Hi,
It is simple to revert to the old behaviour, and maybe we should just do that.
Using the amount of literal text in the pattern as the sort order of specifism is a good idea, this could perhaps be added to pdbtool merge.
The question is whether the preference over full matches over partial ones should stay as an option or be dropped entirely.
What do you think?
Hi Evan,
On Tue, Sep 22, 2015 at 09:49:43AM -0700, Evan Rempel wrote:
> I propose that the PatternDB preference be changed from the pattern with the longest MATCH to the pattern with the largest amount of static content.
I fully agree with Evan here: it should work as described in this sentence.
That being said, I'm not so sure about the Status quo with 3.7.1.
Maybe Balázs can give some more details on the change?
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq