We help IT Professionals succeed at work.

regex error

Amin El-Zein
Amin El-Zein asked
on
Hello,
I want to log all rysylog I configure and everything is fine.
I create a new template that is:
template(name="stdSQLformat" type="string" option.sql="on" string="insert into SystemEvents (Message, Message2, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%','%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?"--end%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')")
but when I run rsyslog I get:
error during parsing file /etc/rsyslog.d/mysql.conf, on or before line 8: invalid character '"' in object definit
I know that the problem is with
%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?"--end%
but I don't understand what I have to do !
thanks.
Comment
Watch Question

View Solution Only

nociSoftware Engineer
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
if " is the error in here:
%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?"--end%

then try:
%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?\"--end%
(use an escaped ")

or:
%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?--end%
ignore ".
Amin El-Zein

Author

Commented:
Hello,
its not working in any case !
Software Engineer
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
Ok there is more wrong there...
it should be
$template
not template()

(I dont' think SQL server are the right way to log things, but anyway the exampe with rsyslog is this:
$template OurDBLog,"INSERT INTO SystemEvents (Message, Facility, FromHost, Priority, \
DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag, ProcessID) values \
( '%msg%',%syslogfacility%,'%HOSTNAME%',%syslogpriority%,'%timereported:::date-mysql%',\
'%timegenerated:::date-mysql%',%iut%,'%programname%','%procid:R,ERE,0,ZERO:[0-9]+--end%')",SQL


So your needs rework, counting " you need to remove the " i mentioned...  It can be along this: for rsyslog v 8.1911.0

$template stdSQLformat,  "insert into SystemEvents (Message, Message2, Facility, FromHost, Priority, DeviceReportedTime, ReceivedAt, InfoUnitID, SysLogTag) values ('%msg%','%msg:R,ERE,0,DFLT,1:([0-9]+\.){3}[0-9]+[:]?([0-9]+)?--end%', %syslogfacility%, '%HOSTNAME%', %syslogpriority%, '%timereported:::date-mysql%', '%timegenerated:::date-mysql%', %iut%, '%syslogtag%')" ,SQL

Your version may be different: check man rsyslog and example config delivered with rsyslog.
Amin El-Zein

Author

Commented:
noci you perfect I notice that before one  hour of your notice :)
I am trying somting with regex and I will back to you ..
hope if you can help me with this : https://www.experts-exchange.com/questions/29169699/regex-syntax.html ;)
many thanks for your support.