MonitorWare Knowledge Base

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

rgerhards wrote:Well, I doubt it works, but why not give it a try? Please report the results back. In any case, that is not a really clean solution. I think this thread has a lot of information why it is not.

rgerhards wrote:oh, and one thing: This can not be included in the official build, at least not without configuration (which is far more trivial) because it would break valid implementations in favor of the invalid NetScreen implementation. Definitely not something I'd like to do.

arv wrote:

rgerhards wrote:oh, and one thing: This can not be included in the official build, at least not without configuration (which is far more trivial) because it would break valid implementations in favor of the invalid NetScreen implementation. Definitely not something I'd like to do.

I perfectly undestand that. However I wonder why '\n' is valid .

rsyslog manual wrote:$InputTCPServerAddtlFrameDelimiter <Delimiter>
This directive permits to specify an additional frame delimiter for plain tcp syslog.
The industry-standard specifies using the LF character as frame delimiter. Some vendors,
notable Juniper in their NetScreen products, use an invalid frame delimiter, in Juniper's
case the NUL character. This directive permits to specify the ASCII value of the delimiter
in question. Please note that this does not guarantee that all wrong implementations can
be cured with this directive. It is not even a sure fix with all versions of NetScreen,
as I suggest the NUL character is the effect of a (common) coding error and thus will
probably go away at some time in the future. But for the time being, the value 0 can
probably be used to make rsyslog handle NetScreen's invalid syslog/tcp framing.

If this doesn't work for you, please do not blame the rsyslog team. Instead file
a bug report with Juniper!

$ModLoad immark.so
$ModLoad imuxsock.so
$ModLoad imklog.so
$ModLoad ommysql.so
$ModLoad imtcp.so
$ModLoad imfile.so

$MarkMessagePeriod 43200

$ActionOmmysqlServerPort 5151

$template format-syslog-ng,"INSERT INTO loguri_%fromhost% (host, facility, priority, tag, date, time, program, message) VALUES ('%fromhost%', '%syslogfacility-text%', '%syslogseverity-text%', '%syslogtag%', '%timereported:::date-mysql%', '%timereported:::date-mysql%', '%programname%', '%msg%')", sql

$InputFileName /var/log/audit/audit.log
$InputFileTag auditd:
$InputFileStateFile audit_log
$InputFileSeverity alert
$InputFileFacility kern
$InputRunFileMonitor
$InputFileName /var/log/bash_history/root_history
$InputFileTag root_bash:
$InputFileStateFile root_bash_log
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFileName /var/log/bash_history/user1_history
$InputFileTag user1_bash:
$InputFileStateFile user1_bash_log
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFileName /var/log/bash_history/user2_history
$InputFileTag user2_bash:
$InputFileStateFile user2_bash_log
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFileName /var/log/bash_history/user3_history
$InputFileTag user3_bash:
$InputFileStateFile user3_bash_log
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFileName /var/log/bash_history/user4_history
$InputFileTag user4_bash:
$InputFileStateFile user4_bash_log
$InputFileSeverity notice
$InputFileFacility user
$InputRunFileMonitor
$InputFilePollInterval 10

$WorkDirectory /var/spool/rsyslog
$ActionQueueType LinkedList
$ActionQueueFileName dbq
$ActionResumeRetryCount -1

local7.* /var/log/boot.log;RSYSLOG_FileFormat
mail.* -/var/log/mail/current;RSYSLOG_FileFormat

*.*;mail,news.none >127.0.0.1,rsyslog_db,rsyslog_user,rsyslog_user_pass;format-syslog-ng
*.*;mail,news,cron,local7.none;local6.!info -/var/log/everything/current

$DefaultNetstreamDriver ptcp
$InputTCPServerStreamDriverMode 0
$InputTCPServerStreamDriverAuthMode anon
$InputTCPServerAddtlFrameDelimiter NUL
$InputTCPServerRun 514
$AllowedSender TCP, IP1, IP2, IP3, ... , IP15

I think symbolic names are not supported, so use
$InputTCPServerAddtlFrameDelimiter 0

(2009-06-23 13:46:54)#000<133>fw1.border: NetScreen device_id=fw1.border [Root]system-notification-00531: The system clock was updated from primary NTP server type AAA.BBB.CCC.DDD with an adjustment of 917 ms. Authentication was None. Update mode was Automatic (2009-06-23 13:56:55)#000<133>fw1.border: NetScreen device_id=fw1.border [Root]system-notification-00531: The system clock was updated from primary NTP server type AAA.BBB.CCC.DDD with an adjustment of -78 ms. Authentication was None. Update mode was Automatic

rgerhards wrote:yes