<div dir="ltr">thanks to your reply. i do not understand how to do now. it puzzle and trouble me some days. i read the balabit syslog-ng OSE guide documents and only have simple information in there.<div><br></div><div style>
how to do on this</div><div>----->>>><br><div class="gmail_extra">If you change the patterndb ruleset pattern to use a program of system rather than ESXI I think it would work.<br></div><div class="gmail_extra">
<br><br><div class="gmail_quote">2013/4/28 <span dir="ltr"><<a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a>></span><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Send syslog-ng mailing list submissions to<br>
<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:syslog-ng-request@lists.balabit.hu">syslog-ng-request@lists.balabit.hu</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:syslog-ng-owner@lists.balabit.hu">syslog-ng-owner@lists.balabit.hu</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of syslog-ng digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Can not get DBParse match macro result (syslog-ng 3.13<br>
debian squeeze) (????)<br>
2. Re: Can not get DBParse match macro result (syslog-ng 3.13<br>
debian squeeze) (Evan Rempel)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Sat, 27 Apr 2013 22:34:50 +0800<br>
From: ???? <<a href="mailto:onlydebian@gmail.com">onlydebian@gmail.com</a>><br>
Subject: [syslog-ng] Can not get DBParse match macro result (syslog-ng<br>
3.13 debian squeeze)<br>
To: <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
Message-ID:<br>
<CA+SSH2oBB2-WWvQksbchVVoyhfZbdVvDR=<a href="mailto:V7wJ1EJdvE6Zx9zg@mail.gmail.com">V7wJ1EJdvE6Zx9zg@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
when use pdbtool do match test, it is success. but from syslog-ng can not<br>
return result of macro<br>
i can not get macro result. for example, ${.esxi.month} no value, same<br>
as ${.esxi.host_ip} ${.esxi.time}<br>
<br>
test log output ,just like this.<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
<br>
<br>
do the pdbtool test, it's ok. wish someone can give me some solution and<br>
help. i have search some mail list but i can not get the right solution.<br>
thanks a lot.<br>
<br>
root@debian:~# pdbtool match -D -c -p<br>
/etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31<br>
192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd<br>
0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path<br>
"vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0.<br>
Act:NONE"<br>
Pattern matching part:<br>
@STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@<br>
@STRING:.esxi.time=15:17:31@@IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program=<br>
vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a<br>
(0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0<br>
Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0.<br>
Act:NONE@@ANYSTRING:.esxi.message=cpu11:8203)NMP:<br>
nmp_ThrottleLogForDevice:2319: Cmd<br>
0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0<br>
Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@<br>
Matching part:<br>
Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP:<br>
nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev<br>
mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid<br>
sense data: 0x5 0x20 0x0. Act:NONE<br>
Values:<br>
MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP:<br>
nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev<br>
mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid<br>
sense data: 0x5 0x20 0x0. Act:NONE<br>
PROGRAM=ESXI<br>
.classifier.class=esxi<br>
.classifier.rule_id=182437592347598<br>
.esxi.month=Apr<br>
.esxi.date=26<br>
.esxi.time=15:17:31<br>
.esxi.host_ip=192.168.88.71<br>
.esxi.program= vmkernel<br>
.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a<br>
(0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0<br>
Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE<br>
root@debian:~#<br>
<br>
<br>
my configuration like as below<br>
<br>
######## esxi_pattern.xml ############<br>
<?xml version="1.0" encoding="utf-8"?><br>
<patterndb version='3' pub_date='2009-04-17'><br>
<ruleset name='esxi' id='123456678'><br>
<pattern>ESXI</pattern><br>
<rules><br>
<rule provider='Fone Bro' id='182437592347598' class='esxi'><br>
<patterns><br>
<pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@<br>
@STRING:.esxi.time::@@IPv4:.esxi.host_ip:@<br>
@ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern><br>
</patterns><br>
</rule><br>
</rules><br>
</ruleset><br>
</patterndb><br>
<br>
######## syslog-ng.conf ########<br>
<br>
#####Parser#####<br>
parser pattern_db {<br>
db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml"));<br>
};<br>
<br>
#Check pattern matching<br>
destination udp_esxi_output {<br>
