<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
</head>
<body>
<pre style="word-wrap:break-word; font-size:10.0pt; font-family:Tahoma; color:black">It would appear that you have everything correct when the "PROGRAM" is ESXI but the log line as syslog-ng sees it has a PROGRAM of "system" according to your test log output.
If you change the patterndb ruleset pattern to use a program of system rather than ESXI I think it would work.
Evan Rempel 250.271.7691
University Systems, University of Victoria
不坏阿峰 <onlydebian@gmail.com> wrote:
</pre>
<div>
<div dir="ltr">
<div style="">when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro </div>
<div style="">i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time}<br>
</div>
<div style=""><br>
</div>
<div style="">test log output ,just like this.</div>
<div style="">
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div>=== system,error,critical, HOST IP ,</div>
<div><br>
</div>
</div>
<div style=""><br>
</div>
<div style="">do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot.</div>
<div style=""><br>
</div>
<div style="">
<div>root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0"
Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE"</div>
<div>Pattern matching part:</div>
<div>@STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@ @IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path
vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ @ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2
P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@</div>
<div>Matching part:</div>
<div>Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>Values:</div>
<div>MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>PROGRAM=ESXI</div>
<div>.classifier.class=esxi</div>
<div>.classifier.rule_id=182437592347598</div>
<div>.esxi.month=Apr</div>
<div>.esxi.date=26</div>
<div>.esxi.time=15:17:31</div>
<div>.esxi.host_ip=192.168.88.71</div>
<div>.esxi.program= vmkernel</div>
<div>.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE</div>
<div>root@debian:~#</div>
<div><br>
</div>
</div>
<div style=""><br>
</div>
my configuration like as below
<div><br>
</div>
<div style="">######## esxi_pattern.xml ############</div>
<div>
<div><?xml version="1.0" encoding="utf-8"?></div>
<div><patterndb version='3' pub_date='2009-04-17'></div>
<div><ruleset name='esxi' id='123456678'></div>
<div><pattern>ESXI</pattern></div>
<div><rules></div>
<div><rule provider='Fone Bro' id='182437592347598' class='esxi'></div>
<div><patterns></div>
<div><pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@ @IPv4:.esxi.host_ip:@@ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern></div>
<div></patterns></div>
<div></rule></div>
<div></rules></div>
<div></ruleset></div>
<div></patterndb></div>
</div>
<div><br>
</div>
<div style="">######## syslog-ng.conf ########</div>
<div>
<div><br>
</div>
<div>#####Parser#####</div>
<div>parser pattern_db {</div>
<div> db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml"));</div>
<div>};</div>
<div><br>
</div>
<div>#Check pattern matching</div>
<div>destination udp_esxi_output {</div>
<div> file("/var/log/pattern_output"</div>
<div> template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n")</div>
<div>template_escape(no));</div>
<div>};</div>
<div><br>
</div>
<div>#####Log#####</div>
<div>log {</div>
<div> source(s_network);</div>
<div> parser(pattern_db);</div>
<div> destination(udp_esxi_output);</div>
<div>};</div>
</div>
<div><br>
</div>
</div>
</div>
</body>
</html>