<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Apr 11, 2014 at 10:10 PM, David Hauck <span dir="ltr"><<a href="mailto:davidh@netacquire.com" target="_blank">davidh@netacquire.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Viktor,<br>
<div class=""><br>
On Friday, April 11, 2014 1:01 PM, <a href="mailto:syslog-ng-bounces@lists.balabit.hu">syslog-ng-bounces@lists.balabit.hu</a> wrote:<br>
> Hi David!<br>
><br>
> If a log message does not match any pattern for a parser, syslog-ng<br>
> db-parser sets its .classifier.class to "unknown" regardless of the field's previous state.<br>
> So if it matched on a previous parser, the next parser will overwrite<br>
> it if it doesn't match on that. I think it's a bug rather than a<br>
> feature, so could you please open an issue for that on github?<br>
<br>
</div>Sure, I can do that (although I can imagine a potential valid semantic for wanting this to behave either way).<br></blockquote><div>Perhaps then we should make this switchable and the default should be the current behaviour. You're right, I forgot that changing behaviour could break existing configs :(.<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class=""><br>
> You can merge patterndb .pdb files easily with "pdbtool merge"<br>
> command, which is shipped with syslog-ng. It's simpler than having junctions :).<br>
<br>
</div>:) OK, that's an option too (although I also like splitting these out into individual files and not having to run the merge whenever an individual file is modified).<br>
<br>
Cheers,<br>
-David<br>
<div class="HOEnZb"><div class="h5">______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div></div>