<p class="MsoNormal"><span style="font-family: Arial;">Hello,</span></p>
<p class="MsoNormal"><span style="font-family: Arial;"> </span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">I'm writing patterndb.xml files to filter syslog messages from servers
and CISCO routers. Currently, CISCO sends syslog with that format:</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB"> </span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">Nov<span style=""> </span>3 15:36:02 srv01.dom.test
36779: .Nov<span style=""> </span>3 14:50:30.403:
%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: user01] [Source: 10.0.0.1]
[localport: 22] at 15:50:30 CET Wed Nov 3 2010</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">Nov<span style=""> </span>3 15:39:02 srv01.dom.test
36780: .Nov<span style=""> </span>3 14:53:30.255:
%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: user01] [Source: 10.0.0.1]
[localport: 22] at 15:53:30 CET Wed Nov 3 2010</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">Nov<span style=""> </span>3 15:42:01 srv01.dom.test
36781: .Nov<span style=""> </span>3 14:56:30.378:
%SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: user01] [Source: 10.0.0.1]
[localport: 22] at 15:56:30 CET Wed Nov 3 2010</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB"> </span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">The problem comes from the program name which changes for each message: 36779,
36780, 36781, etc. For this reason, I can't use patterndb mechanism.</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">How may I solve my problem? I think it's not allowed to change the
program name with the "rewrite" rule.</span></p><p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">I have the same problem with switches from Alcatel...<br></span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB"> </span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">Regards,</span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB"> </span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB">Yann I.<br></span></p>
<p class="MsoNormal"><span style="font-family: Arial;" lang="EN-GB"> </span></p>