<div dir="ltr"><div style>when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro </div><div style>i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time}<br>
</div><div style><br></div><div style>test log output ,just like this.</div><div style><div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div><div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div><div><br></div></div><div style><br></div><div style>do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot.</div>
<div style><br></div><div style><div>root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE"</div>
<div>Pattern matching part:</div><div>@STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@ @IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ @ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@</div>
<div>Matching part:</div><div>Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>Values:</div><div>MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>PROGRAM=ESXI</div><div>.classifier.class=esxi</div><div>.classifier.rule_id=182437592347598</div><div>.esxi.month=Apr</div><div>.esxi.date=26</div><div>.esxi.time=15:17:31</div><div>.esxi.host_ip=192.168.88.71</div><div>
.esxi.program= vmkernel</div><div>.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>root@debian:~#</div><div><br></div></div><div style><br></div>my configuration like as below<div><br></div><div style>######## esxi_pattern.xml ############</div><div><div><?xml version="1.0" encoding="utf-8"?></div>
<div><patterndb version='3' pub_date='2009-04-17'></div><div><ruleset name='esxi' id='123456678'></div><div><pattern>ESXI</pattern></div><div><rules></div><div>
<rule provider='Fone Bro' id='182437592347598' class='esxi'></div><div><patterns></div><div><pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@ @IPv4:.esxi.host_ip:@@ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern></div>
<div></patterns></div><div></rule></div><div></rules></div><div></ruleset></div><div></patterndb></div></div><div><br></div><div style>######## syslog-ng.conf ########</div><div><div><br>
</div><div>#####Parser#####</div><div>parser pattern_db {</div><div> db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml"));</div><div>};</div><div><br></div><div>#Check pattern matching</div><div>
destination udp_esxi_output {</div><div> file("/var/log/pattern_output"</div><div> template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n")</div>
<div>template_escape(no));</div><div>};</div><div><br></div><div>#####Log#####</div><div>log {</div><div> source(s_network);</div><div> parser(pattern_db);</div><div> destination(udp_esxi_output);</div>
<div>};</div></div><div><br></div></div>