrelp (it provides the core relp protocol implementation).hhhhhh7h}q(h]h]h ]h!]h#]uh%Kh&hh]q(h/XPlease note that qq}q(hXPlease note that hhubhR)q}q(hX$`librelp `__h}q(UnameXlibrelpUrefuriqXhttp://www.librelp.comh!]h ]h]h]h#]uhhh]qh/Xlibrelpqq}q(hUhhubahhZubh/XL is required for imrelp (it provides the core relp protocol implementation).qq}q(hXL is required for imrelp (it provides the core relp protocol implementation).hhubeubh3)q}q(hX$**Action Configuration Parameters**:qhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh&hh]q(h:)q}q(hX#**Action Configuration Parameters**h}q(h]h]h ]h!]h#]uhhh]qh/XAction Configuration Parametersqq}q(hUhhubahhBubh/X:q}q(hX:hhubeubh3)q}q(hXThis module supports RainerScript configuration starting with rsyslog 7.3.10. For older versions, legacy configuration directives must be used.qhhhhhh7h}q(h]h]h ]h!]h#]uh%Kh&hh]qh/XThis module supports RainerScript configuration starting with rsyslog 7.3.10. For older versions, legacy configuration directives must be used.qq}q(hhhhubaubcdocutils.nodes bullet_list q)q}q(hUhhhhhU bullet_listqh}q(UbulletqX-h!]h ]h]h]h#]uh%Kh&hh]q(cdocutils.nodes list_item q)q}q(hX7**target** (mandatory) The target server to connect to.hhhhhU list_itemqh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hX7**target** (mandatory) The target server to connect to.hhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]q(h:)q}q(hX **target**h}q(h]h]h ]h!]h#]uhhh]qh/Xtargetqхq}q(hUhhubahhBubh/X- (mandatory) The target server to connect to.qԅq}q(hX- (mandatory) The target server to connect to.hhubeubaubh)q}q(hXn**template** (not mandatory, default "RSYSLOG\_ForwardFormat") Defines the template to be used for the output.hhhhhhh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hXn**template** (not mandatory, default "RSYSLOG\_ForwardFormat") Defines the template to be used for the output.hhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]q(h:)q}q(hX **template**h}q(h]h]h ]h!]h#]uhhh]qh/Xtemplateqㅁq}q(hUhhubahhBubh/Xa (not mandatory, default "RSYSLOG_ForwardFormat") Defines the template to be used for the output.q慁q}q(hXb (not mandatory, default "RSYSLOG\_ForwardFormat") Defines the template to be used for the output.hhubeubaubh)q}q(hX**timeout** (not mandatory, default 90) Timeout for relp sessions. If set too low, valid sessions may be considered dead and tried to recover.hhhhhhh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}q(hX**timeout** (not mandatory, default 90) Timeout for relp sessions. If set too low, valid sessions may be considered dead and tried to recover.hhhhhh7h}q(h]h]h ]h!]h#]uh%Kh]q(h:)q}q(hX **timeout**h}q(h]h]h ]h!]h#]uhhh]qh/Xtimeoutqq}q(hUhhubahhBubh/X (not mandatory, default 90) Timeout for relp sessions. If set too low, valid sessions may be considered dead and tried to recover.qq}q(hX (not mandatory, default 90) Timeout for relp sessions. If set too low, valid sessions may be considered dead and tried to recover.hhubeubaubh)q}q(hXO**conn.timeout** (not mandatory, default 10) Timeout for the socket connection.hhhhhhh}q(h]h]h ]h!]h#]uh%Nh&hh]qh3)q}r(hXO**conn.timeout** (not mandatory, default 10) Timeout for the socket connection.hhhhhh7h}r(h]h]h ]h!]h#]uh%K h]r(h:)r}r(hX**conn.timeout**h}r(h]h]h ]h!]h#]uhhh]rh/X conn.timeoutrr}r (hUhjubahhBubh/X? (not mandatory, default 10) Timeout for the socket connection.r r }r (hX? (not mandatory, default 10) Timeout for the socket connection.hhubeubaubh)r }r(hX**windowSize** (not mandatory, default 0) This is an **expert parameter**. It permits to override the RELP window size being used by the client. Changing the window size has both an effect on performance as well as potential message duplication in failure case. A larger window size means more performance, but also potentially more duplicated messages - and vice versa. The default 0 means that librelp's default window size is being used, which is considered a compromise between goals reached. For your information: at the time of this writing, the librelp default window size is 128 messages, but this may change at any time. Note that there is no equivalent server parameter, as the client proposes and manages the window size in RELP