<p dir="ltr">Hi,</p>
<p dir="ltr">It is simple to revert to the old behaviour, and maybe we should just do that.</p>
<p dir="ltr">Using the amount of literal text in the pattern as the sort order of specifism is a good idea, this could perhaps be added to pdbtool merge.</p>
<p dir="ltr">The question is whether the preference over full matches over partial ones should stay as an option or be dropped entirely.</p>
<p dir="ltr">What do you think?</p>
<div class="gmail_quote">On Sep 22, 2015 10:43 PM, "Fabien Wernli" <<a href="mailto:wernli@in2p3.fr">wernli@in2p3.fr</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Evan,<br>
<br>
On Tue, Sep 22, 2015 at 09:49:43AM -0700, Evan Rempel wrote:<br>
> I propose that the PatternDB preference be changed from the pattern with the longest MATCH to the pattern with the largest amount of static content.<br>
<br>
I fully agree with Evan here: it should work as described in this sentence.<br>
That being said, I'm not so sure about the Status quo with 3.7.1.<br>
Maybe Balázs can give some more details on the change?<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>