<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.2">
<TITLE>Question about QSTRING and "<>" separators</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Hello,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I have another question (the last of the day ?) about db parser. In fact, my question is about the QSTRING. I'm not sur to understand how</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> to</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial">use it.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I follow the example given here (<A HREF="http://marci.blogs.balabit.com/2009/04/intorduction-to-parser-in-syslog-ng-db.html">http://marci.blogs.balabit.com/2009/04/intorduction-to-parser-in-syslog-ng-db.html</A>) but it doesn't seem to work.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Here is my xml file :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"><?xml version='1.0' encoding='UTF-8'?></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"><patterndb version='3' pub_date='2010-07-23'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <ruleset name='test' id='yann-test'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <description>Programme : test</description></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <pattern>test</pattern></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <rules></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <rule provider='yann' id='123456789' class='system'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="de"> <FONT SIZE=2 FACE="Arial"><patterns></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="de"><FONT SIZE=2 FACE="Arial"> <pattern>@QSTRING:message:<>@ Message message message</pattern></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="de"><FONT SIZE=2 FACE="Arial"> </patterns></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="de"><FONT SIZE=2 FACE="Arial"> </FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial"></rule></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </rules></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </ruleset></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"></patterndb></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I try to test a message by using the pdbtool :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">$ /opt/syslog-ng/bin/pdbtool match -p /tmp/syslog-ng.xml -P test -M "<123> Message message message"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Key contains '@' without escaping; key='@QSTRING:message:', value='123456789'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Error parsing pattern database file; filename='/tmp/syslog-ng.xml', error='Error on line 9 char 38: \'>\' is not a valid character following a \'<\' character; it may not begin an element name'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">...and I obtain</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial">this</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> error.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">What's wrong with the message</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial">or the use of QSTRING ?</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I replaced '<>' by "'" (simple quote) and it works</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">…</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"></SPAN></P>
<P DIR=LTR><SPAN LANG="fr"><FONT SIZE=2 FACE="Arial">Regards,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="fr"><FONT SIZE=2 FACE="Arial">Yann I.</FONT></SPAN><SPAN LANG="fr"></SPAN></P>
</BODY>
</HTML>