protocol.hhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hX**windowSize** (not mandatory, default 0) This is an **expert parameter**. It permits to override the RELP window size being used by the client. Changing the window size has both an effect on performance as well as potential message duplication in failure case. A larger window size means more performance, but also potentially more duplicated messages - and vice versa. The default 0 means that librelp's default window size is being used, which is considered a compromise between goals reached. For your information: at the time of this writing, the librelp default window size is 128 messages, but this may change at any time. Note that there is no equivalent server parameter, as the client proposes and manages the window size in RELP protocol.hj hhhh7h}r(h]h]h ]h!]h#]uh%K"h]r(h:)r}r(hX**windowSize**h}r(h]h]h ]h!]h#]uhjh]rh/X windowSizerr}r(hUhjubahhBubh/X' (not mandatory, default 0) This is an rr}r(hX' (not mandatory, default 0) This is an hjubh:)r}r (hX**expert parameter**h}r!(h]h]h ]h!]h#]uhjh]r"h/Xexpert parameterr#r$}r%(hUhjubahhBubh/X. It permits to override the RELP window size being used by the client. Changing the window size has both an effect on performance as well as potential message duplication in failure case. A larger window size means more performance, but also potentially more duplicated messages - and vice versa. The default 0 means that librelp's default window size is being used, which is considered a compromise between goals reached. For your information: at the time of this writing, the librelp default window size is 128 messages, but this may change at any time. Note that there is no equivalent server parameter, as the client proposes and manages the window size in RELP protocol.r&r'}r((hX. It permits to override the RELP window size being used by the client. Changing the window size has both an effect on performance as well as potential message duplication in failure case. A larger window size means more performance, but also potentially more duplicated messages - and vice versa. The default 0 means that librelp's default window size is being used, which is considered a compromise between goals reached. For your information: at the time of this writing, the librelp default window size is 128 messages, but this may change at any time. Note that there is no equivalent server parameter, as the client proposes and manages the window size in RELP protocol.hjubeubaubh)r)}r*(hX**tls** (not mandatory, values "on","off", default "off") If set to "on", the RELP connection will be encrypted by TLS, so that the data is protected against observers. Please note that both the client and the server must have set TLS to either "on" or "off". Other combinations lead to unpredictable results. *Attention when using GnuTLS 2.10.x or older* Versions older than GnuTLS 2.10.x may cause a crash (Segfault) under certain circumstances. Most likely when an imrelp inputs and an omrelp output is configured. The crash may happen when you are receiving/sending messages at the same time. Upgrade to a newer version like GnuTLS 2.12.21 to solve the problem.hhhhhhh}r+(h]h]h ]h!]h#]uh%Nh&hh]r,(h3)r-}r.(hX5**tls** (not mandatory, values "on","off", default "off") If set to "on", the RELP connection will be encrypted by TLS, so that the data is protected against observers. Please note that both the client and the server must have set TLS to either "on" or "off". Other combinations lead to unpredictable results.hj)hhhh7h}r/(h]h]h ]h!]h#]uh%K.h]r0(h:)r1}r2(hX**tls**h}r3(h]h]h ]h!]h#]uhj-h]r4h/Xtlsr5r6}r7(hUhj1ubahhBubh/X. (not mandatory, values "on","off", default "off") If set to "on", the RELP connection will be encrypted by TLS, so that the data is protected against observers. Please note that both the client and the server must have set TLS to either "on" or "off". Other combinations lead to unpredictable results.r8r9}r:(hX. (not mandatory, values "on","off", default "off") If set to "on", the RELP connection will be encrypted by TLS, so that the data is protected against observers. Please note that both the client and the server must have set TLS to either "on" or "off". Other combinations