[syslog-ng] PCRE subst example from documentation produces error

Daniel Maher dmaher at milestonelab.com
Mon May 2 14:34:35 CEST 2011


Hello,

While following the example given here :
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guide-admin-en.html/index.html-single.html#example_regexp_pcre

I copied and pasted the string, then attempted to restart the daemon;
unfortunately, this was the result :

---
Error parsing rewrite expression, syntax error, unexpected
LL_IDENTIFIER, expecting ')' in /etc/syslog-ng/syslog-ng.conf at line
354, column 27:

        {subst("a*", "?", field("message") type("pcre") flags("utf8"
"global"));  };
                          ^^^^^

syslog-ng documentation:
http://www.balabit.com/support/documentation/?product=syslog-ng
mailing list: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Cannot load /etc/syslog-ng/syslog-ng.conf
---

Have I managed to paste incorrectly, or is the documentation incorrect,
or is it something else entirely ?

# syslog -V
syslog-ng 3.2.2
Installer-Version: 3.2.2
Revision: 
Compile-Date: Apr 20 2011 16:19:28
Enable-Threads: off
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-Sun-STREAMS: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: off
Enable-SSL: on
Enable-SQL: off
Enable-Linux-Caps: off
Enable-Pcre: on
Enable-Pacct: off

Thank you.

-- 
Daniel Maher
« can't talk, too busy calculating computrons. »



More information about the syslog-ng mailing list