[Bug 244] New: Pattern beginning with a parser never matches
https://bugzilla.balabit.com/show_bug.cgi?id=244 Summary: Pattern beginning with a parser never matches Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: major Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: bugzilla.balabit@faxm0dem.org Type of the Report: bug Estimated Hours: 0.0 It would seem the patterns beginning with parsers never match. Example: Consider the following MESSAGE: -- Puppet::Type::Package::ProviderUp2date: file /usr/sbin/up2date-nox does not exist -- The following pattern matches OK: -- <pattern>P@ESTRING:puppet_module: @file @ESTRING:puppet_file: @does not exist</pattern> -- The following pattern does not match: -- <pattern>@ESTRING:puppet_module::: @file @ESTRING:puppet_file: @does not exist</pattern> -- -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=244 --- Comment #1 from Balazs Scheidler <bazsi@balabit.hu> 2013-08-14 12:07:02 --- It does match if this is the only rule in the database, however it probably collides with one of your other rules. Patterndb currently doesn't backtrack, and if there's a conflict at a position, it simply picks the first parser and tries to go that way. If you can expect "Puppet::" as a prefix, I'd recommend to match against that as it 1) performs much better 2) avoids the collision -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=244 Evan Rempel <erempel@uvic.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |erempel@uvic.ca --- Comment #2 from Evan Rempel <erempel@uvic.ca> 2013-11-13 07:53:35 --- it does not match because @ESTRING:puppet_module::: @ requires the string to end with ":: " and there is not ":: " in the syslog line. In this ontext the : does not need to be escaped with a : Although I have not tested it @ESTRING:puppet_module:: @file @ESTRING:puppet_file: @does not exist would probably work. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com