<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE : [syslog-ng] Which macros are available for filtering ?</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>De: syslog-ng-bounces@lists.balabit.hu de la part de Balazs Scheidler<BR>
>On Tue, 2009-03-03 at 17:06 +0100, Vincent Panel wrote:<BR>
>><BR>
>> On a test machine, I've set up syslog-ng with a filter which looks<BR>
>> like this :<BR>
>><BR>
>> filter filter1 { match(".+" VALUE ("MACRO")); };<BR>
>><BR>
>> I've tried many MACROS and it seems only a few of them are not empty<BR>
>> (easy to spot using this regex). The most surprising is that several<BR>
>> documented macros are empty : for instance, MSGHDR and MSG (MSG should<BR>
>> be the same than MESSAGE, but looks like it's not).<BR>
<BR>
>Hmm.. must be a bug then... It really seems to be a bug, I've just tried<BR>
>it with $MSG and it didn't work.<BR>
><BR>
>I'll look into this, thanks for reporting it.<BR>
<BR>
<BR>
Thanks for confirming. Should all macros work in filtering ?<BR>
<BR>
I can understand syslog-ng doesn't know yet the S_* date/time macros, because the file is still not written and it's possible the "write" time is not known yet, but for all other macros, I think they should be available to the match() function.<BR>
<BR>
Should I open a bug report so that this bug gets followed up in a standard way ?</FONT>
</P>
</BODY>
</HTML>