I saw this as well, and replaced all the underscores with dashes. This problem started with 1.6.x. Richard -----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Wednesday, March 03, 2004 11:08 AM To: syslog-ng@lists.balabit.hu Subject: RE: [syslog-ng]$HOST $YEAR, etc not working correctly.. --- Balazs Scheidler <bazsi@balabit.hu> wrote:
2004-02-25, sze keltezéssel 21:16-kor Doug Peterson ezt írta:
--- Balazs Scheidler <bazsi@balabit.hu> wrote:
strange, the problem seems to be that you reference marcos like $YEAR_$MONTH_
which is interpeted as $YEAR_ concatenated with $MONTH_, these are undefined macros, thus are expanded to an empty string.
Try escaping the underscore with a backslash, like
$YEAR\_$MONTH\_
I escaped out the _ characters, and am still getting the same results with 1.6.2.. files are being written as messages_25 (25 being $DAY)
My rules now look like this:
destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/messages\_$HOST\_$YEAR\_$MONTH\_$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); };
This definitely works here. syslog-ng uses gperf to generate a lookup hash for macro names. A generated file is shipped with syslog-ng to avoid the build dependency on gperf, but maybe it was regenerated for some reason.
This area had a bug in 1.6.0rc2 (before or after this version should be ok), are you sure you are running 1.6.2?
-- Bazsi
I am running: syslog-ng 1.6.0rc1 currently, and that is the most recent version that works (I'm not sure if I tried rc2). When I install 1.6.2 I encounter the macro problem, even when I escape the underscore. __________________________________ Do you Yahoo!? Yahoo! Search - Find what youre looking for faster http://search.yahoo.com _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html