Thanks very much for the quick fix !<br>I tried today's snapshot and it seems to work.<br><br>regards<br><br><div><span class="gmail_quote">On 4/29/07, <b class="gmail_sendername">Balazs Scheidler</b> <<a href="mailto:bazsi@balabit.hu">
bazsi@balabit.hu</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">On Sat, 2007-04-28 at 12:44 -0700, stucky wrote:<br>> Baszi
<br>><br>> Cool. I'm in the middle of building a new infrastructure and would<br>> like to use this feature. I'm not a programmer but I assume adding<br>> this feature shouldn't be very hard at all right ?
<br>> If you had a rough ETA that'd help me.<br><br>attached patch implements it using perl-like syntax, e.g.:<br><br>filter f_case { match('(?i)regexp'); };<br><br>It works in all filters that use regexps (
e.g. match, host, program,<br>etc) The regexp must begin with '(?' or otherwise the flag will not be<br>recognized.<br><br>Tomorrow's snapshot should contain it.<br><br>>From 47f53555268efb72ab8db2d620d7669b8e5dc7a4 Mon Sep 17 00:00:00 2001
<br>From: Balazs Scheidler <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>><br>Date: Sun, 29 Apr 2007 18:53:46 +0200<br>Subject: [PATCH] added support for Perl-like regexp flags to support case-ignoring matches
<br><br>2007-04-28 Balazs Scheidler <<a href="mailto:bazsi@balabit.hu">bazsi@balabit.hu</a>><br><br> * src/filter.c (filter_re_compile): parse '(?i)' at the beginning of<br> regexps as an ignore-case flag, just like Perl does
<br>---<br> src/filter.c | 34 +++++++++++++++++++++++++++++++---<br> tests/unit/test_filters.c | 5 +++++<br> 2 files changed, 36 insertions(+), 3 deletions(-)<br><br>diff --git a/src/filter.c b/src/filter.c
<br>index 8e19440..cf7e3aa 100644<br>--- a/src/filter.c<br>+++ b/src/filter.c<br>@@ -230,11 +230,39 @@ typedef struct _FilterRE<br> } FilterRE;<br><br> static gboolean<br>-filter_re_compile(const char *re, regex_t *regex)
<br>+filter_re_compile(const gchar *re, regex_t *regex)<br> {<br>- int rc;<br>+ gint rc;<br>+ const gchar *re_comp = re;<br>+ gint flags = REG_EXTENDED;<br><br>- rc = regcomp(regex, re, REG_EXTENDED);<br>+ if (re[0] == '(' && re[1] == '?')
<br>+ {<br>+ gint i;<br>+<br>+ for (i = 2; re[i] && re[i] != ')'; i++)<br>+ {<br>+ switch (re[i])<br>+ {<br>+ case 'i':<br>+ flags |= REG_ICASE;
<br>+ break;<br>+ }<br>+ }<br>+ if (re[i])<br>+ {<br>+ re_comp = &re[i + 1];<br>+ }<br>+ else<br>+ {<br>+ msg_error("Invalid regexp flags",
<br>+ evt_tag_str("re", re),<br>+ NULL);<br>+ return FALSE;<br>+ }<br>+ }<br>+<br>+ rc = regcomp(regex, re_comp, flags);<br> if (rc)<br> {<br> gchar buf[256];
<br>diff --git a/tests/unit/test_filters.c b/tests/unit/test_filters.c<br>index 58236d7..187b572 100644<br>--- a/tests/unit/test_filters.c<br>+++ b/tests/unit/test_filters.c<br>@@ -137,11 +137,16 @@ main(int argc G_GNUC_UNUSED, char *argv[] G_GNUC_UNUSED)
<br><br> testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("^host$"), 1);<br> testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("^hos$"), 0);
<br>+ testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("pthread"), 0);<br> fprintf(stderr, "One \"invalid regular expressions\" message is to be expected\n");
<br> TEST_ASSERT(filter_host_new("((") == NULL);<br><br>+ fprintf(stderr, "One \"invalid regular expressions\" message is to be expected\n");<br>+ TEST_ASSERT(filter_host_new("(?iana") == NULL);
<br>+<br> testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new(" PTHREAD "), 1);<br> testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new("^PTHREAD$"), 0);
<br>+ testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new("(?i)pthread"), 1);<br> fprintf(stderr, "One \"invalid regular expression\" message is to be expected\n");
<br> TEST_ASSERT(filter_match_new("((") == NULL);<br><br><br><br>--<br>Bazsi<br><br>_______________________________________________<br>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu
</a><br><a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>Frequently asked questions at <a href="http://www.campin.net/syslog-ng/faq.html">http://www.campin.net/syslog-ng/faq.html
</a><br><br></blockquote></div><br><br clear="all"><br>-- <br>stucky