What are the special character in file name Ubuntu rsyslog while receiving logs from Zscaler? - rsyslog

I have configured Zscaler NSS log forward to send logs on Linux server which is using ubuntu rsyslog service, I am able to receive logs, however, file name which getting generated it's with Special character, which is causing an issue to copy via script. Below is nss.conf file created under /etc/rsyslog.d/nss.conf
template(name="TmplMsg" type="list") {
constant(value="/rsys/log/client_logs/")
property(name="hostname")
constant(value="/")
property(name="programname" SecurePath="replace")
constant(value=".log")
}
template(name="TmplAuth" type="list") {
constant(value="/rsys/log/client_logs/")
property(name="hostname")
constant(value="/")
property(name="programname" SecurePath="replace")
constant(value=".log")
}
authpriv.* ?TmplAuth
*.info;mail.none;authpriv.none;cron.none ?TmplMsg

According to the templates doc, as well as securepath="replace", which replaces "/" in the property by "_", you can also use controlcharacters=. This can have one of 3 values:
"escape" to replace non-printing characters by #ddd (3 digit decimal value),
"drop" to remove them
or "space" to replace them by a space.

Related

TOMCAT: quote < ' > in CATALINA_HOME environment variable causing load error?

I'm trying to install tomcat as a service using service.bat in the following path :
C:\Program Files\text with' quote\Tomcat
but I keep getting the following error :
java.io.FileNotFoundException: C:\Program Files\text with quote\Tomcat\conf\logging.properties; (The system cannot find the path specified)
as you can see from the error message the ' is being ignored and thus keeping some files from being found/loaded properly.
If I switch to a path without a quote, everything works well. Is there a way around this as I need to include a ' in the path?
Your problem comes from the way Procrun parses its command line parameters. In those parameters which accept lists of values (++DependsOn, ++Environment, ++JvmOptions, ++JvmOptions9, ++StartParams and ++StopParams) single quotes ' are stripped after the parameter value has been split into single values. There is no way to quote them (cf. source code).
Therefore the ++JvmOptions parameter used in service.bat is interpreted as follows (one value per line):
-Dcatalina.home=C:\Scarlett oHara;-Dcatalina.base=C:\Scarlett oHara
-Dignore.endorsed.dirs=C:\Scarlett oHara\endorsed;-Djava.io.tmpdir=C:\Scarlett oHara\temp
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.util.logging.config.file=C:\Scarlett oHara\conf\logging.properties;
You might notice that some entries are joined by ;, due to the ' unintentional quoting.
The only way to fix this is to start Prunmgr (the executable renamed as tomcat*w.exe) and fix them in the "Java" tab:
-Dcatalina.home=C:\Scarlett o'Hara
-Dcatalina.base=C:\Scarlett o'Hara
-Dignore.endorsed.dirs=C:\Scarlett o'Hara\endorsed
-Djava.io.tmpdir=C:\Scarlett o'Hara\temp
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.util.logging.config.file=C:\Scarlett o'Hara\conf\logging.properties;
or work directly on the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0 registry keys.
See also:
a similar problem due to quoting: Adding multiple values to an environment in registry and retrieving in Java application

Bash script to run through multiple log files and extract client IP from which URL was accessed

I want to create a bash script, that will run through multiple log files and print out client IP addresses, from which certain URL was accessed (for example https://test123.com). Every log file has content like:
"client_ip":"192.168.100.100"
I know that I need a loop, and I found way to extract any IP address using grep:
grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' $log1.txt
My question is how I can extract exactly this IP, which comes after "client_ip", and from which certain URL was accessed?
Also, string "client_ip":"192.168.100.100" is in the same line as requested URL. So, I need to extract line at the begin where my URL shows up and then extract from that line IP address, which comes after "client_ip".
I am not so familiar with bash.
Could anyone help with that?

Reading valid rsyslog configurations from /etc/rsyslog.d/project.conf drops syntax errors?

I have a few lines of configurations that I need in my rsyslgog.
if $programname == 'project' then /var/log/file.log
When added to the end of the main rsyslog configuration file, /etc/rsyslog.conf, this configuration appears to be valid and functional.
However, when using the rsyslog.d directory I get a syntax error.
error during parsing file /etc/rsyslog.d/project.conf, on or before line 2: syntax error on token '==' [v8.32.0 try http://www.rsyslog.com/e/2207 ]
Is there anything in the main config that has to be parsed in advance, or is this a bug that should be reported to Fedora 27 developers?
As rsyslog author, I would assume that there is some include right in front of it that somehow renders your (valid) construct invalid. Red Hat unfortunately tends to stick to obsolete legacy format, and things like these can easily happen when this is used (after all, this was why we obsoleted it).
To hunt this down, I would check the config include that is included immediately in front of your own. If included via wildcards, the include order is sorted by filename.
Sorry, it was my bad. The configuration for my rsyslog config file was rewritten by my installer bash script, and that interpreted the $ sign as variable within the string. I should have double-checked the correctness of my config file.

Unity: Open local file containing a space for windows

I have tried unsuccessfully to open image file that it's name contains a space.
I use the following call:
WWW www = new WWW(url);
where:
url = "C:\Users\user\Documents\Files\Thumbnails\sample image.png";
A red question mark appears instead of image.
Also a 404 error appears when print www.error.
If I use another .png file without space (sampleimage.png), it works perfectly. On Windows and Editor it works nice too.
So I tried to replace the space with %20 but an error "can't load the file" appears.
I have also tried WWW.EscapeURL applied on the filename ... but nothing works.
Try to use verbatim string along with file:// prefix:
string filePrefix = #"file://";
string url = #"C:\Users\user\Documents\Files\Thumbnails\sample image.png";

How to get newlines in classpath for JMSProvider using wsadmin

I want to create a JMSProvider object with a custom classpath. Here's how I'm doing it in jython:
...
classpath = "a.jar:b.jar:c.jar".replace(":", "\n")
properties = [
['name', name],
['description', description],
['classpath', classpath],
['externalInitialContextFactory', externalInitialContextFactory],
['externalProviderURL', externalProviderURL],
['nativepath',[]],
['supportsASF','true']
]
AdminConfig.create('JMSProvider', node, properties)
AdminConfig.save()
The JMSProvider is created, but the classpath variable has the newlines escaped:
a.jar\nb.jar\nc.jar
How can I tell wsadmin to not escape the newlines?
Whilst the WAS admin console (the web page) requires you to enter the classpath with newlines, the wsadmin tool requires that it be separated by the host O/S file separator. So there is no need to modify the input string at all.
classpath = "a.jar;b.jar;c.jar"
Will work just fine.
"\n" is a real newline.
Compare repr(classpath) immediately after classpath.replace() with the repr(classpath) that JMSProvider sees they should be the same.

Resources