I am in the process of trying to create a macro FAC / SEV to produce the two numeric values I need for facility / priority. I've been looking over the source code and I was going to model those macros off of M_LEVEL macro. I am using 1.6.10 at the moment. When I check my changes.... my code doesn't seem to produce the desired results. ;) Not sure if I am missing something relative to static unsigned char lengthtable[] & static struct macro_def wordlist[] ? Am I missing something obvious? It also appears I may have broken other macros such as SEC, LEVEL, and a few others. Did I shift something relative to the lengthtable that might have hosed the program? It's been a while since I have coded much of anything in 'c'. Thanks diff -c --recursive syslog-ng-1.6.10-jeremy/src/macros-gperf.c syslog-ng-1.6.10/src/macros-gperf.c *** syslog-ng-1.6.10-jeremy/src/macros-gperf.c 2006-05-23 21:43:14.000000000 -0500 --- syslog-ng-1.6.10/src/macros-gperf.c 2004-12-13 12:16:14.000000000 -0600 *************** *** 32,38 **** #include "macros.h" struct macro_def { char *name; int id; int len; }; ! #define TOTAL_KEYWORDS 55 #define MIN_WORD_LENGTH 2 #define MAX_WORD_LENGTH 13 #define MIN_HASH_VALUE 2 --- 32,38 ---- #include "macros.h" struct macro_def { char *name; int id; int len; }; ! #define TOTAL_KEYWORDS 53 #define MIN_WORD_LENGTH 2 #define MAX_WORD_LENGTH 13 #define MIN_HASH_VALUE 2 *************** *** 150,157 **** {"R_DATE", M_DATE_RECVD}, {""}, {"PRI", M_PRI}, - {"FAC", M_FAC}, - {"SEV", M_SEV}, {"R_WEEKDAY", M_WEEKDAY_RECVD}, {"S_TZOFFSET", M_TZOFFSET_STAMP}, {"S_DATE", M_DATE_STAMP}, --- 150,155 ---- diff -c --recursive syslog-ng-1.6.10-jeremy/src/macros.c syslog-ng-1.6.10/src/macros.c *** syslog-ng-1.6.10-jeremy/src/macros.c 2006-05-23 22:33:11.000000000 -0500 --- syslog-ng-1.6.10/src/macros.c 2006-02-14 04:05:51.000000000 -0600 *************** *** 192,205 **** length = snprintf(*dest, *left, "%d", msg->pri); break; } - case M_FAC: { - length = snprintf(*dest, *left, "%d", ( msg->pri - ( msg->pri % 8 ) ) / 8 ); - break; - } - case M_SEV: { - length = snprintf(*dest, *left, "%d", ( msg->pri % 8 )) ; - break; - } case M_SOURCE_IP: { char *ip; --- 192,197 ---- *************** *** 456,463 **** { "LEVEL", M_LEVEL }, { "TAG", M_TAG }, { "PRI", M_PRI }, - { "FAC", M_FAC}, - { "SEV", M_SEV}, { "DATE", M_DATE }, { "FULLDATE", M_FULLDATE }, --- 448,453 ---- diff -c --recursive syslog-ng-1.6.10-jeremy/src/macros.gprf syslog-ng-1.6.10/src/macros.gprf *** syslog-ng-1.6.10-jeremy/src/macros.gprf 2006-05-23 21:30:01.000000000 -0500 --- syslog-ng-1.6.10/src/macros.gprf 2004-12-13 12:15:34.000000000 -0600 *************** *** 8,15 **** LEVEL, M_LEVEL TAG, M_TAG PRI, M_PRI - FAC, M_FAC - SEV, M_SEV DATE, M_DATE FULLDATE, M_FULLDATE ISODATE, M_ISODATE --- 8,13 ---- diff -c --recursive syslog-ng-1.6.10-jeremy/src/macros.h syslog-ng-1.6.10/src/macros.h *** syslog-ng-1.6.10-jeremy/src/macros.h 2006-05-23 22:27:04.000000000 -0500 --- syslog-ng-1.6.10/src/macros.h 2004-05-06 02:37:10.000000000 -0500 *************** *** 29,36 **** #define M_LEVEL 10 #define M_TAG 20 #define M_PRI 21 - #define M_FAC 22 - #define M_SEV 23 #define M_DATE 30 #define M_FULLDATE 40 --- 29,34 ---- On Tuesday 23 May 2006 05:06, Balazs Scheidler wrote:
On Mon, 2006-05-22 at 20:11 -0500, Jeremy M. Guthrie wrote:
The issue I have found with Syslog-NG is that it does convert the facility & priority/severity to full names when writing. Today I have Modular Syslog writing facility and severity as individual decimal values rather than the aggregate 0-255 decimal(see the table layout below). I was wondering if someone knew of a way to get Syslog-NG to write out the facility/priority values separately? .ie via the syslog-ng.conf filtering/manipulation kung fu? Or does this look like a modification that I will have to make in the .c code?
It depends on the template that you use, $FACILITY and $LEVEL writes it using names if possible, $TAG is a hexadecimal value for the facility/priority combined, and $PRI is the same in decimal.
There's currently no macro for generating facility/priority separately in numeric form, it is not difficult to add though. An alternative solution would be to convert your tables to the 'enum' data type of mysql, which stores an integer internally, but accepts/shows the string representation.
-- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie@berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711