<div dir="ltr"><div>Hi,</div><div><br></div><div>I've now tried the disable-jit example from the documentation and it does seem to work for me. I've set a breakpoint where it would do the jit compilation, and it didn't do it.</div><div><br></div><div>btw, I was using Axoflow produced documentation, which is somewhat more usable to me:<br></div><div><a href="https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/reference-regexp-types/regexp-flags-options/regexp-flags-options-pcre/">https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/reference-regexp-types/regexp-flags-options/regexp-flags-options-pcre/</a></div><div><br></div><div>This is the config I have checked:</div><div><br></div><div>```</div><div>@version: 3.32<br><br>log { <br>      source { tcp(port(2000)); };<br><br>        filter { match("(?<DN>foo)|(?<DN>bar)" value(MSG) flags(store-matches, disable-jit, dupnames)); };<br>      destination { file("/tmp/log" template("$(format-json *)\n")); };<br>};</div><div>```<br></div><div><br></div><div>I am using the latest master, but 4.4.0 should be the same. How do you know that jit is enabled?<br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Nov 21, 2023 at 10:59 AM "Tóth Attila" <<a href="mailto:atoth@atoth.sote.hu">atoth@atoth.sote.hu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I'm using syslog-ng-4.4.0 on a Gentoo system, that also employs PaX<br>
hardening. Due to the necessity to elevate restrictions on pcre2 with jit<br>
enabled, I keep it disabled for this particular installation. Syslog-ng<br>
emits error messages during startup complaining about pcre2 and jit. I had<br>
studied the manual and found the disable-jit feature.<br>
<a href="https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.30/administration-guide/72" rel="noreferrer" target="_blank">https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.30/administration-guide/72</a><br>
Maybe I'm using a wrong syntax, but syslog-ng doesn't seem to respect the<br>
option. Commenting out the jit feature in the source code works, but it<br>
would be much more comfortable to find the proper way to disable jit.<br>
<br>
Are there any other who managed to use disable-jit in action?<br>
<br>
Are there any tips or tricks aboutv what to pay attention on?<br>
<br>
Thx:<br>
Dw.<br>
-- <br>
dr Tóth Attila, Radiológus, 06-20-825-8057<br>
Attila Toth MD, Radiologist, +36-20-825-8057<br>
<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div><br clear="all"><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature">Bazsi</div>