define <name> Log2Syslog <destination host> [ident:<ident>] [event:<regexp>] [fhem:<regexp>]define <name> Log2Syslog define SyslogServer Log2Syslog
+2018-07-31 17:07:24.382 Log2Syslog SyslogServer HOST: fhem.myds.me || FAC: syslog || SEV: Notice || ID: Prod_event || CONT: USV state: OL
+2018-07-31 17:07:24.858 Log2Syslog SyslogServer HOST: fhem.myds.me || FAC: syslog || SEV: Notice || ID: Prod_event || CONT: HMLAN2 loadLvl: low
+
+ | HOST | the Sender of the dataset |
| FAC | Facility corresponding to RFC5424 |
| SEV | Severity corresponding to RFC5424 |
| ID | Ident-Tag |
| CONT | the message part of the received message |
define <name> Log2Syslog <destination host> [ident:<ident>] [event:<regexp>] [fhem:<regexp>]| <destination host> | host (name or IP-address) where the syslog server is running |
| [ident:<ident>] | optional program identifier. If not set the device name will be used as default. |
| [event:<regexp>] | optional regex to filter events for logging |
| [fhem:<regexp>] | optional regex to filter fhem system log for logging |
| verbose-Level | Severity in Syslog |
| 0 | Critical |
| 1 | Error |
| 4 | Informational |
| 5 | Debug |
define splunklog Log2Syslog fhemtest 192.168.2.49 ident:Test event:.* fhem:.* Aug 18 21:06:46 fhemtest.myds.me 1 2017-08-18T21:06:46 fhemtest.myds.me Test_event 13339 FHEM - : LogDB sql_processing_time: 0.2306 -Aug 18 21:06:46 fhemtest.myds.me 1 2017-08-18T21:06:46 fhemtest.myds.me Test_event 13339 FHEM - : LogDB background_processing_time: 0.2397 -Aug 18 21:06:45 fhemtest.myds.me 1 2017-08-18T21:06:45 fhemtest.myds.me Test_event 13339 FHEM - : LogDB CacheUsage: 21 -Aug 18 21:08:27 fhemtest.myds.me 1 2017-08-18T21:08:27.760 fhemtest.myds.me Test_fhem 13339 FHEM - : 4: CamTER - Informations of camera Terrasse retrieved -Aug 18 21:08:27 fhemtest.myds.me 1 2017-08-18T21:08:27.095 fhemtest.myds.me Test_fhem 13339 FHEM - : 4: CamTER - CAMID already set - ignore get camid + + Example of a Sender:
+ +
define splunklog Log2Syslog fhemtest 192.168.2.49 ident:Test event:.* fhem:.*
+Aug 18 21:06:46 fhemtest.myds.me 1 2017-08-18T21:06:46 fhemtest.myds.me Test_event 13339 FHEM [version@Log2Syslog version="4.2.0"] : LogDB sql_processing_time: 0.2306
+Aug 18 21:06:46 fhemtest.myds.me 1 2017-08-18T21:06:46 fhemtest.myds.me Test_event 13339 FHEM [version@Log2Syslog version="4.2.0"] : LogDB background_processing_time: 0.2397
+Aug 18 21:06:45 fhemtest.myds.me 1 2017-08-18T21:06:45 fhemtest.myds.me Test_event 13339 FHEM [version@Log2Syslog version="4.2.0"] : LogDB CacheUsage: 21
+Aug 18 21:08:27 fhemtest.myds.me 1 2017-08-18T21:08:27.760 fhemtest.myds.me Test_fhem 13339 FHEM [version@Log2Syslog version="4.2.0"] : 4: CamTER - Informations of camera Terrasse retrieved
+Aug 18 21:08:27 fhemtest.myds.me 1 2017-08-18T21:08:27.095 fhemtest.myds.me Test_fhem 13339 FHEM [version@Log2Syslog version="4.2.0"] : 4: CamTER - CAMID already set - ignore get camid
-
+
The structure of the payload differs dependent of the used logFormat. | PRIVAL | priority value (coded from "facility" and "severity") |
| IETFVERS | used version of RFC5424 specification |
| TIME | timestamp according to RFC5424 |
| MYHOST | Internal MYHOST |
| IDENT | ident-Tag from DEF if set, or else the own device name. The statement will be completed by "_fhem" (FHEM-Log) respectively "_event" (Event-Log). |
| PID | sequential Payload-ID |
| MID | fix value "FHEM" |
| SD-FIELD | contains additional iformation about used module version |
| MESSAGE | the dataset to transfer |
| PRIVAL | priority value (coded from "facility" and "severity") |
| MONAT | month according to RFC3164 |
| TAG | day of month according to RFC3164 |
| MONTH | month according to RFC3164 |
| DAY | day of month according to RFC3164 |
| TIME | timestamp according to RFC3164 |
| MYHOST | Internal MYHOST |
| IDENT | ident-Tag from DEF if set, or else the own device name. The statement will be completed by "_fhem" (FHEM-Log) respectively "_event" (Event-Log). |
