<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">I agree with what Attila wrote, but to
answer your question the first rexpression <span
style="font-family:"Calibri","sans-serif";color:black">host("*.abca.*")
is invalid.<br>
you have a "*." where you needed a ".*"<br>
<br>
Evan<br>
</span><br>
<br>
On 06/06/2017 05:07 AM, Szalai, Attila wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4CA2A180C7B0884DAFB845902ABF643321E0C556@OZWEX0201N2.msad.ms.com"><!-- Template generated by Exclaimer Template Editor on 08:07:47 Dinsdag, 6 Junie 2017 -->
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<style type="text/css">P.4a856f22-2c31-4778-a052-a5131e2ae7d9 {
MARGIN: 0cm 0cm 0pt
}
LI.4a856f22-2c31-4778-a052-a5131e2ae7d9 {
MARGIN: 0cm 0cm 0pt
}
DIV.4a856f22-2c31-4778-a052-a5131e2ae7d9 {
MARGIN: 0cm 0cm 0pt
}
TABLE.4a856f22-2c31-4778-a052-a5131e2ae7d9Table {
MARGIN: 0cm 0cm 0pt
}
DIV.Section1 {
page: Section1
}
</style>
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<p>
</p>
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">First
of all, the content of the host() is a regular expression,
so adding .* to the beginning and/or to the end of the
expression adds nothing, just pain/slowness.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Second,
it would help a lot if we can see the actual error message.
I found no obvious mistake, but because this is not the
original line, maybe something lost in the translation.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in
0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
syslog-ng [<a class="moz-txt-link-freetext" href="mailto:syslog-ng-bounces@lists.balabit.hu">mailto:syslog-ng-bounces@lists.balabit.hu</a>]
<b>On Behalf Of </b><a class="moz-txt-link-abbreviated" href="mailto:wiskbroom@hotmail.com">wiskbroom@hotmail.com</a><br>
<b>Sent:</b> Tuesday, June 06, 2017 12:59 AM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:syslog-ng@lists.balabit.hu">syslog-ng@lists.balabit.hu</a><br>
<b>Subject:</b> [syslog-ng] Filter Not Working (too
many or's?)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p><span
style="font-family:"Calibri","sans-serif";color:black">Here
is an example of what I am trying to do, these hostnames
are not real; the real ones have no common pattern.<o:p></o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black">filter
f_xyz { host("*.abca.*") or host(".*abcb.*") or
host(".*abcc.*") or host(".*abcd.*") or host(".*abce.*")
or host(".*abcf.*") or host(".*abcg.*") or
host(".*abch.*"); };<o:p></o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black">The
filter above is for any host containing a hostname with
what is contained within the .* and *.; i.e. hostabca01
will be matched by host("*.abca.*")
<o:p></o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black">When
I have this filter in my config, syslog fails to
restart.<o:p></o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black"><o:p> </o:p></span></p>
<p><span
style="font-family:"Calibri","sans-serif";color:black">Eyes
hurt, obvious mistake?<o:p></o:p></span></p>
</div>
</div>
</div>
<br>
<span style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; COLOR: #808080"></span></blockquote>
</body>
</html>