Log Message Normalization Module

Module Name:    mmnormalize

Available since: 6.1.2+

Author: Rainer Gerhards <rgerhards@adiscon.com>

Description:

This module provides the capability to normalize log messages via liblognorm. Thanks to libee, unstructured text, like usually found in log messages, can very quickly be parsed and put into a normal form. This is done so quickly, that it usually should be possible to normalize events in realtime.

This module is implemented via the output module interface. That means that mmnormalize should be called just like an action. After it has been called, the normalized message properties are avaialable and can be access. These properties are called the "CEE" properties, because liblognorm creates a format that is inspired by the CEE approach.

Note that mmnormalize should only be called once on each message. Behaviour is undifined if multiple calls to mmnormalize happen for the same message.

Configuration Directives:

• $mmnormalizeRuleBase <rulebase-file>
  Specifies which rulebase file is to use. This file is loaded. If there are multiple mmnormalize instances, each one can use a different file. However, a single instance can use only a single file. This parameter MUST be given, because normalization can only happen based on a rulebase.
• $mmnormalizeUseRawMsg <on/off>
  Specifies if the raw message should be used for normalization (on) or just the MSG part of the message (off). Default is "off".

None known at this time.

Sample:

This activates the module and applies normalization to all messages:

[rsyslog.conf overview] [manual index] [rsyslog site]

This documentation is part of the rsyslog project.
Copyright © 2010 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 3 or higher.