axoflow / axosyslog-core-docs

AxoSyslog Core documentation
https://axoflow.com/docs/axosyslog-core/
Apache License 2.0
9 stars 5 forks source link

Add documentation for flags(check-hostname) for syslog-parser plus where appicable #70

Closed jszigetvari closed 1 month ago

jszigetvari commented 2 months ago

There is a flag called "check-hostname" for syslog-parser() that is undocumented at the moment. Also, it may apply to other parsers or other places as well. (Also, there is a corresponding global option too.)

The goal would be to document the flag, what it does exactly, and add features where it is applicable. Also if the corresponding global option's documentation is missing something, that should be added too.

fekete-robert commented 2 months ago

@alltilla / @bazsi please comment on the above, where does the check-hostname flag work and how is it different from the global option?

alltilla commented 2 months ago

check-hostname(yesno) is applicable to all these sources:

It can also be set for the global options block, like: options{check-hostname(yesno);}; It can also be set via the check-hostname flag in all the sources mentioned above, in the python and python-fetcher sources and the syslog-parser() parser, like python(flags(check-hostname));.

If it is enabled, we check the host field's value during the initial implicit syslog parsing (aka. flags(no-parse) or flags(no-header) is not set for the sources). If it contains an invalid character, the syslog.invalid_hostname tag will be set for the message, and $HOST will not be parsed from the message, similar to bad-hostname().

Valid characters are:

(i >= 'A' && i <= 'Z') ||
(i >= 'a' && i <= 'z') ||
(i >= '0' && i <= '9') ||
i == '-' || i == '_' ||
i == '.' || i == ':' ||
i == '@' || i == '/')
jszigetvari commented 2 months ago

In case of parsers (and probably the sources too) check-hostname can be added as a flag to the parser.

fekete-robert commented 2 months ago

Sidenote: the fifo source isn't documented, should it be? Or is it an alias for the pipe source?