Hi Scot,

Your founded issue seems valid. The GitHub project: syslog-ng-patterndb need some updates, to fix that warnings (Non-numeric correlation state ID found).

For the quick workaround you can add some missing "@" to the following lines in generated patterndb.xml. After that syslog-ng should start with that patterndb.xml.

install/var/patterndb.xml:209: <value name='usracct.device'>${temp.su_username}@@${temp.su_tty}</value>

install/var/patterndb.xml:587: <value name='usracct.device'>${temp.sudo_username}@@${temp.sudo_tty}</value>

install/var/patterndb.xml:616: <value name='usracct.device'>${temp.sudo_username}@@${temp.sudo_tty}</value>

install/var/patterndb.xml:643: <value name='usracct.device'>${temp.sudo_username}@@unknown</value>

Micek

On Wed, Aug 31, 2016 at 6:58 AM, Scot Needy <scotrn@gmail.com> wrote:

Can someone point me in the right direction on how to use update-patterndb for syslog-ng ?

Downloaded current git syslog-ng-patterndb to /opt/syslog-ng/etc/patterndb.d/, but not sure how to load and test it.

Am I doing something wrong ?

bin/pdbtool merge -r --glob \*.pdb -D /opt/syslog-ng/etc/patterndb.d -p /opt/syslog-ng/etc/patterndb.xml

[@ROOT] sbin/syslog-ng -f /opt/syslog-ng/etc/syslog-ng.conf

[2016-08-31T00:55:54.978717] Non-numeric correlation state ID found, assuming a literal '@' character. To avoid confusion when using a literal '@' after a macro or template function, write '@@' in the template.; Template='${temp.su_username}@${temp.su_tty}’
blah…
blah..
[2016-08-31T00:55:54.978978] Non-numeric correlation state ID found, assuming a literal '@' character. To avoid confusion when using a literal '@' after a macro or template function, write '@@' in the template.; Template='${temp.sudo_username}@unknown’

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq