The docs clearly state that HOST is a soft macro and can be modified, which is confirmed by the fact that the second pattendb rule works and sets the HOST macro. There is no mention of any reserved words for the optional name in a parser, and based on its position in the pattern it is definitively an optional name rather than a parser name. It is for these reasons that I consider this a bug, rather than an undocumented limitation. Evan. On 03/06/2013 12:06 AM, Fekete Robert wrote:
Hi Evan,
My guess would be that HOST is a reserved macro name, but a developer should confirm this.
(And if this is the problem, I should clarify this in the docs.)
Robert
On 03/05/2013 08:34 PM, bugzilla@bugzilla.balabit.com wrote:
https://bugzilla.balabit.com/show_bug.cgi?id=225
Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0
This fails in the patterndb test --validate with the error
ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX)
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns>
<examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule>
but this succeeds and replaces the HOST macro
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule>
I would expect the both to work.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Evan Rempel erempel@uvic.ca Senior Systems Administrator 250.721.7691 Data Centre Services, University Systems, University of Victoria