[syslog-ng] 3.7.1 patterndb matching rule preference fix - incorrect

[Scheidler, Balázs]

Hi,

It is simple to revert to the old behaviour, and maybe we should just do
that.

Using the amount of literal text in the pattern as the sort order of
specifism is a good idea, this could perhaps be added to pdbtool merge.

The question is whether the preference over full matches over partial ones
should stay as an option or be dropped entirely.

What do you think?
On Sep 22, 2015 10:43 PM, "Fabien Wernli" <wernli at in2p3.fr> wrote:

> Hi Evan,
>
> On Tue, Sep 22, 2015 at 09:49:43AM -0700, Evan Rempel wrote:
> > I propose that the PatternDB preference be changed from the pattern with
> the longest MATCH to the pattern with the largest amount of static content.
>
> I fully agree with Evan here: it should work as described in this sentence.
> That being said, I'm not so sure about the Status quo with 3.7.1.
> Maybe Balázs can give some more details on the change?
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20150926/36af21dc/attachment.htm