sysevent plugin¶

This plugin utilizes a network socket to listen for incoming rsyslog messages.

While running, two threads are used:

1. The main read thread, to read semaphore-protected shared memory.
2. A blocking listening thread that waits for rsyslog messages on a socket and writes them to shared memory (a ring buffer).

The listening thread waits for incoming messages and writes them into the ring buffer. All messages are stored. The read thread then wakes at plugin interval and steps through new messages in the ring buffer. What happens next depends on configuration and message content:

1. The plugin will try to parse the whole message as JSON data. If the parsing succeeds, the plugin breaks the message into its constituent elements for filtering and dispatching.
2. If any RegexFilters are configured, the "message" portion of the message must match at least one of these filters. The "message" portion is only available if JSON parsing succeeded in step 1. If JSON parsing failed, the whole of the message content is considered for filtering purposes.
3. Using data available from the message (individual key/value pairs of data, if JSON parsing succeeded), a notification is constructed and dispatched.

Synopsis¶

 <Plugin sysevent>
    Listen "192.168.0.2" "6666"
    BufferSize 1024
    BufferLength 10
    RegexFilter "regex"
  </Plugin>

Parameters¶

Example Graph¶

None yet. Add one now!

Dependencies¶

• libjaql

Caveats¶

History¶

• Plugin that monitors rsyslog for system events added in 5.10.

See also¶

• High level design doc
• Pull request: #2624

Configuration¶

<Plugin sysevent>
  Listen "192.168.0.2" "6666"
  BufferSize 1024
  BufferLength 10
  RegexFilter "regex"
</Plugin>

rsyslog should be configured such that it sends data to the IP and port you
include in the plugin configuration.  For example, given the configuration
above, something like this would be set in /etc/rsyslog.conf:

if $programname != 'collectd' then
*.* @192.168.0.2:6666

This plugin is designed to consume JSON rsyslog data, so a more complete
rsyslog configuration would look like so (where we define a JSON template
and use it when sending data to our IP and port):

$template ls_json,"{%timestamp:::date-rfc3339,jsonf:@timestamp%, \
%source:::jsonf:@source_host%,\"@source\":\"syslog://%fromhost-ip:::json%\", \
\"@message\":\"%timestamp% %app-name%:%msg:::json%\",\"@fields\": \
{%syslogfacility-text:::jsonf:facility%,%syslogseverity:::jsonf:severity-num%, \
%syslogseverity-text:::jsonf:severity%,%programname:::jsonf:program%, \
%procid:::jsonf:processid%}}"

if $programname != 'collectd' then
*.* @192.168.0.2:6666;ls_json

Please note that these rsyslog.conf examples are *not* complete, as rsyslog
requires more than these options in the configuration file.  These examples
are meant to demonstration the proper remote logging and JSON format syntax.