-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, After I upgraded to 15.3 my main machine, I see excesive verbose entries, probably debug entries, in the warning log. I want to filter them out. These are the entries I'm starting with: <3.4> 2022-01-23T22:56:02.171332+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:2: Unknown key name '_Name' in section 'Desktop Entry', ignoring. <3.4> 2022-01-23T22:56:02.171482+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:3: Unknown key name '_GenericName' in section 'Desktop Entry', ignoring. <3.4> 2022-01-23T22:56:02.171539+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:4: Unknown key name '_Comment' in section 'Desktop Entry', ignoring. <3.4> 2022-01-23T22:56:02.171911+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - Configuration file /etc/xdg/autostart/klipper.desktop is marked executable. Please remove executable permission bits. Proceeding anyway. <3.4> 2022-01-23T22:56:02.175609+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - Not generating service for XDG autostart app-xapp\x2dsn\x2dwatcher-autostart.service, error parsing Exec= line: No such file or directory So, I create this filter in /etc/rsyslog.conf: #debugging. if $syslogfacility == 3 and $syslogseverity == 4 and $programname == 'systemd-xdg-autostart-generator' \ then -/var/log/pruned.warn & stop This does work. So indeed it is facility number 3, severity 4, and the programname is correct. But I want to be more strict, and I write this modified filter: #debugging. if $syslogfacility == 3 and $syslogseverity == 4 and $programname == 'systemd-xdg-autostart-generator' \ and ($msg startswith '/etc/xdg/autostart/ibus-autostart.desktop') \ then -/var/log/pruned.warn & stop This does not trigger on the line below, it continues being written to /var/log/warn and not to /var/log/pruned.warn: <3.4> 2022-01-23T22:56:02.171539+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:4: Unknown key name '_Comment' in section 'Desktop Entry', ignoring. To me, it is obvious that the message is indeed starting with '/etc/xdg/autostart/ibus-autostart.desktop', so why doesn't it work? What am I missing? If instead I write: #debugging. if $syslogfacility == 3 and $syslogseverity == 4 and $programname == 'systemd-xdg-autostart-generator' \ and ($msg contains '/etc/xdg/autostart/ibus-autostart.desktop') \ then -/var/log/pruned.warn & stop It does work. :-? - -- Cheers Carlos E. R. (from 15.3 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCYe3Utxwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfV9poAoIVGyjmglAYSdJbvH9iY uVTtDdfRAJ9w61MkYIzgx3iShQDEJbvJVNCWcQ== =Muo/ -----END PGP SIGNATURE-----
On 2022-01-23 17:20:36 Bengt Gördén wrote:
|On 2022-01-23 23:20, Carlos E. R. wrote: |> $msg startswith '/etc/xdg/autostart/ibus-autostart.desktop' | |Have you tried putting a space in front? | |Like so: |$msg startswith ' /etc/xdg/autostart/ibus-autostart.desktop'
Or maybe for some reason the whitespace character before /etc is not an actual space? Leslie -- Platform: Linux Distribution: openSUSE Leap 15.3 x86_64
On 24/01/2022 01.25, J Leslie Turriff wrote:
On 2022-01-23 17:20:36 Bengt Gördén wrote:
|On 2022-01-23 23:20, Carlos E. R. wrote: |> $msg startswith '/etc/xdg/autostart/ibus-autostart.desktop' | |Have you tried putting a space in front? | |Like so: |$msg startswith ' /etc/xdg/autostart/ibus-autostart.desktop'
Or maybe for some reason the whitespace character before /etc is not an actual space?
Well, I just copypasted from the log that "space", so I will see in a few minutes what happens. [...] Bingo! A space it is. Call me surprised. :-o Bug? Feature? Of course, another question is why debug messages are sent to syslog at warning level, not debug level :-/ Each year, I have to purge new message strings. -- Cheers / Saludos, Carlos E. R. (from 15.3 x86_64 at Telcontar)
Carlos E. R. wrote:
Bingo! A space it is. Call me surprised. :-o Bug? Feature?
Neither - looking at what you posted, that logline begins with a blank.
Of course, another question is why debug messages are sent to syslog at warning level, not debug level :-/
They don't look like debug messages to me. -- Per Jessen, Zürich (0.7°C)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Monday, 2022-01-24 at 08:25 +0100, Per Jessen wrote:
Carlos E. R. wrote:
Bingo! A space it is. Call me surprised. :-o Bug? Feature?
Neither - looking at what you posted, that logline begins with a blank.
