<div dir="ltr"><div dir="ltr">Hello,<div><br></div><div>By simple you mean you want a more compact regular expression ?</div><div><br></div><div>Just shortening you could do something like this: "AAA-6-AAA_ACCOUNTING_MESSAGE: [^@]+@[^:]+:[^:]+:[a-zA-Z]+ user"</div><div><br></div><div>But this would match your example fine: "AAA-6-AAA_ACCOUNTING_MESSAGE: .+:[a-zA-Z]+ user".</div><div><br></div><div>Do you have pattern that you do not want to match ? Is there any description about the message format that you want to match ? As I would try to build a regex for that instead guessing.</div><div><br></div><div>--</div><div>Kokan</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 2, 2019 at 11:28 PM Lin, Victor <<a href="mailto:victor.lin@rbc.com">victor.lin@rbc.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<font face="Calibri" size="2"><span style="font-size:11pt">
<div>Thanks a lot Kokan!!!!!</div>
<div><font face="Times New Roman"> </font></div>
<div>I got the result :-)</div>
<div><font face="Times New Roman"> </font></div>
<div>One more question</div>
<div>For the following two</div>
<div>%<font color="red">AAA-6-AAA_ACCOUNTING_MESSAGE</font>: update:10.94.200.210@pts/0:syslogtest:<font color="red">deleted user</font><font color="red"> </font>victor</div>
<div>%<font color="red">AAA-6-AAA_ACCOUNTING_MESSAGE</font>: update:10.94.201.173@pts/0:syslogtest:<font color="red">added user</font> victor</div>
<div><font face="Times New Roman"> </font></div>
<div>I try to use the following regex to match the text in red color, it shows works. </div>
<div><font face="Times New Roman"> </font></div>
<div>AAA-6-AAA_ACCOUNTING_MESSAGE: [a-zA-Z0-9]+:[0-9.]+@[a-zA-Z0-9]+\/[a-zA-Z0-9]+:[a-zA-Z0-9]+:[a-zA-Z]+ user</div>
<div><font face="Times New Roman"> </font></div>
<div>Is there a simple way to math " update:10.94.200.210@pts/0:syslogtest:"</div>
<div> </div>
<div>Thank you very much again‼‼!</div>
<div> </div>
<div>VL</div>
<div><font face="Times New Roman"> </font></div>
<a name="m_25411158935480782______replyseparator"></a>
<div>-----Original Message-----<br>
From: syslog-ng [<a href="mailto:syslog-ng-bounces@lists.balabit.hu" target="_blank">mailto:syslog-ng-bounces@lists.balabit.hu</a>] On Behalf Of <a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a><br>
Sent: 2019, March, 01 7:00 AM<br>
To: <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a><br>
Subject: syslog-ng Digest, Vol 167, Issue 1</div>
<div><font face="Times New Roman"> </font></div>
<div>Send syslog-ng mailing list submissions to</div>
<div> <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a></div>
<div><font face="Times New Roman"> </font></div>
<div>To subscribe or unsubscribe via the World Wide Web, visit</div>
<div> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a></div>
<div>or, via email, send a message with subject or body 'help' to</div>
<div> <a href="mailto:syslog-ng-request@lists.balabit.hu" target="_blank">syslog-ng-request@lists.balabit.hu</a></div>
<div><font face="Times New Roman"> </font></div>
<div>You can reach the person managing the list at</div>
<div> <a href="mailto:syslog-ng-owner@lists.balabit.hu" target="_blank">syslog-ng-owner@lists.balabit.hu</a></div>
<div><font face="Times New Roman"> </font></div>
<div>When replying, please edit your Subject line so it is more specific than "Re: Contents of syslog-ng digest..."</div>
<div> </div>
<div> </div>
<div>Today's Topics:</div>
<div> </div>
<div> 1. unofficial syslog-ng 3.20 packages for Debian/Ubuntu</div>
<div> (Laszlo Budai)</div>
<div> 2. Re: How to use regex in syslog-ng.conf (Péter)</div>
<div> 3. Re: How to use regex in syslog-ng.conf (Fabien Wernli)</div>
<div> </div>
<div> </div>
<div>----------------------------------------------------------------------</div>
<div> </div>
<div>Message: 1</div>
<div>Date: Fri, 1 Mar 2019 10:09:03 +0000</div>
<div>From: Laszlo Budai <<a href="mailto:laszlo.budai@outlook.com" target="_blank">laszlo.budai@outlook.com</a>></div>
<div>To: Syslog-ng users' and developers' mailing list</div>
<div> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>></div>
<div>Subject: [syslog-ng] unofficial syslog-ng 3.20 packages for</div>
<div> Debian/Ubuntu</div>
<div>Message-ID:</div>
<div> <<a href="mailto:VI1PR0601MB2237CC24E8908466F6ABC1B38E760@VI1PR0601MB2237.eurprd06.prod.outlook.com" target="_blank">VI1PR0601MB2237CC24E8908466F6ABC1B38E760@VI1PR0601MB2237.eurprd06.prod.outlook.com</a>></div>
<div> </div>
<div>Content-Type: text/plain; charset="iso-8859-1"</div>
<div> </div>
<div>Hi,</div>
<div> </div>
<div> </div>
<div>syslog-ng 3.20.1[1] packages are available in OBS repo[2].</div>
<div> </div>
<div>List of supported OSs:</div>
<div>* Debian 8.0</div>
<div>* Debian 9.0 [including armv7l]</div>
<div>* Ubuntu 14.04</div>
<div>* Ubuntu 16.04</div>
<div>* Ubuntu 16.10</div>
<div>* Ubuntu 17.04</div>
<div>* Ubuntu 17.10</div>
<div>* Ubuntu 18.04</div>
<div>* Ubuntu 18.10</div>
<div> </div>
<div> </div>
<div>Install</div>
<div>-------</div>
<div> </div>
<div>example: Debian 9.0</div>
<div> </div>
<div>1. get release key</div>
<div>wget -qO - <a href="http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Debian_9.0/Release.key" target="_blank">http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Debian_9.0/Release.key</a> | sudo apt-key add -</div>
<div> </div>
<div>2. add repo to APT sources</div>
<div>eg.: /etc/apt/sources.list.d/syslog-ng-obs.list</div>
<div>deb <a href="http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Debian_9.0" target="_blank">http://download.opensuse.org/repositories/home:/laszlo_budai:/syslog-ng/Debian_9.0</a> ./</div>
<div> </div>
<div>Then `apt-get update` and `apt-get install syslog-ng-core`</div>
<div> </div>
<div> </div>
<div>Links</div>
<div>--------</div>
<div>[1] <a href="https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1" target="_blank">https://github.com/balabit/syslog-ng/releases/tag/syslog-ng-3.20.1</a></div>
<div>[2] <a href="https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-ng-3.20" target="_blank">https://build.opensuse.org/package/show/home:laszlo_budai:syslog-ng/syslog-ng-3.20</a></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>regards,</div>
<div>Laszlo Budai</div>
<div>-------------- next part --------------</div>
<div>An HTML attachment was scrubbed...</div>
<div>URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/2e2934b4/attachment-0001.html" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/2e2934b4/attachment-0001.html</a>></div>
<div> </div>
<div>------------------------------</div>
<div> </div>
<div>Message: 2</div>
<div>Date: Fri, 1 Mar 2019 11:34:00 +0100</div>
<div>From: Péter, Kókai <<a href="mailto:peter.kokai@oneidentity.com" target="_blank">peter.kokai@oneidentity.com</a>></div>
<div>To: "Syslog-ng users' and developers' mailing list"</div>
<div> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>></div>
<div>Subject: Re: [syslog-ng] How to use regex in syslog-ng.conf</div>
<div>Message-ID:</div>
<div> <<a href="mailto:CABxQCpjDdn3JSwA1btkF7GZGLX_De0qGq+i9GtOcz8JWjhgpzA@mail.gmail.com" target="_blank">CABxQCpjDdn3JSwA1btkF7GZGLX_De0qGq+i9GtOcz8JWjhgpzA@mail.gmail.com</a>></div>
<div>Content-Type: text/plain; charset="utf-8"</div>
<div> </div>
<div>Hello,</div>
<div> </div>
<div>Based on your example one possible solution could be: match("cmd=username [a-z]+ privilege 15" value("MESSAGE"));</div>
<div> </div>
<div>You could also check out the syslog-ng administrator guide, it covers a lot of possibilities:</div>
<div><font face="Times New Roman"><a href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.20/administration-guide/63#TOPIC-1122022" target="_blank"><font face="Calibri">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.20/administration-guide/63#TOPIC-1122022</font></a></font></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>--</div>
<div>Kokan</div>
<div> </div>
<div>On Thu, Feb 28, 2019 at 3:50 PM Lin, Victor <<a href="mailto:victor.lin@rbc.com" target="_blank">victor.lin@rbc.com</a>> wrote:</div>
<div> </div>
<div>> Dear all,</div>
<div>></div>
<div>> I am trying to use regex in syslog-ng.conf without success L</div>
<div>></div>
<div>> Below is from my filter</div>
<div>></div>
<div>> match("cmd=username toto privilege 15", value("MESSAGE"));</div>
<div>></div>
<div>> could you please let me know how could I replace username toto with </div>
<div>> regex ? tried /w+ , but didn’t passing through</div>
<div>></div>
<div>> Thank you very much for your instruction!</div>
<div>></div>
<div>> VL</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> ______________________________________________________________________</div>
<div>> _</div>
<div>></div>
<div>> If you received this email in error, please advise the sender (by </div>
<div>> return email or otherwise) immediately. You have consented to receive </div>
<div>> the attached electronically at the above-noted email address; please </div>
<div>> retain a copy of this confirmation for future reference.</div>
<div>></div>
<div>> Si vous recevez ce courriel par erreur, veuillez en aviser </div>
<div>> l'expéditeur immédiatement, par retour de courriel ou par un autre </div>
<div>> moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par </div>
<div>> voie électronique à l'adresse courriel indiquée ci-dessus; veuillez </div>
<div>> conserver une copie de cette confirmation pour les fins de reference future.</div>
<div>></div>
<div>></div>
<div>> ______________________________________________________________________</div>
<div>> ________ Member info: </div>
<div>> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a></div>
<div>> Documentation:</div>
<div>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a></div>
<div>> FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a></div>
<div>></div>
<div>></div>
<div>-------------- next part --------------</div>
<div>An HTML attachment was scrubbed...</div>
<div>URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/7921ceb3/attachment-0001.html" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/7921ceb3/attachment-0001.html</a>></div>
<div> </div>
<div>------------------------------</div>
<div> </div>
<div>Message: 3</div>
<div>Date: Fri, 1 Mar 2019 12:50:50 +0100</div>
<div>From: Fabien Wernli <<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></div>
<div>To: "Syslog-ng users' and developers' mailing list"</div>
<div> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a>></div>
<div>Subject: Re: [syslog-ng] How to use regex in syslog-ng.conf</div>
<div>Message-ID: <<a href="mailto:20190301115050.hs3d5vjf27a7lwfe@ccfawe.in2p3.fr" target="_blank">20190301115050.hs3d5vjf27a7lwfe@ccfawe.in2p3.fr</a>></div>
<div>Content-Type: text/plain; charset="iso-8859-1"</div>
<div> </div>
<div>On Fri, Mar 01, 2019 at 11:34:00AM +0100, Péter, Kókai wrote:</div>
<div>> Hello,</div>
<div>> </div>
<div>> Based on your example one possible solution could be: </div>
<div>> match("cmd=username [a-z]+ privilege 15" value("MESSAGE"));</div>
<div>> </div>
<div>> You could also check out the syslog-ng administrator guide, it covers </div>
<div>> a lot of possibilities:</div>
<div>> <a href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-sourc" target="_blank">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-sourc</a></div>
<div>> e-edition/3.20/administration-guide/63#TOPIC-1122022</div>
<div> </div>
<div>also, prefer single quotes over double quotes: will make escaping easier</div>
<div> </div>
<div>-------------- next part --------------</div>
<div>A non-text attachment was scrubbed...</div>
<div>Name: smime.p7s</div>
<div>Type: application/x-pkcs7-signature</div>
<div>Size: 2801 bytes</div>
<div>Desc: not available</div>
<div>URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/21433a6a/attachment-0001.bin" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20190301/21433a6a/attachment-0001.bin</a>></div>
<div> </div>
<div>------------------------------</div>
<div> </div>
<div>Subject: Digest Footer</div>
<div> </div>
<div>_______________________________________________</div>
<div>syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank">syslog-ng@lists.balabit.hu</a> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a></div>
<div><font face="Times New Roman"> </font></div>
<div><font face="Times New Roman"> </font></div>
<div>------------------------------</div>
<div> </div>
<div>End of syslog-ng Digest, Vol 167, Issue 1</div>
<div>*****************************************</div>
<div><font face="Times New Roman"> </font></div>
</span></font>
<p><font style="font-size:9pt">_______________________________________________________________________</font></p>
<p><font style="font-size:9pt">If you received this email in error, please advise the sender (by return email or otherwise) immediately. You have consented to receive the attached electronically at the above-noted email address; please retain a copy of this confirmation for future reference.</font></p>
<p><font style="font-size:9pt">Si vous recevez ce courriel par erreur, veuillez en aviser l'expéditeur immédiatement, par retour de courriel ou par un autre moyen. Vous avez accepté de recevoir le(s) document(s) ci-joint(s) par voie électronique à l'adresse courriel indiquée ci-dessus; veuillez conserver une copie de cette confirmation pour les fins de reference future. </font></p>
<p></p></div>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>