<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7653.2">
<TITLE>Pattern database and '<'</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Hello,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Currently, I'm using syslog-ng version 3.1.1.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I would like to parse that kind of message by using pattern database. Here is the message : "<<<<< Message message message".</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">So I created that xml file :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"><?xml version='1.0' encoding='UTF-8'?></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"><patterndb version='3' pub_date='2010-07-22'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <ruleset name='test' id='yann-test-</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">9999999999</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <description>Programme : test</description></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <pattern>test</pattern></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <rules></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <rule provider='yann' id='ss-test:syslog:dest:</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">123123123</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">:id005' class='system'></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="de"> <FONT SIZE=2 FACE="Arial"><patterns></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="de"><FONT SIZE=2 FACE="Arial"> <pattern><<<<< Message message message</pattern></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="de"><FONT SIZE=2 FACE="Arial"> </FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial"><values></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <value name=".classifier.facility">local0</value></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <value name=".classifier.severity">notice</value></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> <value name=".classifier.priority">133</value></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </values></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </patterns></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </rule></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </rules></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> </ruleset></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"></patterndb></FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">I obtain that message when I try to parse with the pdbtool application :</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">$ pdbtool match -p syslog-ng.xml -P test -M "<<<<< Message message message"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Error parsing pattern database file; filename='/tmp/syslog-ng.xml', error='Error on line 9 char 22: \'<\' is not a valid character following a \'<\' character; it may not begin an element name'</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Into the xml file, I replaced '<<<<<' with @STRING::@ or</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"> <FONT SIZE=2 FACE="Arial">@</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">ESTRING</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">…</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">@</FONT></SPAN><SPAN LANG="fr"></SPAN><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial"> but it doesn't work. Is it possible to match that kind of message ?</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Regards,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="fr"><FONT SIZE=2 FACE="Arial">Yann</FONT></SPAN><SPAN LANG="fr"></SPAN></P>
</BODY>
</HTML>