Use this documentation with care! It describes the heavily outdated version 5, which was actively developed around 2010 and is considered dead by the rsyslog team for many years now.

This documentation reflects the latest update of the previously existing (now removed) v5-stable branch. It describes the 5.10.2 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v5 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is no rsyslog community support available for this heavily outdated version. If you need to stick with it, please ask your distribution for support.

Message Modification Modules

Message modification modules are used to change the content of messages being processed. They can be implemented using either the output module or the parser module interface. From the rsyslog core’s point of view, they actually are output or parser modules, it is their implementation that makes them special.

Currently, there do not exist any such modules, but could be written with the methods the engine provides. They could be used, for example, to:

  • anonymize message content
  • add dynamically computed content to message (fields)

Message modification modules are usually written for one specific task and thus usually are not generic enough to be reused. However, existing module’s code is probably an excellent starting base for writing a new module. Currently, the following modules existin inside the source tree

Previous topic

pmrfc5424: Parse RFC5424-formatted messages

Next topic

mmsnmptrapd message modification module

This Page