<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">That does not really address the issue.
By adding @ANYSTRNG@ to then end, we just end up with<br>
equally long matches, and then the pattern database load order
needs to be controlled to define<br>
preference. When merging pattern databases there is no real
control over load order. Additionally,<br>
if you and an @ANYSTRING@ to the end of a pattern that is designed
to match the whole line, you<br>
fail to get a match at all because @ANYSTRING@ can not match a
zero length string.<br>
<br>
The real issue is that the most specific pattern needs to be the
preferred pattern when<br>
there are multiple matches. The discussion is how to define a
pattern as being more specific.<br>
<br>
Consider glob file patterns as an example. Listed from least to
most specific,<br>
or stated differently, matching the most number of files, to
matching the least number of files.<br>
<br>
*<br>
*.doc<br>
contract*.doc*<br>
contract*2015*.doc<br>
contract-purchase-2015.doc<br>
<br>
The reason that this list is least specific to most specific is
because there is more<br>
static content to match on.<br>
<br>
If these were mail filtering rules to store e-mail in different
folders, you would never expect<br>
the document "contract-sale-2015.doc" to be stored in a folder
associated with the rule for<br>
the pattern "contract*.doc*". You would expect the rule
"contract*2015*.doc" to have priority.<br>
It is the amount of static content in the pattern that defines how
specific a pattern is.<br>
<br>
In the above example, it looks easy because the longest pattern is
the most specific. That is<br>
misleading because using Syslog-ng pattern syntax, a user variable
name can be introduced<br>
which can make a longer pattern actauly match a shorter message.
For example<br>
<br>
some @STRING:my.variable.matched:"@ here<br>
<br>
compared to<br>
<br>
some @STRING@ here @STRING@ done<br>
<br>
The second is more specific.<br>
<br>
At my site we had already done this because we store all of our
patterns in a database and<br>
programmatically create our pattern database by ordering the
patterns by the amount of static<br>
content. Now that the patterndb was "fixed" in 3.7 we can't use
this work around any more, which<br>
makes 3.7 break our pattern database :-(<br>
<br>
Evan.<br>
<br>
<br>
On 09/25/2015 02:35 PM, Scheidler, Balázs wrote:<br>
</div>
<blockquote
cite="mid:CANWQT2MPZyqFzw4AL=-aQNfQLD2wv2cKrz5iEXqsGVcYyLnNDg@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p dir="ltr">What if we grabbed the tail of the message you are
matching with @ANYSTRING@ to a name-value pair automatically, so
you don't need anything in your rule, making it a shorter match
than the other.</p>
<p dir="ltr">What do you think?</p>
<div class="gmail_quote">On Sep 22, 2015 10:43 PM, "Fabien Wernli"
<<a moz-do-not-send="true" href="mailto:wernli@in2p3.fr">wernli@in2p3.fr</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Evan,<br>
<br>
On Tue, Sep 22, 2015 at 09:49:43AM -0700, Evan Rempel wrote:<br>
> I propose that the PatternDB preference be changed from
the pattern with the longest MATCH to the pattern with the
largest amount of static content.<br>
<br>
I fully agree with Evan here: it should work as described in
this sentence.<br>
That being said, I'm not so sure about the Status quo with
3.7.1.<br>
Maybe Balázs can give some more details on the change?<br>
<br>
______________________________________________________________________________<br>
Member info: <a moz-do-not-send="true"
href="https://lists.balabit.hu/mailman/listinfo/syslog-ng"
rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a moz-do-not-send="true"
href="http://www.balabit.com/support/documentation/?product=syslog-ng"
rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a moz-do-not-send="true"
href="http://www.balabit.com/wiki/syslog-ng-faq"
rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">This body part will be downloaded on demand.</pre>
</blockquote>
<br>
</body>
</html>