Re: [syslog-ng]syntax for escaped characters

On Thu, 2005-02-24 at 16:28 -0500, Mike Pepe wrote:

OK, I'm trying to figure out what the correct syntax for a match is.

I'm trying to match crond(pam_unix)

filter f_cron_pam { match("crond(pam_unix)"); };

Doesn't match.

filter f_cron_pam { match("crond\(pam_unix\)"); };

Doesn't match.

something about the parenthesis it doesn't like, because:

filter f_cron_pam { match("crond") and match("pam_unix"); };

does match. It's just kind of an ugly way around it.

Anyone know what the right way to do this is?

the string syntax is the same as in C, e.g. '\' is used to escape characters, e.g. '\(' is the equivalent of '(' which is a special character in eregexps. You'll need match("crond\\(pam_unix\\)") -- Bazsi