On Thu, Jun 13, 2002 at 02:19:22PM -0400, Clayton L. Scott wrote:

Syslog-ng: 1.5.18 and 1.4.11

If I have a message that looks like this:

Jun 3 00:16:52 X.X.X.X/X.X.X.X rido-ott[System]: request for unserviced tcp:X.X.X.X-25 from X.X.X.X denied

if I want to match this part [System]: request for unserviced

I have to leave out the leading '['.

eg

match("[System]: request for unserviced") will not

but

match("System]: request for unserviced") will

Is this a bug in the matching grammar? If I used normal regexp syntax and escape the '[' as in '\[' is stiil won't work.

quotation marks behave just like do in the shell, so '\' is interpreted by the quotation mark itself. To insert a \ in the string, you must duplicate it like this: match("\\[System\\]: request for unserviced") -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1