<p dir="ltr">Really good ideas here. Thanks for sharing.</p>
<p dir="ltr">Some answers inline.</p>
<p dir="ltr">On May 23, 2016 6:06 PM, "Balint Kovacs" <<a href="mailto:kovacs.balint@balasys.hu">kovacs.balint@balasys.hu</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> This is a great one, it will help sysadmins tremendously. Some of it is available in "pbdtool match", but it's not a very flexible as the available syslog-ng facilities (filter, template) are hardwired. On the other hand, it helps with gathering user stories, I've been using this for the following tasks:<br>
><br>
> - patterndb building process -> testing the current patterndb coverage and identify outliers in existing log data<br>
> - "offline" processing log messages, without running a syslog-ng daemon<br>
> - basic filtering, "grep on steroids"<br>
> - advanced, message parser (e.g. patterndb) based filtering<br>
> - rewrite, adding metadata and anonymisation<br>
> - transform output using templates<br>
> - postprocessing old raw logs with new patterndb rules<br>
><br>
> What is not available in pbdtool is the heuristics in the initial message parsing of the source drivers, it would be great to have that implemented in the stdin driver, as it would save a great deal of time and resources if you don't have to transform the source material to a format that pdbtool likes.<br>
><br>
> I for myself see specifying the configuration in the command line a bit clumsy, I would not want to deal with escaping quotation marks and parentheses and rather use an input file. </p>
<p dir="ltr">Yeah, I think both are needed. Awk supports both specifying it via the command line and specifying a file.</p>
<p dir="ltr">Using apostrophes you can specify parentheses without escaping. Anyway,we are in agreement here.<br></p>
<p dir="ltr">Also, the supplied config snippet can grow very fast to a level where it is not quite well readable without indentation. Nevertheless this might be useful for quick, one-shot tests.<br>
><br>
> It would also be great if this tool could be used to test very complex log routing setups by being able to use your _existing_ syslog-ng configuration and feed a test message to it. It could prefix the output with the name of the chosen destination or it you want to take the idea further, you could specify which source and destination should be attached to stdin and stdout respectively, overriding the configured source and destination with the new drivers.</p>
<p dir="ltr"> The closest thing to this, that comes to my mind, is when you are stubbing out input and output streams of a library function within a unit test. I'm not sure that this fits in the scope of the GSoC project, but would save quite a lot of debug time on some setups I've encountered.</p>
<p dir="ltr">Good ideas. I am not sure how to handle complex source/destination setups.</p>
<p dir="ltr">Also this could be extremely helpful when combined with the built-in interactive config debugger (eg -i in 3.7 and current master)<br></p>
<p dir="ltr">><br>
> Best regards,<br>
> Balint<br>
><br>
><br>
> On 05/21/2016 03:02 PM, Scheidler, Balázs wrote:<br>
>><br>
>> Hi,<br>
>><br>
>> This is an email where I tried to describe what I had in mind with the original idea:<br>
>><br>
>> <a href="http://comments.gmane.org/gmane.comp.syslog-ng/17449">http://comments.gmane.org/gmane.comp.syslog-ng/17449</a><br>
>><br>
>> It would be great to have this implemented. <br>
>><br>
>> Cheers,<br>
>> Bazsi<br>
>><br>
>><br>
>> -- <br>
>> Bazsi<br>
>><br>
>> On Fri, May 20, 2016 at 2:10 PM, Noémi Ványi <<a href="mailto:sitbackandwait@gmail.com">sitbackandwait@gmail.com</a>> wrote:<br>
>>><br>
>>> Hello!<br>
>>><br>
>>> A new feature is going to be developed, as a part of GSOC, so syslog-ng can be started as a command line tool.<br>
>>><br>
>>> What could the CLI do for you?<br>
>>> pipelines of complex filtering, rewriting could be tested more easily, thus configuration could become simpler than before<br>
>>> existing logs could be transformed<br>
>>> The format of the new command line options is not decided yet. So your help and insight is needed to design the interface and the usage of the tool that you and other people around the world would use. :)<br>
>>><br>
>>> If you are intereted in contributing to the CLI, thus contributing to the syslog-ng community, please send an email to this thread. :) I am available at gitter for further info. :)<br>
>>><br>
>>> Regards<br>
>>> kvch<br>
>>><br>
>>> ______________________________________________________________________________<br>
>>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
>>> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
>>> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
>>><br>
>>><br>
>><br>
>><br>
>><br>
>> ______________________________________________________________________________<br>
>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
>> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
>> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
>><br>
><br>
><br>
> ______________________________________________________________________________<br>
> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
><br>
><br>
</p>