How so? How do you know? They all have two spaces after the - - <3.4> 2022-01-22T12:17:30.512415+01:00 Telcontar systemd 1 - - vmware.service: Failed with result 'exit-code'. <3.3> 2022-01-22T12:17:30.512567+01:00 Telcontar systemd 1 - - Failed to start LSB: This service starts and stops VMware services. <3.3> 2022-01-22T12:17:30.548483+01:00 Telcontar VMware init - - /usr/sbin/vmware-authdlauncher: error while loading shared libraries: libssl.so.1.0.2: cannot open shared object file: No such file or directory <3.4> 2022-01-22T12:17:30.591539+01:00 Telcontar dnsmasq 4038 - - ignoring nameserver 127.0.0.1 - local interface <3.3> 2022-01-22T12:17:30.612912+01:00 Telcontar smbd 4042 - - [2022/01/22 12:17:30.607390, 0] ../../lib/util/become_daemon.c:153(daemon_ready) <3.3> 2022-01-22T12:17:30.613049+01:00 Telcontar smbd 4042 - - daemon_ready: daemon 'smbd' finished starting up and ready to serve connections <3.4> 2022-01-22T12:17:30.625371+01:00 Telcontar rpc.statd 4095 - - Flags: TI-RPC <3.4> 2022-01-22T12:17:30.822263+01:00 Telcontar systemd-xdg-autostart-generator 4151 - - /etc/xdg/autostart/ibus-autostart.desktop:2: Unknown key name '_Name' in section 'Desktop Entry', ignoring. <3.4> 2022-01-22T12:17:30.822342+01:00 Telcontar systemd-xdg-autostart-generator 4151 - - /etc/xdg/autostart/ibus-autostart.desktop:3: Unknown key name '_GenericName' in section 'Desktop Entry', ignoring. <3.4> 2022-01-22T12:17:30.822376+01:00 Telcontar systemd-xdg-autostart-generator 4151 - - /etc/xdg/autostart/ibus-autostart.desktop:4: Unknown key name '_Comment' in section 'Desktop Entry', ignoring. <3.4> 2022-01-22T12:17:30.824714+01:00 Telcontar systemd-xdg-autostart-generator 4151 - - Configuration file /etc/xdg/autostart/klipper.desktop is marked executable. Please remove executable permission bits. Proceeding anyway. <3.4> 2022-01-22T12:17:30.848048+01:00 Telcontar systemd-xdg-autostart-generator 4151 - - Not generating service for XDG autostart app-xapp\x2dsn\x2dwatcher-autostart.service, error parsing Exec= line: No such file or directory
Of course, another question is why debug messages are sent to syslog at warning level, not debug level :-/
They don't look like debug messages to me.
I don't see the urgent, crucial, terribly inportant importance of those messages, repeated every minute, spamming the warning log so that I can not see the really important messages about which I can do something. - -- Cheers, Carlos E. R. (from openSUSE 15.3 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCYe6Cbhwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVLYIAnRECNg/GblzqIXyYLP9x Zodd4f+cAJ0UdpGxZBPW1RSdCF7YqzMIaIIfNg== =F0T2 -----END PGP SIGNATURE-----
Carlos E. R. wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Monday, 2022-01-24 at 08:25 +0100, Per Jessen wrote:
Carlos E. R. wrote:
Bingo! A space it is. Call me surprised. :-o Bug? Feature?
Neither - looking at what you posted, that logline begins with a blank.
How so? How do you know?
I don't know if the line was folded or not, but in your post, there was a blank in front of '/etc/xdg' : <3.4> 2022-01-23T22:56:02.171332+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:2: Unknown key name '_Name' in section 'Desktop Entry', ignoring. <3.4> 2022-01-23T22:56:02.171482+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:3: Unknown key name '_GenericName' in section 'Desktop Entry', ignoring. <3.4> 2022-01-23T22:56:02.171539+01:00 Telcontar systemd-xdg-autostart-generator 28650 - - /etc/xdg/autostart/ibus-autostart.desktop:4: Unknown key name '_Comment' in section 'Desktop Entry', ignoring. I'll send a screenshot to you directly.
Of course, another question is why debug messages are sent to syslog at warning level, not debug level :-/
They don't look like debug messages to me.
I don't see the urgent, crucial, terribly inportant importance of those messages, repeated every minute, spamming the warning log so that I can not see the really important messages about which I can do something.
Maybe they are not urgent or crucial or terribly important, they look like warnings about something that isn't right. -- Per Jessen, Zürich (2.1°C)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Monday, 2022-01-24 at 11:52 +0100, Per Jessen wrote:
Carlos E. R. wrote:
On Monday, 2022-01-24 at 08:25 +0100, Per Jessen wrote:
Carlos E. R. wrote:
Bingo! A space it is. Call me surprised. :-o Bug? Feature?
Neither - looking at what you posted, that logline begins with a blank.
How so? How do you know?
I don't know if the line was folded or not, but in your post, there was a blank in front of '/etc/xdg' :
There are two spaces betweedn the "'- -" and the string, on absolutely every log entry, every log. The examples at the rfc linked by Bengt, have one. And most start with 'BOM'. Example from my log, edited to avoid line wrap: Telcontar ...-generator 28650 - - /etc/xdg/au... ..2 spaces.......................^^
I'll send a screenshot to you directly.
Ok. [...] When I sent them, there was no line wrap.
Of course, another question is why debug messages are sent to syslog at warning level, not debug level :-/
They don't look like debug messages to me.
I don't see the urgent, crucial, terribly inportant importance of those messages, repeated every minute, spamming the warning log so that I can not see the really important messages about which I can do something.
Maybe they are not urgent or crucial or terribly important, they look like warnings about something that isn't right.
