contains_i not recognized as valid

[Cat22]

:msg, contains_i, "qt" /var/log/qt.log

Expected behavior

according to documentation this should work

Actual behavior

rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 93: invalid character ':' - is there an invalid escape sequence somewhere? [v8.39.0 try http://www.rsyslog.com/e/2207 ]

Steps to reproduce the behavior

insert this line in /etc/rsyslog.conf and run rsyslogd -N 1
:msg, contains_i, "qt" /var/log/qt.log

Environment

• rsyslog version:
• platform:
• for configuration questions/issues, include rsyslog.conf and included config files

rsyslogd -v

rsyslogd 8.39.0, compiled with:
PLATFORM: x86_64-suse-linux-gnu
PLATFORM (lsb_release -d):
FEATURE_REGEXP: Yes
GSSAPI Kerberos 5 support: Yes
FEATURE_DEBUG (debug build, slow code): No
32bit Atomic operations supported: Yes
64bit Atomic operations supported: Yes
memory allocator: system default
Runtime Instrumentation (slow code): No
uuid support: Yes
systemd support: Yes
Number of Bits in RainerScript integers: 64

[davidelang]

please post your full config, the problem is probably in a prior line. David Lang

…

On Fri, 7 Feb 2020, erbenton wrote: Date: Fri, 07 Feb 2020 08:07:55 -0800 From: erbenton ***@***.***> Reply-To: rsyslog/rsyslog ***@***.***> To: rsyslog/rsyslog ***@***.***> Cc: Subscribed ***@***.***> Subject: [rsyslog/rsyslog] contains_i not recognized as valid (#4165) :msg, contains_i, "qt" /var/log/qt.log ### Expected behavior according to documentation this should work ### Actual behavior rsyslogd: error during parsing file /etc/rsyslog.conf, on or before line 93: invalid character ':' - is there an invalid escape sequence somewhere? [v8.39.0 try http://www.rsyslog.com/e/2207 ] ### Steps to reproduce the behavior insert this line in /etc/rsyslog.conf and run rsyslogd -N 1 :msg, contains_i, "qt" /var/log/qt.log ### Environment - rsyslog version: <!-- e.g. 8.35.0 - use "rsyslogd -v" to obtain the version number --> - platform: <!-- e.g. Ubuntu 16.04 --> - for configuration questions/issues, include rsyslog.conf and included config files <!-- Note: rsyslog documentation is available here: - current stable release: http://www.rsyslog.com/doc/v8-stable/ - pre-release: http://www.rsyslog.com/doc/master/ --> # rsyslogd -v rsyslogd 8.39.0, compiled with: PLATFORM: x86_64-suse-linux-gnu PLATFORM (lsb_release -d): FEATURE_REGEXP: Yes GSSAPI Kerberos 5 support: Yes FEATURE_DEBUG (debug build, slow code): No 32bit Atomic operations supported: Yes 64bit Atomic operations supported: Yes memory allocator: system default Runtime Instrumentation (slow code): No uuid support: Yes systemd support: Yes Number of Bits in RainerScript integers: 64

[Cat22]

rsyslog.txt
I don't believe its a prior line because if i change contains_i to contains then rsyslogd -N 1 reports no errors, if i change it back to contains_i it reports the error again.
Note: I had to rename the file because git hub doesn't allow me to upload a conf file or even a gzip'd file (sounds like a windows thing sadly...)

[Cat22]

So, just to follow up for anyone else reading this (Thanks David Lang for all your offline help):
It turns out that the openSuse version of rsyslog is apparently broken (bug to be filed).
contains_i doesnt work in :msg or $msg format but it does work in the if/then format
e.g:
This doesnt work
:msg, contains_i "txt to match' /var/log/junk.log
but this does
if ( $msg, contains_i "txt to match' ) then /var/log/junk.log

ps: use rsyslogd -N 1 to check your config file(s)

[davidelang]

I'm not sure that this is specific to suse, the version you are running is 8.39 (just over a year old at this point, 9 releases) David Lang

…

On Thu, 13 Feb 2020, erbenton wrote: Date: Thu, 13 Feb 2020 07:00:21 -0800 From: erbenton ***@***.***> Reply-To: rsyslog/rsyslog ***@***.***> To: rsyslog/rsyslog ***@***.***> Cc: David Lang ***@***.***>, Comment ***@***.***> Subject: Re: [rsyslog/rsyslog] contains_i not recognized as valid (#4165) So, just to follow up for anyone else reading this **(Thanks David Lang for all your offline help)**: It turns out that the openSuse version of rsyslog is apparently broken (bug to be filed). _contains_i_ doesnt work in :msg or $msg format but it does work in the _if/then_ format e.g: This doesnt work `:msg, contains_i "txt to match' /var/log/junk.log` but this does `if ( $msg, contains_i "txt to match' ) then /var/log/junk.log` `ps: use rsyslogd -N 1 to check your config file(s)`

[Cat22]

Please also see this bug report:
https://bugzilla.suse.com/show_bug.cgi?id=1163602

[rgerhards]

If I read correctly, contains_i is not supported in property based filters, only expression ones.

So you may consider changing to that

If $msg contains_i "..."

[rgerhards]

Forgot link https://www.rsyslog.com/doc/v8-stable/configuration/filters.html

[davidelang]

the documentation page he pointed at reads to me like it should. I wasn't sure if this was a bug in the code or the docs David Lang

…

On Fri, 21 Feb 2020, Rainer Gerhards wrote: If I read correctly, contains_i is not supported in property based filters, only expression ones. So you may consider changing to that If $msg contains_i "..."

[rgerhards]

El sáb., 22 feb. 2020 a las 0:17, David Lang (<notifications@github.com>) escribió:

the documentation page he pointed at reads to me like it should. I wasn't sure if this was a bug in the code or the docs

I just checked the code, it is like I said: contains_i is only available for expression based filters. This is most probably because we do not intend to duplicate all functionality into older constructs. There no longer is a real reason to use property based filters. HTH Rainer David Lang

…

On Fri, 21 Feb 2020, Rainer Gerhards wrote: > If I read correctly, contains_i is not supported in property based filters, only expression ones. > > So you may consider changing to that > > If $msg contains_i "..." > > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#4165?email_source=notifications&email_token=AALJ3CYLFL545E67U3OGORTREBOHXA5CNFSM4KRQ7FOKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMUM6ZY#issuecomment-589877095>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALJ3C5BJN62LL3ZEE6EEPTREBOHXANCNFSM4KRQ7FOA> .

[traveller42]

I hit this issue as well by following the text in the documentation for property filters.