Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: RSyslog: users
Re: rawmessage forwarding doesn't appear to work
 

Index | Next | Previous | View Flat


rgerhards at hq

Apr 19, 2012, 10:34 PM


Views: 527
Permalink
Re: rawmessage forwarding doesn't appear to work [In reply to]

> -----Original Message-----
> From: rsyslog-bounces [at] lists [mailto:rsyslog-
> bounces [at] lists] On Behalf Of Jo Rhett
> Sent: Friday, April 20, 2012 2:53 AM
> To: rsyslog-users
> Subject: [rsyslog] rawmessage forwarding doesn't appear to work
>
> I've been debugging this all day, and I'm not sure what's wrong yet
> (got some pcaps I'm staring at) but raw message forwarding as
> documented doesn't work. First, as documented on
> http://www.rsyslog.com/doc/omudpspoof.html
>
> $ModLoad omudpspoof
> $template spooftemplate,"%rawmsg%"
> $ActionUDPSpoofTargetHost server.example.com
> *.* :omudpspoof:;spooftemplate
>
> This doesn't work with 5.8. So revised as:
>
> $ModLoad omudpspoof
> $template spooftemplate,"%rawmsg%"
> $ActionOMUDPSpoofTargetHost server.example.com
> *.* :omudpspoof:;spooftemplate

Thanks - the doc was incorrect. I just fixed it (inside git so far).
>
> This works and sends the packet, but the remote server doesn't like the
> packet. I've gotten it to work with just "%msg%" and a few other
> formats, but sending the entire original message doesn't appear to
> work.
>
> Some clarity might be helpful: is rsyslog breaking the message down and
> rebuilding it? If so, is rawmessage likely to be producing a
> pregnant/bundled message?

In theory, the message is processed, but if you use just the rawmsg property,
this *is* the raw message exactly as it was received. So the message is not
altered in that case.

Rainer
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards

Subject User Time
rawmessage forwarding doesn't appear to work jrhett at netconsonance Apr 19, 2012, 5:52 PM
    Re: rawmessage forwarding doesn't appear to work david at lang Apr 19, 2012, 6:07 PM
        Re: rawmessage forwarding doesn't appear to work rgerhards at hq Apr 19, 2012, 10:36 PM
    Re: rawmessage forwarding doesn't appear to work rgerhards at hq Apr 19, 2012, 10:34 PM
    Re: rawmessage forwarding doesn't appear to work david at lang Apr 19, 2012, 11:37 PM
    Re: rawmessage forwarding doesn't appear to work rgerhards at hq Apr 20, 2012, 12:33 AM
        Re: rawmessage forwarding doesn't appear to work david at lang Apr 20, 2012, 7:52 AM
            Re: rawmessage forwarding doesn't appear to work rgerhards at hq Apr 20, 2012, 9:58 AM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.