[Bug 174] New: It's unable to analyze entire string by match filter
https://bugzilla.balabit.com/show_bug.cgi?id=174 Summary: It's unable to analyze entire string by match filter Product: syslog-ng Version: 3.2.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: olegon@olegon.ru Type of the Report: --- Estimated Hours: 0.0 In my Gentoo Linux (compiled syslog-ng by source), I can't filter entire string, coming from external source. My Cisco sends string "Session terminated .....", so I can't match it by match("Session terminated","MESSAGE") nor match("Session terminated","MSGHDR"), because string splitted to PROGRAM and MESSAGE. Old behaviour allowed me to analyze entire string by "MESSAGE", and "MSGONLY" allowed to analyze only message part of string, but nowadays all of this macro points to only message part of string. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=174 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu --- Comment #1 from Gergely Nagy <algernon@balabit.hu> 2012-04-19 10:55:58 --- You can set flags(no-parse) on the source that accepts Cisco messages, and then everything will be shoveled into $MESSAGE. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=174 Oleg Kulabukhov <olegon@olegon.ru> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|NEW |RESOLVED --- Comment #2 from Oleg Kulabukhov <olegon@olegon.ru> 2012-04-19 11:10:37 --- flags(no-parse) works... Excuse me.. I'm so sorry... Tried more than two days to resolve this, including forums... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=174 Patrick <bugzilla.syslogng@feystorm.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|FIXED |INVALID --- Comment #3 from Patrick <bugzilla.syslogng@feystorm.net> 2012-04-19 13:58:19 --- Nothing was fixed, changing resolution to invalid. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
bugzilla＠bugzilla.balabit.com