[rsyslog] Some list templates with mmjsonparse try to get 2GB of RAM or give OOM

Rainer Gerhards rgerhards at hq.adiscon.com
Tue Jan 8 12:39:21 CET 2013


> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Radu Gheorghe
> Sent: Monday, January 07, 2013 3:47 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] Some list templates with mmjsonparse try to get
> 2GB of RAM or give OOM
> Wow, that was fast! Thanks, Rainer!
> Regarding the related questions:
> - please let me know if there's any issue with using $!all-json. I
> would
> need to use it to handle with CEE-enhanced and "regular" logs with the
> same
> template - and output a JSON. Something like:
> template(name="testTemplate"
>          type="list") {
>            constant(value="{")
>            constant(value="\"@timestamp\":\"")
>            property(name="timereported" dateFormat="rfc3339")
>            constant(value="\",")
>            property(name="$!all-json" position.from="2")
>          }
> I can work around that with 2 templates and %parsesuccess%, but I find
> the
> solution above much nicer.

What do you expect to see with non-JSON messages? All-json being "{}" or the message content (e.g. for a startup message, it would be

"{ "msg": "[origin software=\"rsyslogd\" swVersion=\"7.2.4\" x-pid=\"2705\" x-info=\"http:\/\/www.rsyslog.com\"] start" }"

I ask because the latter is the case, and I think this has been introduced as part of the lumberjack effort within the last three to six month.


More information about the rsyslog mailing list