[rsyslog] Double quotes Problem

[david at lang.hm]

On Tue, 3 Mar 2009, Daniel Anson wrote:

> Does anyone know of a quick and easy template to remove the double quote
> character from a %msg% before it is inserted into the database (MySQL in
> my case).  I have a %msg% that looks like this:
>
> user pid=21214 uid=0 auid=4294967295 msg='PAM setcred: user="oracle"
> exe="/bin/su" (hostname=?, addr=?, terminal=? result=Success)'
>
> I am reading the %msg% from the MySQL database and returning it in JSON
> formatting.  When it encounters a double-quote character, it causes
> issues.  I can always fix the program that returns it in JSON, but I
> think rsyslog can pre-fix the %msg%.

you will need to change the mySQL template in rsyslog

I think you have two options.

1. you can put any valid SQL in the rsyslog config that does the insert, 
so write SQL that eliminates the quote

2. I think you can change the template to remove the quotes before sending 
it to MySQL (but this may end up removing quotes needed for MySQL to work)

David Lang