[Bug 268] New: filter on tag does partial match
https://bugzilla.balabit.com/show_bug.cgi?id=268 Summary: filter on tag does partial match Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: erempel@uvic.ca Type of the Report: --- Estimated Hours: 0.0 According to the documentation ------- tags() Synopsis: tag Description: Select messages labeled with the specified tag. Every message automatically has the tag of its source in .source.<id_of_the_source_statement> format. This option is available only in syslog-ng 3.1 and later. ------------ I interpret this to mean that an exact and full match of the tag is required. I have a tag on a message of "collection.required" and a filter filter f_collection { tags("collection"); }; this filter matches the messages with the tag "collection.required" which I think is a bug. I expect this filter on only match tags that exactly match "collection". -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=268 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu AssignedTo|bazsi@balabit.hu |algernon@balabit.hu -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=268 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO --- Comment #1 from Gergely Nagy <algernon@balabit.hu> 2014-01-25 20:26:34 --- I can't reproduce it with the following config: @version: 3.4 source s_l { unix-stream("var/log" tags("foo.bar")); unix-stream("var/log2" tags("foo")); }; filter f_foo { tags("foo"); }; destination d_foo { file("var/foo-tagged.log"); }; log { source(s_l); filter(f_foo); destination(d_foo); }; When I use logger -u var/log, it will be correctly dropped, while logger -u var/log2 will arrive to var/foo-tagged.log. Running syslog-ng -Fvde also says that the filter does not match. Are you sure that something else is not tagging the message with "collection"? If you are, can you perhaps run a sample message through syslog-ng -Fvde? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=268 Evan Rempel <erempel@uvic.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |CLOSED --- Comment #2 from Evan Rempel <erempel@uvic.ca> 2014-01-27 17:27:40 --- Sorry for the trouble. I have a different pattern in my database that looked very similar, but it was correctly tagged to match the filter. I thought it was the incorrectly tagged message that went into the log file for the filter, but it was the correctly tagged one. This can be closed as not-a-bug -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=268 Evan Rempel <erempel@uvic.ca> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |INVALID --- Comment #3 from Evan Rempel <erempel@uvic.ca> 2014-01-27 17:29:29 --- this was confirmed to not be a bug. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com