<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>----- Original message -----
<br>>  I am considering using the patterndb to rewrite messages that do not
<br>> conform to syslog standards.
<br>>
<br>> Can the patterndb change all normally defined macros?  I need to be able
<br>> to change MSGHDR MESSAGE PROGRAM PID MSG MSGONLY and I think that is
<br>> all. I know that macros such as MSGHDR can not be changed by the rewrite
<br>> command but can it be changed by the patterndb?
<br>>
<br>
<br>there are two kinds of 'macros' within syslog-ng (and I'm considering a name change because of that). some of them are like registers, contain a given value, can be changed at will. I plan to name these properties in the future.
<br>
<br>others are basically derived values, where syslog-ng programmatically creates the value when needed. these cannot be changed. these would be called read-only properties.
<br>
<br>having this naming scheme, here's an explanation
<br>
<br>MSGHDR - this is read only, its contents are affected by PROGRAM, PID. If any of those is changed, MSGHDR will automatically change. (there was a bug in this a couple of years ago, but 3.3 should be ok)
<br>MESSAGE - read write
<br>PROGRAM - read write
<br>PID - read write
<br>MSG - alias to MESSAGE
<br>MSGONLY - read only, but is the same as MESSAGE in recent versions.
<br>
<br>patterndb is able to change read write proprties, but cannot change read only ones, similar to how rewrite rules behave.
<br>
<br>> Thanks for your expertise.
<br>> --
<br>> Evan Rempel
<br>> Senior Systems Administrator, Data Centre Services
<br>> University of Victoria
<br>> 250.721.7691
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>