I'm working with syslog-ng-4.1.1-1 and attempting to validate a
patterndb xml file.

I understand that the pattern parsers will produce type aware values,
but it seems that if the tests in the patterndb xml file do not contain
any type information that all tests against non-string values will fail.

Is that intended behavior to require type information on all tests?

If that is by design I propose that this makes thing difficult because
@NUMBER:var@ and @STRING:var@ will both successfully parse the same
value out of the syslog message, but the test would now have to be
different. Tools that programmatically produce the patterndb need to
become a lot smarter.

Can anyone comment on this behavior?

When attempting to validate the attached patterndb.xml file I get the error

Testing message: program='xinetd' message='EXIT: gsiftp status=0
pid=23133 duration=0(sec)'
  Wrong match name='status', value='0', type='integer', expected='0',
expected_type='string'
  Wrong match name='sec', value='0', type='integer', expected='0',
expected_type='string'
  Wrong match name='pid', value='23133', type='integer',
expected='23133', expected_type='string'


--
Evan
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq