[Bug 225] New: patterndb can not use HOST as variable in pattern
https://bugzilla.balabit.com/show_bug.cgi?id=225 Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0 This fails in the patterndb test --validate with the error ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX) <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule> but this succeeds and replaces the HOST macro <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule> I would expect the both to work. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
Hi Evan, My guess would be that HOST is a reserved macro name, but a developer should confirm this. (And if this is the problem, I should clarify this in the docs.) Robert On 03/05/2013 08:34 PM, bugzilla@bugzilla.balabit.com wrote:
https://bugzilla.balabit.com/show_bug.cgi?id=225
Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0
This fails in the patterndb test --validate with the error
ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX)
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns>
<examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule>
but this succeeds and replaces the HOST macro
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule>
I would expect the both to work.
The docs clearly state that HOST is a soft macro and can be modified, which is confirmed by the fact that the second pattendb rule works and sets the HOST macro. There is no mention of any reserved words for the optional name in a parser, and based on its position in the pattern it is definitively an optional name rather than a parser name. It is for these reasons that I consider this a bug, rather than an undocumented limitation. Evan. On 03/06/2013 12:06 AM, Fekete Robert wrote:
Hi Evan,
My guess would be that HOST is a reserved macro name, but a developer should confirm this.
(And if this is the problem, I should clarify this in the docs.)
Robert
On 03/05/2013 08:34 PM, bugzilla@bugzilla.balabit.com wrote:
https://bugzilla.balabit.com/show_bug.cgi?id=225
Summary: patterndb can not use HOST as variable in pattern Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0
This fails in the patterndb test --validate with the error
ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX)
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:HOST@</pattern> </patterns>
<examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="HOST">some.host.here</test_value> </test_values> </example> </examples> </rule>
but this succeeds and replaces the HOST macro
<rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic"> <patterns> <pattern>replace HOST with @ANYSTRING:tempHost@</pattern> </patterns> <values> <value name="HOST">$tempHost</value> </values> <examples> <example> <test_message program="something">replace HOST with some.host.here</test_message> <test_values> <test_value name="tempHost">some.host.here</test_value> </test_values> </example> </examples> </rule>
I would expect the both to work.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Evan Rempel erempel@uvic.ca Senior Systems Administrator 250.721.7691 Data Centre Services, University Systems, University of Victoria
https://bugzilla.balabit.com/show_bug.cgi?id=225 --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2013-03-12 21:52:29 --- This patch pushed to github, branch f/fixed-setting-host-in-patterns should fix this. Algernon, can you pls pull this? Thanks. commit 3d2d2d3de8fc3599d90c94d006c30c118f05c731 Author: Balazs Scheidler <bazsi@balabit.hu> Date: Tue Mar 12 21:51:00 2013 +0100 patterndb: fixed a failed assertion when using builtin values in a pattern An assertion was failed when using a db-parser() pattern that contains a builtin name-value pair, like: replace HOST with @ANYSTRING:HOST@ This is fixed by this patch. Reported-By: Evan Rempel <erempel@uvic.ca> Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> diff --git a/lib/logmsg.h b/lib/logmsg.h index 966c89e..b09b870 100644 --- a/lib/logmsg.h +++ b/lib/logmsg.h @@ -203,6 +203,12 @@ gboolean log_msg_is_handle_macro(NVHandle handle); gboolean log_msg_is_handle_sdata(NVHandle handle); gboolean log_msg_is_handle_match(NVHandle handle); +static inline gboolean +log_msg_is_handle_settable_with_an_indirect_value(NVHandle handle) +{ + return (handle < LM_V_MAX); +} + const gchar *log_msg_get_macro_value(LogMessage *self, gint id, gssize *value_len); static inline const gchar * diff --git a/modules/dbparser/patterndb.c b/modules/dbparser/patterndb.c index 243ce03..09571b6 100644 --- a/modules/dbparser/patterndb.c +++ b/modules/dbparser/patterndb.c @@ -1302,7 +1302,7 @@ log_db_add_matches(LogMessage *msg, GArray *matches, NVHandle ref_handle, const log_msg_set_value(msg, match->handle, match->match, match->len); g_free(match->match); } - else if (ref_handle != LM_V_NONE) + else if (ref_handle != LM_V_NONE && log_msg_is_handle_settable_with_an_indirect_value(match->handle)) { log_msg_set_value_indirect(msg, match->handle, ref_handle, match->type, match->ofs, match->len); } -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=225 --- Comment #2 from Evan Rempel <erempel@uvic.ca> 2013-03-28 17:35:54 --- I applied this patch to 3.4.1 (unpatched release) and it did not address the issue. pdbtool match --program XXX -pdb mypatterns.xml -M 'message that would match' I get ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=225 --- Comment #3 from Balazs Scheidler <bazsi@balabit.hu> 2013-03-28 21:09:10 --- the condition in the function is reversed, should check if handle is larger or equal to LM_V_MAX -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=225 --- Comment #4 from Evan Rempel <erempel@uvic.ca> 2013-03-28 21:44:36 --- Thanks, reversing that function seems to make it work. Now on to bug 229 :-) -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=225 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu Resolution| |FIXED Status|NEW |RESOLVED --- Comment #5 from Gergely Nagy <algernon@balabit.hu> 2013-03-30 10:57:11 --- Better later than never, I applied the fixed patch to 3.4 master. Thanks for the report and the fix too! -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (3)
-
bugzilla＠bugzilla.balabit.com
-
Evan Rempel
-
Fekete Robert