lead to unpredictable results.hj-ubeubh3)r;}r<(hX-*Attention when using GnuTLS 2.10.x or older*r=hj)hhhh7h}r>(h]h]h ]h!]h#]uh%K4h]r?cdocutils.nodes emphasis r@)rA}rB(hj=h}rC(h]h]h ]h!]h#]uhj;h]rDh/X+Attention when using GnuTLS 2.10.x or olderrErF}rG(hUhjAubahUemphasisrHubaubh3)rI}rJ(hX5Versions older than GnuTLS 2.10.x may cause a crash (Segfault) under certain circumstances. Most likely when an imrelp inputs and an omrelp output is configured. The crash may happen when you are receiving/sending messages at the same time. Upgrade to a newer version like GnuTLS 2.12.21 to solve the problem.rKhj)hhhh7h}rL(h]h]h ]h!]h#]uh%K6h]rMh/X5Versions older than GnuTLS 2.10.x may cause a crash (Segfault) under certain circumstances. Most likely when an imrelp inputs and an omrelp output is configured. The crash may happen when you are receiving/sending messages at the same time. Upgrade to a newer version like GnuTLS 2.12.21 to solve the problem.rNrO}rP(hjKhjIubaubeubh)rQ}rR(hX**tls.compression** (not mandatory, values "on","off", default "off") The controls if the TLS stream should be compressed (zipped). While this increases CPU use, the network bandwidth should be reduced. Note that typical text-based log records usually compress rather well.hhhhhhh}rS(h]h]h ]h!]h#]uh%Nh&hh]rTh3)rU}rV(hX**tls.compression** (not mandatory, values "on","off", default "off") The controls if the TLS stream should be compressed (zipped). While this increases CPU use, the network bandwidth should be reduced. Note that typical text-based log records usually compress rather well.hjQhhhh7h}rW(h]h]h ]h!]h#]uh%K;h]rX(h:)rY}rZ(hX**tls.compression**h}r[(h]h]h ]h!]h#]uhjUh]r\h/Xtls.compressionr]r^}r_(hUhjYubahhBubh/X (not mandatory, values "on","off", default "off") The controls if the TLS stream should be compressed (zipped). While this increases CPU use, the network bandwidth should be reduced. Note that typical text-based log records usually compress rather well.r`ra}rb(hX (not mandatory, values "on","off", default "off") The controls if the TLS stream should be compressed (zipped). While this increases CPU use, the network bandwidth should be reduced. Note that typical text-based log records usually compress rather well.hjUubeubaubh)rc}rd(hXM**tls.permittedPeer** peer Places access restrictions on this forwarder. Only peers which have been listed in this parameter may be connected to. This guards against rouge servers and man-in-the-middle attacks. The validation bases on the certficate the remote peer presents. The *peer* parameter lists permitted certificate fingerprints. Note that it is an array parameter, so either a single or multiple fingerprints can be listed. When a non-permitted peer is connected to, the refusal is logged together with it's fingerprint. So if the administrator knows this was a valid request, he can simple add the fingerprint by copy and paste from the logfile to rsyslog.conf. It must be noted, though, that this situation should usually not happen after initial client setup and administrators should be alert in this case. Note that usually a single remote peer should be all that is ever needed. Support for multiple peers is primarily included in support of load balancing scenarios. If the connection goes to a specific server, only one specific certificate is ever expected (just like when connecting to a specific ssh server). To specify multiple fingerprints, just enclose them in braces like this: :: tls.permittedPeer=["SHA1:...1", "SHA1:....2"] To specify just a single peer, you can either specify the string directly or enclose it in braces.hhhhhhh}re(h]h]h ]h!]h#]uh%Nh&hh]rf(h3)rg}rh(hX**tls.permittedPeer** peer Places access restrictions on this forwarder. Only peers which have been listed in this parameter may be connected to. This guards against rouge servers and man-in-the-middle attacks. The validation bases on the certficate the remote peer presents.hjchhhh7h}ri(h]h]h ]h!]h#]uh%K?h]rj(h:)rk}rl(hX**tls.permittedPeer**h}rm(h]h]h ]h!]h#]uhjgh]rnh/Xtls.permittedPeerrorp}rq(hUhjkubahhBubh/X peer Places access restrictions on this forwarder. Only peers which have been listed in this parameter may be connected to. This guards