Hi all, Is it possible to configure two or more conditions under an action?? For example: <action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' "> This action it doesn't works ... I am using syslog-ng 3.3.5 Thanks.
On Wed, Jun 6, 2012 at 8:48 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
Hi all,
Is it possible to configure two or more conditions under an action?? For example:
<action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' ">
This action it doesn't works ... I am using syslog-ng 3.3.5
Thanks.
Nothing??
On Fri, Jun 8, 2012 at 7:53 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
On Wed, Jun 6, 2012 at 8:48 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
Hi all,
Is it possible to configure two or more conditions under an action?? For example:
<action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' ">
This action it doesn't works ... I am using syslog-ng 3.3.5
Thanks.
Nothing??
Please is it possible to do this?? I am doing tests and it seems not ... but I am not sure ...
I have never done this, however, the manual states "condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter can include macros and name-value pairs extracted from the message." so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and". So I think your condition should be <action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' "> you may need parenthesis, so <action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') "> Hope this works for you. Evan. C. L. Martinez wrote:
On Fri, Jun 8, 2012 at 7:53 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
On Wed, Jun 6, 2012 at 8:48 AM, C. L. Martinez <carlopmart@gmail.com> wrote:
Hi all,
 Is it possible to configure two or more conditions under an action?? For example:
<action trigger="match" condition=" '${first_field}@1' == 'something_1' & '${second_field}' == 'something_2' ">
This action it doesn't works ... I am using syslog-ng 3.3.5
Thanks. Nothing??
Please is it possible to do this?? I am doing tests and it seems not ... but I am not sure ... ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Evan Rempel erempel@uvic.ca Senior Systems Administrator 250.721.7691 Unix Services, University Systems, University of Victoria
On Thu, Jun 14, 2012 at 5:21 PM, Evan Rempel <erempel@uvic.ca> wrote:
I have never done this, however, the manual states
"condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter can include macros and name-value pairs extracted from the message."
so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and".
So I think your condition should be
<action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' ">
you may need parenthesis, so
<action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') ">
Hope this works for you.
Evan.
Many thanks Evan, but it doesn't seems to work under 3.3.5 ...Exists some option to debug conditions??
C. L. Martinez wrote:
On Thu, Jun 14, 2012 at 5:21 PM, Evan Rempel <erempel@uvic.ca> wrote:
I have never done this, however, the manual states
"condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter can include macros and name-value pairs extracted from the message."
so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and".
So I think your condition should be
<action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' ">
you may need parenthesis, so
<action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') ">
Hope this works for you.
Evan.
Many thanks Evan, but it doesn't seems to work under 3.3.5 ...Exists some option to debug conditions??
Anyone else want to comment? This should work - bug?
On Monday, June 18, 2012 21:02 CEST, Evan Rempel <erempel@uvic.ca> wrote:
C. L. Martinez wrote:
On Thu, Jun 14, 2012 at 5:21 PM, Evan Rempel <erempel@uvic.ca> wrote:
I have never done this, however, the manual states
"condition: A syslog-ng filter expression. The action is performed only if the message matches the filter. The filter can include macros and name-value pairs extracted from the message."
so if you look at the syntax for filters, you do not use the & for logical and, you use the word "and".
So I think your condition should be
<action trigger="match" condition=" '${first_field}@1' == 'something_1' and '${second_field}' == 'something_2' ">
you may need parenthesis, so
<action trigger="match" condition=" '(${first_field}@1' == 'something_1') and ('${second_field}' == 'something_2') ">
Hope this works for you.
Evan.
Many thanks Evan, but it doesn't seems to work under 3.3.5 ...Exists some option to debug conditions??
Anyone else want to comment? This should work - bug?
Hi, I have asked Bazsi and Algernon to take a look at the code to check if it should work as supposed, or is buggy. I don't know when they will have time to check it, though, Robert
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (3)
-
C. L. Martinez
-
Evan Rempel
-
Fekete Róbert