On Sun, 2011-02-20 at 17:18 +0100, Valentijn Sessink wrote:
Op 20-02-11 14:43, Balazs Scheidler schreef:
Is this how it's meant to be? hmm.. no, @1 should be the one before the current message. I've just tried to reproduce this with 3.3 but it works fine.
Could it have something to do with my context-scope="host"?
... seems to be work OK in 3.2 too. how did you reproduce this exactly?
Please find attached the postfix-maildelivery pattern that I have been experimenting with. Trying to match the "queuid" within messages only worked when using "@1" - which I found rather strange.
Oh, for the record: syslog-ng 3.2.2 Installer-Version: 3.2.2 Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.2#master#1d3f396485eb47b1ff6aa18ac4f1c4cd51c0ea4c Compile-Date: Feb 9 2011 13:14:58 Enable-Threads: on Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-Sun-STREAMS: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: off Enable-SSL: on Enable-SQL: on Enable-Linux-Caps: off Enable-Pcre: off Enable-Pacct: off
Please note that the attached pattern is work (once) in progress. Anyone who would install and use this on a live machine is an idiot just like me ;)
To begin with, the "program" pattern on top of the file is missing, which is not very convenient for a live server :)
Development stalled when the "grep" function wouldn't work; because the pattern works for really, really simple messages but it fails completely for messages with multiple recipients (and possibly other fail factors). Trying to have "grep" output multiple values for one variable didn't work. If you know how to do that, please tell me.
Yes, that's the problem. hmm.. The XML shouldn't do this, as this is a text node, not an attribute node and there '"' doesn't matter. I'll have to dig deeper.
OK, so I gather: grep is not working right now?
Here's a fix for $(grep) (and also $(if)), just pushed so it's hot :) commit 045be28278fa28cb6be8e8e8063a157efaef40ef Author: Balazs Scheidler <bazsi@balabit.hu> Date: Tue Mar 1 21:19:19 2011 +0100 templates: added syntactic sugar for using filter expressions in template functions $(grep) and $(if) take a filter expression as argument, however such expressions may require quoted strings. The default behaviour of the parser in this case was to remove quotes. This is fixed by not caring about quotes within parenthesises, so $(grep) beomes usable with this syntax: $(grep ('$FACILITY' == 'level4') $MSG) This works since the parentheses around the filter expression is nicely processed by the filter anyway, and the template function arg parser ignores quotes in this case. Reported-By: Valentijn Sessink <valentyn@blub.net> Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> -- Bazsi