Назад | Перейти на главную страницу

Шаблоны в Rsyslog 8.17

Недавно я исправил свою систему, и установленная версия rsyslog изменилась с 8.10 на 8.17. Как-то это обновление сломало все мои шаблоны. Мои настраиваемые свойства больше не распознаются (например, Mark, Flag, Windowsize и т. Д.). Вот пример:

template(name="FWToJSON-TCP" type="list") {
  constant(value="{")
  constant(value="\"TimeStamp\":\"") property(name="timereported"       dateFormat="rfc3339") constant(value="\",")
  constant(value="\"Mark\":\"") property(name="$!Mark" format="json")     constant(value="\",")
  constant(value="\"UrgentFlag\":\"") property(name="!UrgentFlag"  format="json") constant(value="\",")
  constant(value="\"Flag\":\"") property(name="$!Flag" format="json") constant(value="\",")
  constant(value="\"WindowSize\":\"") property(name="$!WindowSize" format="json") constant(value="\",")
  constant(value="\"AckNumber\":\"") property(name="$!AckNumber" format="json") constant(value="\",")
  constant(value="\"SequenceNumber\":\"") property(name="$!SequenceNumber" format="json") constant(value="\",")
  constant(value="\"DestinationPort\":\"") property(name="$!DestinationPort" format="json") constant(value="\",")
  constant(value="\"SourcePort\":\"") property(name="$!SourcePort" format="json") constant(value="\",")
  constant(value="\"Protocol\":\"") property(name="$!Protocol" format="json") constant(value="\",")
  constant(value="\"FragmentFlag\":\"") property(name="$!FragmentFlag" format="json") constant(value="\",")
  constant(value="\"ID\":\"") property(name="$!ID" format="json") constant(value="\",")
  constant(value="\"TTL\":\"") property(name="$!TTL" format="json") constant(value="\",")
  constant(value="\"Precedence\":\"") property(name="$!Precedence" format="json") constant(value="\",")
  constant(value="\"TypeOfService\":\"") property(name="$!TypeOfService" format="json") constant(value="\",")
  constant(value="\"Length\":\"") property(name="$!Length" format="json") constant(value="\",")
  constant(value="\"DestinationIP\":\"") property(name="$!DestinationIP" format="json") constant(value="\",")
  constant(value="\"SourceIP\":\"") property(name="!$SourceIP" format="json") constant(value="\",")
  constant(value="\"OutputDevice\":\"") property(name="$!OutputDevice" format="json") constant(value="\",")
  constant(value="\"InputDevice\":\"") property(name="$!InputDevice" format="json") constant(value="\",")
  constant(value="\"Prefix\":\"") property(name="$!Prefix" format="json") constant(value="\",")
  constant(value="\"Policy\":\"") property(name="$!Policy" format="json") constant(value="\",")
  constant(value="\"Chain\":\"") property(name="$!Chain" format="json") constant(value="\",")
  constant(value="\"FW\":\"") property(name="$!FW" format="json") constant(value="\",")
  constant(value="\"Message\":\"") property(name="msg" format="json") constant(value="\"")
  constant(value="}")
}

Журналы нормализуются с помощью модуля mmnormalize, и он по-прежнему работает, как кажется. Кто-нибудь знает, как заставить этот шаблон снова работать?

rsyslog