diff options
Diffstat (limited to 'source/configuration/modules/pmlastmsg.rst')
-rw-r--r-- | source/configuration/modules/pmlastmsg.rst | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/source/configuration/modules/pmlastmsg.rst b/source/configuration/modules/pmlastmsg.rst new file mode 100644 index 0000000..711612f --- /dev/null +++ b/source/configuration/modules/pmlastmsg.rst @@ -0,0 +1,68 @@ +**************************************** +pmlastmsg: last message repeated n times +**************************************** + +=========================== =========================================================================== +**Module Name:** **pmlastmsg** +**Author:** `Rainer Gerhards <https://rainer.gerhards.net/>`_ <rgerhards@adiscon.com> +**Available Since:** 5.5.6 +=========================== =========================================================================== + + +Purpose +======= + +Some syslogds are known to emit severity malformed messages with content +"last message repeated n times". These messages can mess up message +reception, as they lead to wrong interpretation with the standard +RFC3164 parser. Rather than trying to fix this issue in pmrfc3164, we +have created a new parser module specifically for these messages. The +reason is that some processing overhead is involved in processing these +messages (they must be recognized) and we would not like to place this +toll on every user but only on those actually in need of the feature. +Note that the performance toll is not large -- but if you expect a very +high message rate with tenthousands of messages per second, you will +notice a difference. + +This module should be loaded first inside :doc:`rsyslog's parser +chain </concepts/messageparser>`. It processes all those messages that +contain a PRI, then none or some spaces and then the exact text +(case-insensitive) "last message repeated n times" where n must be an +integer. All other messages are left untouched. + + +Configuration Parameters +======================== + +.. note:: + + Parameter names are case-insensitive. + + +There do not currently exist any configuration parameters for this +module. + + +Examples +======== + +Systems emitting malformed "repeated msg" messages +-------------------------------------------------- + +This example is the typical use case, where some systems emit malformed +"repeated msg" messages. Other than that, the default :rfc:`5424` and +:rfc:`3164` parsers should be used. Note that when a parser is specified, +the default parser chain is removed, so we need to specify all three +parsers. We use this together with the default ruleset. + +.. code-block:: none + + module(load="pmlastmsg") + + parser(type="pmlastmsg" name="custom.pmlastmsg") + + ruleset(name="ruleset" parser=["custom.pmlastmsg", "rsyslog.rfc5424", + "rsyslog.rfc3164"]) { + ... do processing here ... + } + |