pmnull: Syslog Null Parser Module

Module Name: pmnull
Author: Rainer Gerhards <rgerhards@adiscon.com>

Purpose

When a message is received it is tried to match a set of parsers to get properties populated. This parser module sets all attributes to “” but rawmsg. There usually should be no need to use this module. It may be useful to process certain known-not-syslog messages.

Configuration Parameters

Note

Parameter names are case-insensitive.

Parser Parameters

Tag

type default mandatory obsolete legacy directive
string   no none

This setting sets the tag value to the message.

SyslogFacility

type default mandatory obsolete legacy directive
Facility 1 no none

This setting sets the syslog facility value. The default comes from the rfc3164 standard.

SyslogSeverity

type default mandatory obsolete legacy directive
Severity 5 no none

This setting sets the syslog severity value. The default comes from the rfc3164 standard.

Examples

Process messages received via imtcp

In this example messages are received through imtcp on port 13514. The ruleset uses the parser pmnull which has the parameters tag, syslogfacility and syslogseverity given.

module(load="imtcp")
module(load="pmnull")

input(type="imtcp" port="13514" ruleset="ruleset")
parser(name="custom.pmnull" type="pmnull" tag="mytag" syslogfacility="3"
      syslogseverity="1")

ruleset(name="ruleset" parser=["custom.pmnull", "rsyslog.pmnull"]) {
     action(type="omfile" file="rsyslog.out.log")
}

Process messages with default parameters

In this example the ruleset uses the parser pmnull with the default parameters because no specifics were given.

module(load="imtcp")
module(load="pmnull")

input(type="imtcp" port="13514" ruleset="ruleset")
parser(name="custom.pmnull" type="pmnull")

ruleset(name="ruleset" parser="custom.pmnull") {
     action(type="omfile" file="rsyslog.out.log")
}

See also

Help with configuring/using Rsyslog:

  • Mailing list - best route for general questions
  • GitHub: rsyslog source project - detailed questions, reporting issues that are believed to be bugs with Rsyslog
  • Stack Exchange (View, Ask) - experimental support from rsyslog community

See also

Contributing to Rsyslog: