Rsyslog - Parsing audit.log / omprog change log value

Question

I'm trying to parse audit.log with rsyslog by using a bash script in order to transform the hex part of proctitle to ascii. However I do not get ressults: the file audit_ascii.log do not have lines with "proctitle" values. I tested the script and it is working fine so I guess the problem comes from my rsyslog.conf.

rsyslog.conf:

$InputFileName /var/log/audit/audit.log
$InputFileTag tag_auditd:
$InputFileStateFile log_audit
$InputFileSeverity info
$InputFileFacility local6
$InputRunFileMonitor

if $msg contains "msg=audit" then {
action(type="omprog" binary="/bin/bash /opt/bin/hex2ascii.sh" output="/var/log/audit/audit_ascii.log")

hex2ascii

    #!/bin/bash
    read log
    
    hasHex=$(echo $log | egrep "msg=audit" | egrep "type=PROCTITLE" | egrep -v '"' | wc -c)
    
    if [ ${hasHex} -gt 0 ];
    then
        part1=$(echo $log | cut -d"=" -f1-3)
    
        part2=$(echo $log | cut -d"=" -f4)
        part2=$(echo $part2 | xxd -r -p )
        echo $part1 >> /var/log/audit/verif.txt 
        #echo "${part1}=${part2}\n" >> /var/log/audit/audit_ascii.log
        log="${part1}=${part2}\n"
    #else
        #echo $log >> /var/log/audit/audit_ascii.log
            
    fi

Answer 1

Though several modules are built-in to rsyslog, some of them are not and need to be loaded before they can be used.

The imfile module you are using needs to be preceded by the line (in legacy syntax):

$ModLoad imfile

Similarly, the omprog module, if using the newer syntax, needs

module(load="omprog")

before it can be used in the if statement (which is missing a closing }). Look at the error messages you will get from rsyslogd -N 1.

Answer 2

Just stop the flow after the script redirected the changed log to another file. Then I take the new file as another input in rsyslog. Best solution I found