[syslog-ng] patterndb

[Balazs Scheidler]

On Tue, 2013-11-26 at 13:56 +0100, Fabien Wernli wrote:
> Hi,
> 
> I'm currently organizing my patterndb files into something easily
> maintainable, and I ran into the following problem, best explained using an
> example: sshd and pam_unix.
> 
> Some of sshd specific patterns reside in a specific ruleset, e.g.
> 
> <ruleset name='sshd' id='A'>
>   <patterns>
>     <pattern>sshd</pattern
>   </patterns>
>   <rules>
>     <rule>
> ...
>     </rule>
>   </rules>
> </ruleset>
> 
> Some of sshd's messages come from pam_unix, e.g. modules/pam_unix/support.c,
> and are shared among other daemons:
> 
> <ruleset name='pam_unix' id='B'>
>   <patterns>
>     <pattern>crond</pattern>
>     <pattern>imap</pattern>
>     <pattern>login</pattern>
>     <pattern>pam</pattern>
>     <pattern>pure-ftpd</pattern>
>     <pattern>proftpd</pattern>
>     <pattern>sshd</pattern>
>     <pattern>su</pattern>
>     <pattern>sudo</pattern>
> ...
>   <patterns>
>   <rules>
>     <rule>
> ...
>     </rule>
>   </rules>
> </ruleset>
> 
> The problem is, when a sshd message is parsed, even if it doesn't match any
> rules in ruleset 'A', ruleset 'B' isn't even considered for matching.
> 
> So how do I properly organize my pdb tree, without duplicating rules in multiple
> source files?

hmm... patterns are merged, so which file the given pattern is read from
is irrelevant.

syslog-ng matches on the $PROGRAM value first (the pattern listed right
below the ruleset tag) and then the $MESSAGE value.

So it should just work (tm). If it doesn't then probably the merge
algorithm is at fault.

Could you pls create a simpler, artificial example that demonstrates the
issue so that I can reproduce it locally?

Thanks.

-- 
Bazsi