file("/var/log/pattern_output"<br>
template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST<br>
IP ${.esxi.host_ip},${.esxi.message}\n")<br>
template_escape(no));<br>
};<br>
<br>
#####Log#####<br>
log {<br>
source(s_network);<br>
parser(pattern_db);<br>
destination(udp_esxi_output);<br>
};<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130427/20e80756/attachment.html" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130427/20e80756/attachment.html</a><br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Sat, 27 Apr 2013 16:10:02 +0000<br>
From: Evan Rempel <<a href="mailto:erempel@uvic.ca">erempel@uvic.ca</a>><br>
Subject: Re: [syslog-ng] Can not get DBParse match macro result<br>
(syslog-ng 3.13 debian squeeze)<br>
To: "Syslog-ng users' and developers' mailing list"<br>
<<a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a>><br>
Message-ID: <<a href="mailto:q8vb966l4qe0219lsusm5ju4.1367078999747@email.android.com">q8vb966l4qe0219lsusm5ju4.1367078999747@email.android.com</a>><br>
Content-Type: text/plain; charset="iso-2022-jp"<br>
<br>
It would appear that you have everything correct when the "PROGRAM" is ESXI but the log line as syslog-ng sees it has a PROGRAM of "system" according to your test log output.<br>
<br>
If you change the patterndb ruleset pattern to use a program of system rather than ESXI I think it would work.<br>
<br>
<br>
Evan Rempel <a href="tel:250.271.7691" value="+12502717691">250.271.7691</a><br>
University Systems, University of Victoria<br>
<br>
???? <<a href="mailto:onlydebian@gmail.com">onlydebian@gmail.com</a>> wrote:<br>
<br>
<br>
<br>
when use pdbtool do match test, it is success. but from syslog-ng can not return result of macro<br>
i can not get macro result. for example, ${.esxi.month} no value, same as ${.esxi.host_ip} ${.esxi.time}<br>
<br>
test log output ,just like this.<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
=== system,error,critical, HOST IP ,<br>
<br>
<br>
do the pdbtool test, it's ok. wish someone can give me some solution and help. i have search some mail list but i can not get the right solution. thanks a lot.<br>
<br>
root@debian:~# pdbtool match -D -c -p /etc/syslog-ng/patterndb/esxi_pattern.xml -P ESXI -M "Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev "mpx.vmhba0:C0:T0:L0" on path "vmhba0:C0:T0:L0" Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE"<br>
Pattern matching part:<br>
@STRING:.esxi.month=Apr@ @STRING:.esxi.date=26@ @STRING:.esxi.time=15:17:31@ @IPv4:.esxi.host_ip=192.168.88.71@@ESTRING:.esxi.program= vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@ @ANYSTRING:.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE@<br>
Matching part:<br>
Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE<br>
Values:<br>
MESSAGE=Apr 26 15:17:31 192.168.88.71 vmkernel: cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE<br>
PROGRAM=ESXI<br>
.classifier.class=esxi<br>
.classifier.rule_id=182437592347598<br>
.esxi.month=Apr<br>
.esxi.date=26<br>
.esxi.time=15:17:31<br>
.esxi.host_ip=192.168.88.71<br>
.esxi.program= vmkernel<br>
.esxi.message=cpu11:8203)NMP: nmp_ThrottleLogForDevice:2319: Cmd 0x1a (0x4124444a6280, 0) to dev mpx.vmhba0:C0:T0:L0 on path vmhba0:C0:T0:L0 Failed: H:0x0 D:0x2 P:0x0 Valid sense data: 0x5 0x20 0x0. Act:NONE<br>
root@debian:~#<br>
<br>
<br>
my configuration like as below<br>
<br>
######## esxi_pattern.xml ############<br>
<?xml version="1.0" encoding="utf-8"?><br>
<patterndb version='3' pub_date='2009-04-17'><br>
<ruleset name='esxi' id='123456678'><br>
<pattern>ESXI</pattern><br>
<rules><br>
<rule provider='Fone Bro' id='182437592347598' class='esxi'><br>
<patterns><br>
<pattern>@STRING:.esxi.month:@ @STRING:.esxi.date:@ @STRING:.esxi.time::@ @IPv4:.esxi.host_ip:@@ESTRING:.esxi.program::@ @ANYSTRING:.esxi.message@</pattern><br>
</patterns><br>
</rule><br>
</rules><br>
</ruleset><br>
</patterndb><br>
<br>
######## syslog-ng.conf ########<br>
<br>
#####Parser#####<br>
parser pattern_db {<br>
db_parser( file("/etc/syslog-ng/patterndb/esxi_pattern.xml"));<br>
};<br>
<br>
#Check pattern matching<br>
destination udp_esxi_output {<br>
file("/var/log/pattern_output"<br>
template("=== $PROGRAM,${.esxi_month} ${.esxi.date} ${.esxi.time} HOST IP ${.esxi.host_ip},${.esxi.message}\n")<br>
template_escape(no));<br>
};<br>
<br>
#####Log#####<br>
log {<br>
source(s_network);<br>
parser(pattern_db);<br>
destination(udp_esxi_output);<br>
};<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130427/2f67c039/attachment-0001.htm" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130427/2f67c039/attachment-0001.htm</a><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
<br>
<br>
End of syslog-ng Digest, Vol 96, Issue 25<br>
*****************************************<br>
</blockquote></div><br></div></div></div>