On Sat, March 14, 2015 5:55 pm, Shawn Heisey wrote:
On 3/14/2015 5:35 PM, J.C. Cleaver wrote:
That would help, however it would also cause items that had gotten
URL-encoded to potentially be missed in analysis.d LOG regex's (which
don't URL-unencode).
Given that this is a display issue more than anything else, it might be
better handled as we're creating the status message from xymond_client.
This leaves the raw log message still available, while still protecting
the display from getting interpreted this way.
Yes, this should definitely be a display-only conversion. The logs
should be unchanged from what the client sends when they are being
analyzed for potential alarms.
That is a perfect segue into another problem I noticed. The first
character on all my log lines for this logfile is [, a left square
bracket. That is being replaced with a . (period) character. In the
email alarm, every line starts like this:
&red .2015-03-13 23:16:43.386125]
This, unfortunately, is not a display issue but a necessity to prevent
corrupted messages.
The "client" message uses [bracketed] sections as delimiters, so logfetch
does this intentionally to prevent initial lines with brackets from
confusing downstream parsers.
Regards,
-jc