On Tue, 2008-07-22 at 09:45 +0200, Jan Kreps wrote:
------------ Původní zpráva ------------ Od: Jan Kreps <krepsj@seznam.cz> Předmět: Re: [syslog-ng] Using regexp in match() Datum: 10.7.2008 10:29:35 ----------------------------------------
I'm trying to setup central syslog-ng server for my Exchange servers. On windows servers I use Epilog agent (brother of Snare) forwarding tracking logs to central syslog.
Obviously I have used bad regexp. Exchange tracking log uses tabs as delimiters. But when I saved $MSG string to text log, tabs was changed to '\011'.
So now I changed my regexp to use tabs as delimiters:
filter f_parsing { match("([^\t]*)\t([^\t]*)\t"); };
This works like charm and saves first two tab delimited fields (date and time in this case) to $1 and $2.
Some more remarks to subject.
Syslog-ng Administrator guide 1.1.1 Edition from May 2008 says on page 111:
"The regular expressions can use up to 255 regexp matches ($1 ... $255)."
and on page 112:
"Regarding braces around macro names, the following two formats are equivalent "$MSG" and "${MSG}"."
Fact is that for regexp matches greater than 9 it MUST be in ${} format. If you use for instance $12 it resolves as content of $1 + character '2'. I found that I have to use ${} syntax in ChangeLog remark for patch 137. I guess that should be stated in Admin Guide more clearly. In this respect, statement "The regular expressions can use up to 255 regexp matches ($1 ... $255)" is not true and should be corrected.
right, this should be fixed in the documentation.
And I have one question about file creation.
When something is logged a file is created according to destination(). But when I delete the file, it's not created anymore, until restart of syslog-ng. Is that correct/expected behaviour?
I run Debian Etch and syslog-ng 2.0.9-1 from unstable branch (in stable is still version 2.0.0)
Yes, you need to send the HUP signal to syslog-ng in order to reopen log files. This is the way UNIX works. (the application does not know about the deletion of a logfile) -- Bazsi