I have just found the answer to my own question by trial and error:  @@
 
Peter


From: Peter Mills
Sent: 17 September 2010 09:56
To: syslog-ng@lists.balabit.hu.
Cc: Sam Moore
Subject: Matching against an embedded @

Since @ is a special character, how do you match against strings containing an @?  Do you escape them e.g. \@ in order to parse them correctly? I am trying to skip over/match the string
 
[wx-event@juniper.net
 
and have had no success.
 
Thanks
 
Peter
 
root@nagios-collector:/opt/syslog-ng/var# /opt/syslog-ng/bin/pdbtool match -D -c -p /opt/syslog-ng/var/db/patterns/v1/test2.xml  -M "- - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime="1284641119" metric="Primary Reg Server Unreachable" sev="major" type="sys"] REG: Self registration failed. IP=192.168.61.242"
Pattern matching part:
- -
WXC-@IPv4:.wxc.host_ip=192.168.61.202@ @STRING:.wxc.process=register@ @NUMBER:.wxc.pid=1102@ @ANYSTRING:rest=[wx-event@juniper.net eventtime=1284641119 metric=Primary@
Matching part:
- - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime=1284641119 metric=Primary
Values:
MESSAGE=- - WXC-192.168.61.202 register 1102 [wx-event@juniper.net eventtime=1284641119 metric=Primary
.classifier.class=system
.classifier.rule_id=1
.wxc.host_ip=192.168.61.202
.wxc.process=register
.wxc.pid=1102
rest=[wx-event@juniper.net eventtime=1284641119 metric=Primary

Imtech Telecom Global is a limited company registered in England and Wales. Registered number: GB04407184. Registered office: Viables 3, Jays Close, Basingstoke, Hampshire, RG22 4BS.
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________