Re: [syslog-ng] issue with rewrite. Please help.

On Mon, 2012-06-18 at 21:23 +0800, Balla, Hithendra (EXT-Other - IN/Bangalore) wrote:

Hi Balint, Thanks for the reply.

I tried the below rewrite

rewrite r_solaris { subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") type("pcre") flags(dont-store-matches)); };

It works for auth.info, but it does not work with local7.info or local6.info as the regex does not handle numerals in the facility field. I tried changing it as follows (i.e. added [0-9] before .)., but with this, this dumps core. Addition of any numeral in this position results in a core dump

subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE")

Getting a core is not nice. Can you post a backtrace? -- Bazsi