On Wed, 2007-04-18 at 19:33 +0200, S. Schulz wrote:
Hi, 1) I found a bug in syslog-ng-1.6.12. If i use the MSGONLY macro the first char of the message is missing.
Here is the patch: -snip-------------------------------- 426,427c426,428 < colon++; < ofs = (colon - (char *) msg->msg->data); ---
ofs = (colon - (char *) msg->msg->data) + 2; if (ofs > msg->msg->length) ofs = msg->msg->length;
-snap--------------------------------
Yes, this indeed seems to be a bug, but this does not seem to affect 2.0.x tree. Do you have some reasons to stick with 1.6.x?
2) And I have an other problem with a regexp in a filter. I want to log all messages that contains the "[ERR]" string to a separate err log. My filter, destination and log looks like this: filter f_usererr { facility(user) and match('\[ERR\]'); }; destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; log { source(s_net); filter(f_usererr); destination(d_usererr); };
What I get is a line like test[1234]:[ERR] fopen failed but also test[1234]:Event 1 or test[1234]:Released
So it seems to be that the backslash before the [ is ignored. If I change the filter to filter f_usererr { facility(user) and match('ERR\]'); }; I get only the line test[1234]:[ERR] fopen failed as expected
you need double backslashes as the first one is absorbed by the configuration parser to be able to escape apostrophes. If you need a real backslash, you need to double them like: match('\\[ERR\\]')
3) And I have a third problem with creation of a filename based on the IP destination d_usererr {file("/var/log/$SOURCEIP_$PROGRAM.err"); }; The created filename is "/var/log/bla.err" and the $SOURCEIP is missing
yes, because '_' is taken part of a word and thus syslog-ng tries to substitute the macro named "SOURCEIP_" which obviously does not exist. syslog-ng 2.0 provides an alternative, shell-like expansion syntax: destination d_usererr {file("/var/log/${SOURCEIP_}$PROGRAM.err"); }; Alternatively use something different than '_'
If I change the destination to destination d_usererr {file("/var/log/$SOURCEIP-$PROGRAM.err"); }; the created filename is "/var/log/192.168.1.1-bla.err" as expected
see above. -- Bazsi