Red Hat Bugzilla – Bug 485937
expression-based filters do not seem to work properly
Last modified: 2016-09-20 00:49:09 EDT
Description of problem:
I am trying to port a syslog-ng configuration to rsyslog.
I believe, however, that there are bugs in the filter expression evaluator
in rsyslog that makes it impossible to port the configuration successfully.
I opened a discussion thread on this in rsyslog forum here:
Version-Release number of selected component (if applicable):
Install rsyslog.conf including a section like this:
$template CronFormat,"%timereported% %HOSTNAME% %syslogtag% [cronrule %syslogseverity-text% %syslogseverity%]%msg:::sp-if-no-1st-sp%%msg%\n"
if ($syslogfacility-text == 'cron') and ($syslogseverity <= 4) \
Run rsyslog and note that you get entries like this:
bash-3.2$ cat /var/log/bug
Feb 17 10:50:01 ti82 CROND: [cronrule info 6] (root) CMD (/usr/lib/sa/sa1 -d 1 1)
This entry should not be there, since the severity (6) is not <= 4.
Steps to Reproduce:
1. Install /etc/rsyslog.conf with a filter expression similar to above
2. Run rsyslog
3. Observe that it does not filter properly.
Incorrect entries in /var/log/bug
The /var/log/bug file should be empty in the normal case (for info messages
about jobs that cron is running).
There's a bug in the expression processing that breaks variables' conversion.
A current workaround is to use something like
($syslogseverity <= '4')
($syslogseverity <= 4)
This should soon be fixed in an updated package.
Thanks for the report.
rsyslog-3.21.10-2.fc10 has been submitted as an update for Fedora 10.
rsyslog-3.21.10-2.fc10 has been pushed to the Fedora 10 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update rsyslog'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-3190
rsyslog-3.21.10-2.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.