<p dir="ltr">The rule has a context-timeout attribute that specifies how long an entry is kept in the correlation state.</p>
<p dir="ltr">Yours specify zero, thus syslog-ng expires the entry as soon as the timestamp changes.</p>
<div class="gmail_quote">On Aug 10, 2015 06:33, "Thanh Dat" <<a href="mailto:dat.tt@netnam.vn">dat.tt@netnam.vn</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Dear all syslog-ng expert, <br>
<br>
I have a pattern to combine multiple lines of postfix into a single
entry. However, it does not work correctly. As I run syslog-ng
-Fvde, I found out the reason is its context always expire after
"from" log and "message-id" log which I don't know why. For example:<br>
[2015-08-10T10:13:58.421999] Expiring patterndb correllation
context; last_rule='bbbbbbbb-3916-2444-5238-7495cb64bf76',
utc='1437843601'<br>
<br>
I send you my debug output, patterndb and my log sample. <br>
Please help me.<br>
Thank you so much for your help.<br>
<br>
PS: Sorry for my bad English.<br>
<div>-- <br>
<div>
<p class="MsoNormal"><span style="color:black">Best Regards.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black">--<br>
<span> </span>Tang Thanh Dat (Mr.)
| System Administration Department<br>
NETNAM CORPORATION<br>
18 Hoang <span>Quoc</span> Viet, <span>Cau</span> <span>Giay</span>,
<span>Hanoi,Vietnam</span><br>
(T)<a href="tel:%2B84-4-37562227" value="+84437562227" target="_blank">+84-4-37562227</a>, (F)<a href="tel:%2B84-4-37%20561%20888" value="+84437561888" target="_blank">+84-4-37 561 888</a>, (M)+84-(0)-9
<a href="tel:32336692" value="+3632336692" target="_blank">32336692</a><br>
(E) <a href="mailto:dat.tt@netnam.vn" target="_blank">dat.tt@netnam.vn</a>
(W) <a href="http://www.netnam.vn" target="_blank">www.netnam.vn</a><br>
--<br>
<span>NetNam</span> - one of the best ISPs
and Solutions Providers in Vietnam,<br>
specialized in corporate networks, managed services &
security solutions.<br>
--<br>
Your Net, We Care! <br>
<br>
</span></p>
</div>
</div>
</div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div>