[rsyslog] Some list templates with mmjsonparse try to get 2GB of RAM or give OOM

Radu Gheorghe radu0gheorghe at gmail.com
Tue Jan 8 12:43:25 CET 2013


2013/1/8 Rainer Gerhards <rgerhards at hq.adiscon.com>

> Radu,
>
> > -----Original Message-----
> > From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> > bounces at lists.adiscon.com] On Behalf Of Radu Gheorghe
> > Sent: Monday, January 07, 2013 3:47 PM
> > To: rsyslog-users
> > Subject: Re: [rsyslog] Some list templates with mmjsonparse try to get
> > 2GB of RAM or give OOM
> >
> > Wow, that was fast! Thanks, Rainer!
> >
> > Regarding the related questions:
> > - please let me know if there's any issue with using $!all-json. I
> > would
> > need to use it to handle with CEE-enhanced and "regular" logs with the
> > same
> > template - and output a JSON. Something like:
> >
> > template(name="testTemplate"
> >          type="list") {
> >            constant(value="{")
> >            constant(value="\"@timestamp\":\"")
> >            property(name="timereported" dateFormat="rfc3339")
> >            constant(value="\",")
> >            property(name="$!all-json" position.from="2")
> >          }
> >
> > I can work around that with 2 templates and %parsesuccess%, but I find
> > the
> > solution above much nicer.
>
>
> What do you expect to see with non-JSON messages? All-json being "{}" or
> the message content (e.g. for a startup message, it would be
>
> "{ "msg": "[origin software=\"rsyslogd\" swVersion=\"7.2.4\"
> x-pid=\"2705\" x-info=\"http:\/\/www.rsyslog.com\"] start" }"
>
> I ask because the latter is the case, and I think this has been introduced
> as part of the lumberjack effort within the last three to six month.
>
>
I'm expecting the message content as JSON. Which is supercool :) because I
can treat non-JSON messages as if they were JSON with just the field "msg".

Best regards,
Radu


More information about the rsyslog mailing list