Hello,

 

I’ve previously had a very simple regex list configured for Cisco ASA devices to deliver email alerts on routing changes in our network, which was configured thus:-

 

filter f_sev1 { match("%ASA-3-622001"); };

 

…which works just fine. Wanting to expand this list a bit, and aware that scaling regex matching up is going to incur performance issues, I’ve thought that an “in-list” expression file might have been a better approach, and as such have configured the following:-

 

filter f_sev1 { in-list("/etc/syslog-ng/email-match-list.list", value("PROGRAM")); };

 

…where “PROGRAM” is (I believe) the applicable part of the code that matches to the Cisco "%ASA-3-622001" part of the message. The whitelist has the following entries (as an example):-

 

%DUAL-5-NBRCHANGE

%ASA-3-622001

%SPANTREE-5-TOPOTRAP

%SPANTREE-5-ROOTCHANGE

%ASA-5-111010

 

I am not getting any matches here, however. What am I missing?

 

Thanks very much in advance,

 

Damian