------------ Původní zpráva ------------ Od: Jan Kreps <krepsj@seznam.cz> Předmět: Re: [syslog-ng] Using regexp in match() Datum: 10.7.2008 10:29:35 ----------------------------------------
I'm trying to setup central syslog-ng server for my Exchange servers. On windows servers I use Epilog agent (brother of Snare) forwarding tracking logs to central syslog.
Obviously I have used bad regexp. Exchange tracking log uses tabs as delimiters. But when I saved $MSG string to text log, tabs was changed to '\011'.
So now I changed my regexp to use tabs as delimiters:
filter f_parsing { match("([^\t]*)\t([^\t]*)\t"); };
This works like charm and saves first two tab delimited fields (date and time in this case) to $1 and $2.
Some more remarks to subject. Syslog-ng Administrator guide 1.1.1 Edition from May 2008 says on page 111: "The regular expressions can use up to 255 regexp matches ($1 ... $255)." and on page 112: "Regarding braces around macro names, the following two formats are equivalent "$MSG" and "${MSG}"." Fact is that for regexp matches greater than 9 it MUST be in ${} format. If you use for instance $12 it resolves as content of $1 + character '2'. I found that I have to use ${} syntax in ChangeLog remark for patch 137. I guess that should be stated in Admin Guide more clearly. In this respect, statement "The regular expressions can use up to 255 regexp matches ($1 ... $255)" is not true and should be corrected. And I have one question about file creation. When something is logged a file is created according to destination(). But when I delete the file, it's not created anymore, until restart of syslog-ng. Is that correct/expected behaviour? I run Debian Etch and syslog-ng 2.0.9-1 from unstable branch (in stable is still version 2.0.0) Greets Jan