On Fri, 2011-09-02 at 14:44 -0500, Matt Zagrabelny wrote:

Hi,

I've looked through the OSE reference PDF and have a question about the program filter regex.

I've done some experimentation and I would have thought the following to work:

I'm trying to match puppet programs in syslog-ng (version 3.1)

log entry: Sep 2 14:36:25 hornet puppet-agent[15008]: Finished catalog run in 0.75 seconds

This filter works: filter f_puppet { program("puppet.*"); };

But this does not: filter f_puppet { program("puppet"); };

For things like grep, perl, and ruby the latter regex ("puppet") would have matched the program string "puppet-agent". Syslog-ng does not seem to behave the same way. Is there a way to get the grep/perl behavior? If not, it seems like it doesn't follow the conventions of other free software. Would anyone consider it a wishlist bug?

this should work. syslog-ng uses the regexp library built into the system libc to perform matching. I've just tried and it indeed works for me. Sorry for the late answer. -- Bazsi