I only got warnings and not errors, when trying to use
this in my XML file:
<value
name="seq-matches">su(pam_unix)</value>
how did you execute syslog-ng so you got the error above?
The only case where this is an error, if you are using
"@version: 4.0"
This was the warning produced (both by syslog-ng and
pdbtool):
WARNING: the template specified in value()/<value>
options for your grouping-by() or db-parser() configuration
has been changed to support typing from syslog-ng 4.0. You
are using an older config version and your template contains
an unrecognized type-cast, probably a parenthesis in the
value field. This will be interpreted in the `type(value)'
format in future versions. Please add an explicit string()
cast as shown in the 'fixed-value' tag of this log message
or remove the parenthesis. The value will be processed as a
'string' expression; config-version='3.38',
name='seq-matches', value='su(pam_unix)',
fixed-value='string(su(pam_unix))'
I chose to embed the type-hint field in the body of the
<value> tag, as this is the format that is used
everywhere else. I might be able to bump the db-parser XML
file version, in the file header:
<patterndb version='5'>
I could bump this up to version 6, in which case you'd
only need to add the type-hint if you also bumped the
version number. That I think is doable.
On the documentation front, there's an XML schema in the
source tree under the doc/xsd/ directory for each version of
patterndb, and I assume the documentation also has a chapter
on the db-parser() format.