against rouge servers and man-in-the-middle attacks. The validation bases on the certficate the remote peer presents.rrrs}rt(hX peer Places access restrictions on this forwarder. Only peers which have been listed in this parameter may be connected to. This guards against rouge servers and man-in-the-middle attacks. The validation bases on the certficate the remote peer presents.hjgubeubh3)ru}rv(hX The *peer* parameter lists permitted certificate fingerprints. Note that it is an array parameter, so either a single or multiple fingerprints can be listed. When a non-permitted peer is connected to, the refusal is logged together with it's fingerprint. So if the administrator knows this was a valid request, he can simple add the fingerprint by copy and paste from the logfile to rsyslog.conf. It must be noted, though, that this situation should usually not happen after initial client setup and administrators should be alert in this case.hjchhhh7h}rw(h]h]h ]h!]h#]uh%KEh]rx(h/XThe ryrz}r{(hXThe hjuubj@)r|}r}(hX*peer*h}r~(h]h]h ]h!]h#]uhjuh]rh/Xpeerrr}r(hUhj|ubahjHubh/X parameter lists permitted certificate fingerprints. Note that it is an array parameter, so either a single or multiple fingerprints can be listed. When a non-permitted peer is connected to, the refusal is logged together with it's fingerprint. So if the administrator knows this was a valid request, he can simple add the fingerprint by copy and paste from the logfile to rsyslog.conf. It must be noted, though, that this situation should usually not happen after initial client setup and administrators should be alert in this case.rr}r(hX parameter lists permitted certificate fingerprints. Note that it is an array parameter, so either a single or multiple fingerprints can be listed. When a non-permitted peer is connected to, the refusal is logged together with it's fingerprint. So if the administrator knows this was a valid request, he can simple add the fingerprint by copy and paste from the logfile to rsyslog.conf. It must be noted, though, that this situation should usually not happen after initial client setup and administrators should be alert in this case.hjuubeubh3)r}r(hX}Note that usually a single remote peer should be all that is ever needed. Support for multiple peers is primarily included in support of load balancing scenarios. If the connection goes to a specific server, only one specific certificate is ever expected (just like when connecting to a specific ssh server). To specify multiple fingerprints, just enclose them in braces like this:rhjchhhh7h}r(h]h]h ]h!]h#]uh%KOh]rh/X}Note that usually a single remote peer should be all that is ever needed. Support for multiple peers is primarily included in support of load balancing scenarios. If the connection goes to a specific server, only one specific certificate is ever expected (just like when connecting to a specific ssh server). To specify multiple fingerprints, just enclose them in braces like this:rr}r(hjhjubaubcdocutils.nodes literal_block r)r}r(hX-tls.permittedPeer=["SHA1:...1", "SHA1:....2"]hjchU literal_blockrh}r(U xml:spacerUpreserverh!]h ]h]h]h#]uh%KYh]rh/X-tls.permittedPeer=["SHA1:...1", "SHA1:....2"]rr}r(hUhjubaubh3)r}r(hXbTo specify just a single peer, you can either specify the string directly or enclose it in braces.rhjchhhh7h}r(h]h]h ]h!]h#]uh%K[h]rh/XbTo specify just a single peer, you can either specify the string directly or enclose it in braces.rr}r(hjhjubaubeubh)r}r(hX**tls.authMode** mode Sets the mode used for mutual authentication. Supported values are either "*fingerprint*\ " or "*name"*. Fingerprint mode basically is what SSH does. It does not require a full PKI to be present, instead self-signed certs can be used on all peers. Even if a CA certificate is given, the validity of the peer cert is NOT verified against it. Only the certificate fingerprint counts. In "name" mode, certificate validation happens. Here, the matching is done against the certificate's subjectAltName and, as a fallback, the subject common name. If the certificate contains multiple names, a match on any one of these names is considered good and permits the peer to talk to rsyslog.hhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hX**tls.authMode** mode Sets the mode used for mutual authentication. Supported values are either "*fingerprint*\ " or "*name"*. Fingerprint mode basically is what SSH does. It does not require a full PKI to be present, instead self-signed certs can be used on all peers. Even if a CA certificate is given, the validity of the peer cert is NOT verified against it. Only the certificate fingerprint counts. In "name" mode, certificate validation happens. Here, the matching is done against the certificate's subjectAltName and, as a fallback, the subject common name. If the certificate contains multiple names, a match on any one of these names is considered good and permits the peer to talk to rsyslog.hjhhhh7h}r(h]h]h ]h!]h#]uh%K]h]r(h:)r}r(hX**tls.authMode**h}r(h]h]h ]h!]h#]uhjh]rh/X tls.authModerr}r(hUhjubahhBubh/XQ mode Sets the mode used for mutual authentication. Supported values are either "rr}r(hXQ mode Sets the mode used for mutual authentication. Supported values are either "hjubj@)r}r(hX *fingerprint*h}r(h]h]h ]h!]h#]uhjh]rh/X fingerprintrr}r(hUhjubahjHubh/X" or "rr}r(hX\ " or "hjubj@)r}r(hX*name"*h}r(h]h]h ]h!]h#]uhjh]rh/Xname"rr}r(hUhjubahjHubh/XA. Fingerprint mode basically is what SSH does. It does not require a full PKI to be present, instead self-signed certs can be used on all peers. Even if a CA certificate is given, the validity of the peer cert is NOT verified against it. Only the certificate fingerprint counts. In "name" mode, certificate validation happens. Here, the matching is done against the certificate's subjectAltName and, as a fallback, the subject common name. If the certificate contains multiple names, a match on any one of these names is considered good and permits the peer to talk to rsyslog.rr}r(hXA. Fingerprint mode basically is what SSH does. It does not require a full PKI to be present, instead self-signed certs can be used on all peers. Even if a CA certificate is given, the validity of the peer cert is NOT verified against it. Only the certificate fingerprint counts. In "name" mode, certificate validation happens. Here, the matching is done against the certificate's subjectAltName and, as a fallback, the subject common name. If the certificate contains multiple names, a match on any one of these names is considered good and permits the peer to talk to rsyslog.hjubeubaubh)r}r(hXC**tls.cacert** the CA certificate that can verify the machine certsrhhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hjhjhhhh7h}r(h]h]h ]h!]h#]uh%Kih]r(h:)r}r(hX**tls.cacert**h}r(h]h]h ]h!]h#]uhjh]rh/X tls.cacertrr}r(hUhjubahhBubh/X5 the CA certificate that can verify the machine certsrr}r(hX5 the CA certificate that can verify the machine certshjubeubaubh)r}r(hX.**tls.mycert** the machine public certiificaterhhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hjhjhhhh7h}r(h]h]h ]h!]h#]uh%Kjh]r(h:)r}r(hX**tls.mycert**h}r(h]h]h ]h!]h#]uhjh]rh/X tls.mycertrr}r(hUhjubahhBubh/X the machine public certiificaterr}r(hX the machine public certiificatehjubeubaubh)r}r(hX)**tls.myprivkey** the machine private keyrhhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hjhjhhhh7h}r(h]h]h ]h!]h#]uh%Kkh]r(h:)r}r(hX**tls.myprivkey**h}r(h]h]h ]h!]h#]uhjh]rh/X tls.myprivkeyrr}r(hUhjubahhBubh/X the machine private keyrr}r(hX the machine private keyhjubeubaubh)r}r(hX**tls.prioritystring** (not mandatory, string) This parameter permits to specify the so-called "priority string" to GnuTLS. This string gives complete control over all crypto parameters, including compression setting. For this reason, when the prioritystring is specified, the "tls.compression" parameter has no effect and is ignored. Full information about how to construct a priority string can be found in the GnuTLS manual. At the time of this writing, this information was contained in `section 6.10 of the GnuTLS manual `__. **Note: this is an expert parameter.