diff options
Diffstat (limited to 'doc/pmlastmsg.html')
| -rw-r--r-- | doc/pmlastmsg.html | 69 |
1 files changed, 0 insertions, 69 deletions
diff --git a/doc/pmlastmsg.html b/doc/pmlastmsg.html deleted file mode 100644 index fd26dbd..0000000 --- a/doc/pmlastmsg.html +++ /dev/null @@ -1,69 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> -<html><head> -<meta http-equiv="Content-Language" content="en"> -<title>parser module for "last message repeated n times" (pmlastmsg)</title> -</head> -<body> -<a href="rsyslog_conf_modules.html">rsyslog module reference</a> - -<h1>parser module for "last message repeated n times" (pmlastmsg)</h1> -<p><b>Module Name: pmlastmsg</b></p> -<p><b>Module Type: parser module</b></p> -<p><b>Author: </b>Rainer Gerhards <rgerhards@adiscon.com></p> -<p><b>Available Since</b>: 5.5.6</p> -<p><b>Description</b>:</p> -<p>Some syslogds are known to emit severily malformed messages with content -"last message repeated n times". These messages can mess up message reception, as -they lead to wrong interpretation with the standard RFC3164 parser. Rather than -trying to fix this issue in pmrfc3164, we have created a new parser module -specifically for these messages. The reason is that some processing overhead is -involved in processing these messages (they must be recognized) and we would -not like to place this toll on every user but only on those actually in need -of the feature. Note that the performance toll is not large -- but if you expect -a very high message rate with tenthousands of messages per second, you will notice -a difference. -<p>This module should be loaded first inside <a href="messageparser.html">rsyslog's -parser chain</a>. It processes all those messages that contain a PRI, then none or -some spaces and then the exact text (case-insensitive) "last message repeated n times" -where n must be an integer. All other messages are left untouched. - -<p><b>Please note:</b> this parser module makes it possible that these messages -are properly detected. It does <b>not</b> drop them. If you intend to drop those -messages, you need to use the usual filter logic in combination with the discard -action. As a side-note, please keep on your mind that the sender discarded messages -when the "last message repeated n times" message is emited. You want to consider if -that really is what you intend to happen. If not, go change the sender. - -<p><b>Configuration Directives</b>:</p> -<p>There do not currently exist any configuration directives for this module. -<p><b>Examples:</b></p> -<p>This example is the typical use case, where some systems emit malformed -"repeated msg" messages. Other than that, the default RFC5424 and RFC3164 parsers -should be used. Note that when a parser is specified, the default parser chain -is removed, so we need to specify all three parsers. We use this together with the -default ruleset. -</p> -<textarea rows="15" cols="80">$ModLoad pmlastmsg # this parser is NOT a built-in module - -# note that parser are tried in the -# order they appear in rsyslog.conf, so put pmlastmsg first -$RulesetParser rsyslog.lastline -# as we have removed the default parser chain, we -# need to add the default parsers as well. -$RulesetParser rsyslog.rfc5424 -$RulesetParser rsyslog.rfc3164 - -# now come the typical rules, like... -*.* /path/to/file.log -</textarea> -<p><b>Caveats/Known Bugs:</b> -<p>currently none -<p>[<a href="rsyslog_conf.html">rsyslog.conf overview</a>] -[<a href="manual.html">manual index</a>] [<a href="http://www.rsyslog.com/">rsyslog site</a>]</p> -<p><font size="2">This documentation is part of the -<a href="http://www.rsyslog.com/">rsyslog</a> -project.<br> -Copyright © 2010 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and -<a href="http://www.adiscon.com/">Adiscon</a>. -Released under the GNU GPL version 3 or higher.</font></p> -</body></html> |