On Sat, March 14, 2015 5:55 pm, Shawn Heisey wrote:
On 3/14/2015 5:35 PM, J.C. Cleaver wrote:
That would help, however it would also cause items that had gotten URL-encoded to potentially be missed in analysis.d LOG regex's (which don't URL-unencode).
Given that this is a display issue more than anything else, it might be better handled as we're creating the status message from xymond_client. This leaves the raw log message still available, while still protecting the display from getting interpreted this way.
Yes, this should definitely be a display-only conversion. The logs should be unchanged from what the client sends when they are being analyzed for potential alarms.
That is a perfect segue into another problem I noticed. The first character on all my log lines for this logfile is [, a left square bracket. That is being replaced with a . (period) character. In the email alarm, every line starts like this:
&red .2015-03-13 23:16:43.386125]
This, unfortunately, is not a display issue but a necessity to prevent corrupted messages.
The "client" message uses [bracketed] sections as delimiters, so logfetch does this intentionally to prevent initial lines with brackets from confusing downstream parsers.
Regards,
-jc