On Fri, 2008-07-11 at 01:19 +0000, Fegan, Joe wrote:
Your regular expressions do look ok - I tested them interactively in tclsh and the "wireless" one does match hostr01.w01.primary while the "router" one does not. So this does seems like a syslog-ng oddity.
fegan> tclsh % set hn {hostr01.w01.primary} hostr01.w01.primary % % set router {^[0-9a-zA-Z\-]+\.r[0-9]{2}\.([0-9a-zA-Z\-]+)$} ^[0-9a-zA-Z\-]+\.r[0-9]{2}\.([0-9a-zA-Z\-]+)$ % % regexp $router $hn 0 % % set wireless {^[0-9a-zA-Z\-]+\.w[0-9]{2}\.([0-9a-zA-Z\-]+)$} ^[0-9a-zA-Z\-]+\.w[0-9]{2}\.([0-9a-zA-Z\-]+)$ % % regexp $wireless $hn 1 % exit fegan>
Note that syslog-ng strings use '\' as an escape character, just like in C, so you need to escape \\ to produce a single '\' character in the regexp. I know this is bad, but changing the quoting style is not really possible without breaking a lot of people's configuration files. "{^[0-9a-zA-Z\\-]+\\.r[0-9]{2}\\.([0-9a-zA-Z\\-]+)$}" Maybe a note in the documentation about this would be useful. Ccing the doc. team about this.
-- Bazsi