| PID | the message-id (sequence number) |
| MESSAGE | the dataset to transfer |
certinfoaddTimestamp [0|1]Aug 18 21:26:55 fhemtest.myds.me 1 2017-08-18T21:26:55 fhemtest.myds.me Test_event 13339 FHEM - : 2017-08-18 21:26:55 USV state: OL
Aug 18 21:26:54 fhemtest.myds.me 1 2017-08-18T21:26:54 fhemtest.myds.me Test_event 13339 FHEM - : 2017-08-18 21:26:54 Bezug state: done
Aug 18 21:26:54 fhemtest.myds.me 1 2017-08-18T21:26:54 fhemtest.myds.me Test_event 13339 FHEM - : 2017-08-18 21:26:54 recalc_Bezug state: Next: 21:31:59
- addStateEvent [0|1]disable [0|1]logFormat [BSD|IETF]protocol [TCP|UDP]| intern | events are generated by module intern mechanism and only visible in FHEM eventmonitor. Readings are not created. |
| no | only readings like "MSG_<hostname>" without event generation are created |
| reading | readings like "MSG_<hostname>" are created. Events are created dependent of the "event-on-.*"-attributes |
| $PRIVAL | "" (0 ... 191) |
| $FAC | "" (0 ... 23) |
| $SEV | "" (0 ... 7) |
| $TS | Timestamp (YYYY-MM-DD hh:mm:ss) |
| $HOST | "" |
| $DATE | "" (YYYY-MM-DD) |
| $TIME | "" (hh:mm:ss) |
| $ID | "" |
| $PID | "" |
| $MID | "" |
| $SDFIELD | "" |
| $CONT | "" |
| $DATA | provided raw-data of received Syslog-message (no evaluation of value return!) |
| $IGNORE | 0 (0|1), if $IGNORE==1 the Syslog-dataset is ignored |
+{
+($PRIVAL,$CONT) = ($DATA =~ /^<(\d{1,3})>\s(.*)$/);
+$CONT = (split(">",$CONT))[1] if($CONT =~ /^<.*>.*$/);
+}
+
+ | BSD | Parsing of messages in BSD-format according to RFC3164 |
| IETF | Parsing of messages in IETF-format according to RFC5424 (default) |
| ... | further specific parse profiles for selective device are provided |
| ParseFn | Usage of an own specific parse function provided by attribute "parseFn" |
| raw | no parsing, events are created from the messages as received without conversion |
| BSD | -> PRIVAL,FAC,SEV,TS,HOST,ID,CONT |
| IETF | -> PRIVAL,FAC,SEV,TS,HOST,DATE,TIME,ID,PID,MID,SDFIELD,CONT |
| ParseFn | -> PRIVAL,FAC,SEV,TS,HOST,DATE,TIME,ID,PID,MID,SDFIELD,CONT |
| raw | -> no selection is meaningful, the original message is used for event creation |
| PRIVAL | coded Priority value (coded from "facility" and "severity") |
| FAC | decoded Facility |
| SEV | decoded Severity of message |
| TS | Timestamp containing date and time (YYYY-MM-DD hh:mm:ss) |
| HOST | Hostname / Ip-address of the Sender |
| DATE | Date (YYYY-MM-DD) |
| TIME | Time (hh:mm:ss) |
| ID | Device or application what was sending the Syslog-message |
| PID | Programm-ID, offen reserved by process name or prozess-ID |
| MID | Type of message (arbitrary string) |
| SDFIELD | Metadaten about the received Syslog-message |
| CONT | Content of the message |
| DATA | received raw-data |
portrateCalcRerunssldebugTLStimeoutverbose| MSG_<Host> | the last successful parsed Syslog-message from <Host> |
| SSL_Algorithm | used SSL algorithm if SSL is enabled and active |
| SSL_Version | the used TLS-version if encryption is enabled and is active |
| Transfered_logs_per_minute | the average number of forwarded logs/events per minute |
| PRIVAL | Priority Wert (kodiert aus "facility" und "severity") |
| IETFVERS | Version der benutzten RFC5424 Spezifikation |
| TIME | Timestamp nach RFC5424 |
| MYHOST | Internal MYHOST |
| IDENT | Ident-Tag aus DEF wenn angegeben, sonst der eigene Devicename. Die Angabe wird mit "_fhem" (FHEM-Log) bzw. "_event" (Event-Log) ergänzt. |
| PRIVAL | Priority Wert (kodiert aus "facility" und "severity") |
| MONAT | Monatsangabe nach RFC3164 |
| TAG | Tag des Monats nach RFC3164 |
| MONTH | Monatsangabe nach RFC3164 |
| DAY | Tag des Monats nach RFC3164 |
| TIME | Zeitangabe nach RFC3164 |
| MYHOST | Internal MYHOST |
| IDENT | Ident-Tag aus DEF wenn angegeben, sonst der eigene Devicename. Die Angabe wird mit "_fhem" (FHEM-Log) bzw. "_event" (Event-Log) ergänzt. |
| PID | Die ID der Mitteilung (= Sequenznummer) |
| MESSAGE | der zu übertragende Datensatz |