syslog-ng 4.2.0 changed the interpretation of regexp
Prior to syslog-ng 4.2.0 I was able to use a filter specified as match("ABC\|DEF" value("MESSAGE")) to match the exact string ABC|DEF in the MESSAGE After upgrading to 4.2.0 this will match either ABC or DEF in the MESSAGE To match an exact string of ABC|DEF I now need to escape both the backslash and the pipe match("ABC\\\|DEF" value("MESSAGE")) I can't find anything in the release notes. Of course I can easily solve this with single quotes, but more complex examples would not be so straight forward. Can someone confirm that this was intentional, or if this is a bug. -- Evan
Hi Evan, I'm pretty sure this is due to the change to libpcre2
libpcre2 was introduced at version 4.0 (was it?) and this issue did not exist in version 4.1.1 and only started in 4.2.0. Evan. On 2023-09-07 01:00, Fabien Wernli wrote:
Hi Evan,
I'm pretty sure this is due to the change to libpcre2
Pcre2 migration happened in 4.3.0 and not in 4.2.0, are you sure that's where the change happened? On Thu, Sep 7, 2023, 15:01 Evan Rempel <erempel@uvic.ca> wrote:
libpcre2 was introduced at version 4.0 (was it?) and this issue did not exist in version 4.1.1 and only started in 4.2.0.
Evan.
On 2023-09-07 01:00, Fabien Wernli wrote:
Hi Evan,
I'm pretty sure this is due to the change to libpcre2
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
The issue definitely started the n 4.2. And is documented to work this way (broken by my description). When changing my configs to follow the documentation (using single quotes or escaping the back slash) it all works correctly. The end result is that everything is working as documented. This is not a bug. Thanks for the input. Evan Rempel University of Victoria On Sept 10, 2023, at 1:45 p.m., Balazs Scheidler <bazsi77@gmail.com<mailto:bazsi77@gmail.com>> wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. Pcre2 migration happened in 4.3.0 and not in 4.2.0, are you sure that's where the change happened? On Thu, Sep 7, 2023, 15:01 Evan Rempel <erempel@uvic.ca<mailto:erempel@uvic.ca>> wrote: libpcre2 was introduced at version 4.0 (was it?) and this issue did not exist in version 4.1.1 and only started in 4.2.0. Evan. On 2023-09-07 01:00, Fabien Wernli wrote:
Hi Evan,
I'm pretty sure this is due to the change to libpcre2
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
participants (3)
-
Balazs Scheidler
-
Evan Rempel
-
Fabien Wernli