Wednesday, November 16, 2011

log annotation with liblognorm

I have recently written about the concept of event (log) annotation and liblognorm. During the past days I have made my mind up and have begun implementing some stuff today. In essence, rule bases will receive a new rule type "annotate", which contains the annotation part. Here is a sample from my lab environment:
rule=logon:<%-:number%>1 %timestamp:date-rfc5424% %src-id:word% ...
annotate=logon:+action="login"

Note the text in red. This is a liblognorm tag (not to confuse with a CEE tag!). This rule base tells the normalizer to append, according to the target format, the fields that are given in the annotate statement to any events that have the tag in question ("logon" in our case).

Today, I am extending the rule base parser to support the annotate rule. Within the next days, I'll update the rest of the system. When this is done, I'll probably release that version so that you can try out the new functionality in your own environment.

No comments:

Introducing new team member

Good news: we have some new folks working on the rsyslog project. In a small mini-series of two blog postings I'd like to introduce the...