On Sat, 2010-11-06 at 20:13 +0100, Fekete Róbert wrote:
On Saturday, November 06, 2010 00:40 CET, Matthew Hall <mhall@mhcomputing.net> wrote:
I'm surprised it doesn't handle doubled delimiters right.
However I am likewise stumped. I can't find any explanation anywhere in the Balabit docs which explain what escape-* options do specifically. You´re right, that is missing. I´ll hunt down what they do, and add it to the docs.
@Bill: I can think of two possibilities that might do what you´re looking for: 1. In your template, try to specify a default value for your macros, for example, to specify a dash: {$APACHE.REFERRER:-} The problem with this is that it might not work - default values probably work only during parsing, and not when the macro is used is a template, but I think it is worth a try. If they were implemented in a universal way, it might work.
Robert, I don't exactly understand what refer to here. The default expansion work everywhere a template is used. E.g. if you have an empty value, you can assign a default to it within the template. But when expanding a template an undefined name-value pair becomes an empty string. E.g. ${APACHE.REFERER} and ${APACHE.REFERER:-} is the same, since if APACHE.REFERER is not defined both become the empty string. And if it is defined, both become the value stored in APACHE.REFERER.
2. In syslog-ng OSE 3.2, you can use template functions and other operators to check and compare macro values. You would need to use the "if" template function to return a dash or other suitable value if your macros are empty (""). So instead of $APACHE.REFERRER, your template would look something like: $(if ("${APACHE.REFERRER}" == "") "-" $APACHE.REFERRER)
See http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid... and http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guid... for details.
-- Bazsi