** Do not use if you do not exactly know what you are doing.hhhhhhh}r(h]h]h ]h!]h#]uh%Nh&hh]rh3)r}r(hX**tls.prioritystring** (not mandatory, string) This parameter permits to specify the so-called "priority string" to GnuTLS. This string gives complete control over all crypto parameters, including compression setting. For this reason, when the prioritystring is specified, the "tls.compression" parameter has no effect and is ignored. Full information about how to construct a priority string can be found in the GnuTLS manual. At the time of this writing, this information was contained in `section 6.10 of the GnuTLS manual `__. **Note: this is an expert parameter.** Do not use if you do not exactly know what you are doing.hjhhhh7h}r(h]h]h ]h!]h#]uh%Klh]r(h:)r}r (hX**tls.prioritystring**h}r (h]h]h ]h!]h#]uhjh]r h/Xtls.prioritystringr r }r(hUhjubahhBubh/X (not mandatory, string) This parameter permits to specify the so-called "priority string" to GnuTLS. This string gives complete control over all crypto parameters, including compression setting. For this reason, when the prioritystring is specified, the "tls.compression" parameter has no effect and is ignored. Full information about how to construct a priority string can be found in the GnuTLS manual. At the time of this writing, this information was contained in rr}r(hX (not mandatory, string) This parameter permits to specify the so-called "priority string" to GnuTLS. This string gives complete control over all crypto parameters, including compression setting. For this reason, when the prioritystring is specified, the "tls.compression" parameter has no effect and is ignored. Full information about how to construct a priority string can be found in the GnuTLS manual. At the time of this writing, this information was contained in hjubhR)r}r(hX``section 6.10 of the GnuTLS manual `__h}r(UnameX!section 6.10 of the GnuTLS manualhX8http://gnutls.org/manual/html_node/Priority-Strings.htmlh!]h ]h]h]h#]uhjh]rh/X!section 6.10 of the GnuTLS manualrr}r(hUhjubahhZubh/X. rr}r(hX. hjubh:)r}r(hX&**Note: this is an expert parameter.**h}r(h]h]h ]h!]h#]uhjh]rh/X"Note: this is an expert parameter.r r!}r"(hUhjubahhBubh/X: Do not use if you do not exactly know what you are doing.r#r$}r%(hX: Do not use if you do not exactly know what you are doing.hjubeubaubh)r&}r'(hX**localclientip** ip_address (not mandatory, string) omrelp uses ip_address as local client address while connecting to remote logserver. hhhhhhh}r((h]h]h ]h!]h#]uh%Nh&hh]r)h3)r*}r+(hX**localclientip** ip_address (not mandatory, string) omrelp uses ip_address as local client address while connecting to remote logserver.hj&hhhh7h}r,(h]h]h ]h!]h#]uh%Kxh]r-(h:)r.}r/(hX**localclientip**h}r0(h]h]h ]h!]h#]uhj*h]r1h/X localclientipr2r3}r4(hUhj.ubahhBubh/Xx ip_address (not mandatory, string) omrelp uses ip_address as local client address while connecting to remote logserver.r5r6}r7(hXx ip_address (not mandatory, string) omrelp uses ip_address as local client address while connecting to remote logserver.hj*ubeubaubeubh3)r8}r9(hX **Sample:**r:hhhhhh7h}r;(h]h]h ]h!]h#]uh%K|h&hh]r<h:)r=}r>(hj:h}r?(h]h]h ]h!]h#]uhj8h]r@h/XSample:rArB}rC(hUhj=ubahhBubaubh3)rD}rE(hXThe following sample sends all messages to the central server "centralserv" at port 2514 (note that that server must run imrelp on port 2514).rFhhhhhh7h}rG(h]h]h ]h!]h#]uh%K~h&hh]rHh/XThe following sample sends all messages to the central server "centralserv" at port 2514 (note that that server must run imrelp on port 2514).rIrJ}rK(hjFhjDubaubj)rL}rM(hXLmodule(load="omrelp") action(type="omrelp" target="centralserv" port="2514")hhhhhjh}rN(jjh!]h ]h]h]h#]uh%Kh&hh]rOh/XLmodule(load="omrelp") action(type="omrelp" target="centralserv" port="2514")rPrQ}rR(hUhjLubaubh3)rS}rT(hX$**Legacy Configuration Directives**:rUhhhhhh7h}rV(h]h]h ]h!]h#]uh%Kh&hh]rW(h:)rX}rY(hX#**Legacy Configuration Directives**h}rZ(h]h]h ]h!]h#]uhjSh]r[h/XLegacy Configuration Directivesr\r]}r^(hUhjXubahhBubh/X:r_}r`(hX:hjSubeubh3)ra}rb(hXThis module uses old-style action configuration to keep consistent with the forwarding rule. So far, no additional configuration directives can be specified. To send a message via RELP, userchhhhhh7h}rd(h]h]h ]h!]h#]uh%Kh&hh]reh/XThis module uses old-style action configuration to keep consistent with the forwarding rule. So far, no additional configuration directives can be specified. To send a message via RELP, userfrg}rh(hjchjaubaubj)ri}rj(hX(*.*  :omrelp::;