IMO, if they are not important, they should not have warning severity. And thousands of them are spam. No matter something is not right, only a dev can do something about them, not the admin, so they are debug messages. - -- Cheers, Carlos E. R. (from openSUSE 15.3 x86_64 at Telcontar) -----BEGIN PGP SIGNATURE----- iHoEARECADoWIQQZEb51mJKK1KpcU/W1MxgcbY1H1QUCYe6IQBwccm9iaW4ubGlz dGFzQHRlbGVmb25pY2EubmV0AAoJELUzGBxtjUfVMhQAniHHQDR00O75bFuIK+o3 NoR3zPK/AJ0UhhY3wSMpFEhbSZhCbmPKBwqGuQ== =dZFi -----END PGP SIGNATURE-----
Carlos E. R. wrote:
Example from my log, edited to avoid line wrap:
Telcontar ...-generator 28650 - - /etc/xdg/au... ..2 spaces.......................^^
I'll send a screenshot to you directly.
Ok. [...] When I sent them, there was no line wrap.
Ah, okay, yes I see that in the source too. Well - here is my guess: The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are: 1) field separator 2) beginning of logtext. -- Per Jessen, Zürich (1.4°C) http://www.dns24.ch/ - free dynamic DNS, made in Switzerland.
On 24/01/2022 12.14, Per Jessen wrote:
Carlos E. R. wrote:
Example from my log, edited to avoid line wrap:
Telcontar ...-generator 28650 - - /etc/xdg/au... ..2 spaces.......................^^
I'll send a screenshot to you directly.
Ok. [...] When I sent them, there was no line wrap.
Ah, okay, yes I see that in the source too. Well - here is my guess:
The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are:
1) field separator 2) beginning of logtext.
Yes, that is obvious now, but I still do not get why all the messages have a space at the start. -- Cheers / Saludos, Carlos E. R. (from 15.3 x86_64 at Telcontar)
Carlos E. R. wrote:
On 24/01/2022 12.14, Per Jessen wrote:
Well - here is my guess:
The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are:
1) field separator 2) beginning of logtext.
Yes, that is obvious now, but I still do not get why all the messages have a space at the start.
Maybe it's just typo. -- Per Jessen, Zürich (2.2°C)
On 24/01/2022 17.16, Per Jessen wrote:
Carlos E. R. wrote:
On 24/01/2022 12.14, Per Jessen wrote:
Well - here is my guess:
The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are:
1) field separator 2) beginning of logtext.
Yes, that is obvious now, but I still do not get why all the messages have a space at the start.
Maybe it's just typo.
Well, unless my memory fails me, I have been for years using "$msg contains" instead of "$msg startswith", before asking about it this time. It has driven me nuts everytime, because I always forget that it "does not work" and I tried again. I have a large /etc/rsyslog.conf file removing excessive messaging from the logs, going back for years. -- Cheers / Saludos, Carlos E. R. (from 15.3 x86_64 at Telcontar)
Carlos E. R. wrote:
On 24/01/2022 17.16, Per Jessen wrote:
Carlos E. R. wrote:
On 24/01/2022 12.14, Per Jessen wrote:
Well - here is my guess:
The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are:
1) field separator 2) beginning of logtext.
Yes, that is obvious now, but I still do not get why all the messages have a space at the start.
Maybe it's just typo.
Well, unless my memory fails me, I have been for years using "$msg contains" instead of "$msg startswith", before asking about it this time. It has driven me nuts everytime, because I always forget that it "does not work" and I tried again.
The key difference is probably that startswith is an anchored regex, whereas contains looks at the whole string. startswith is faster. Just guessing, I don't use rsyslog. -- Per Jessen, Zürich (1.5°C)
On 24/01/2022 20.27, Per Jessen wrote:
Carlos E. R. wrote:
On 24/01/2022 17.16, Per Jessen wrote:
Carlos E. R. wrote:
On 24/01/2022 12.14, Per Jessen wrote:
Well - here is my guess:
The fields in that logline are separated by blanks. The two hyphens are empty fields. The two spaces you point to above are:
1) field separator 2) beginning of logtext.
Yes, that is obvious now, but I still do not get why all the messages have a space at the start.
Maybe it's just typo.
Well, unless my memory fails me, I have been for years using "$msg contains" instead of "$msg startswith", before asking about it this time. It has driven me nuts everytime, because I always forget that it "does not work" and I tried again.
The key difference is probably that startswith is an anchored regex, whereas contains looks at the whole string. startswith is faster. Just guessing, I don't use rsyslog.
Yes, exactly. That's my reason for using it, too. -- Cheers / Saludos, Carlos E. R. (from 15.3 x86_64 at Telcontar)
On 2022-01-24 01:59, Carlos E. R. wrote:
Bug? Feature?
I depend on which direction you come from but since it is part of RFC3164/RFC5424 I'd bet on "feature". You can try to verify the rationale behind it by reading the examples (or whole) in the RFC. https://datatracker.ietf.org/doc/html/rfc5424#section-6.5 -- /bengan
participants (4)
-
Bengt Gördén -
Carlos E. R. -
J Leslie Turriff -
Per Jessen