[Bug 247] New: FEATURE: add context-id value pair
https://bugzilla.balabit.com/show_bug.cgi?id=247 Summary: FEATURE: add context-id value pair Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: bugzilla.balabit@faxm0dem.org Type of the Report: --- Estimated Hours: 0.0 It would be great to add the context-id to the message from the patterndb, e.g. ".classifier.context-id" or something. For one it would greatly help troubleshooting. Thanks -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
Iirc you have $CONTEXT_ID for this purpose. On Aug 21, 2013 2:39 PM, <bugzilla@bugzilla.balabit.com> wrote:
https://bugzilla.balabit.com/show_bug.cgi?id=247
Summary: FEATURE: add context-id value pair Product: syslog-ng Version: 3.4.x Platform: PC OS/Version: Linux Status: NEW Severity: normal Priority: unspecified Component: syslog-ng AssignedTo: bazsi@balabit.hu ReportedBy: bugzilla.balabit@faxm0dem.org Type of the Report: --- Estimated Hours: 0.0
It would be great to add the context-id to the message from the patterndb, e.g. ".classifier.context-id" or something. For one it would greatly help troubleshooting.
Thanks
-- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
https://bugzilla.balabit.com/show_bug.cgi?id=247 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |algernon@balabit.hu --- Comment #1 from Gergely Nagy <algernon@balabit.hu> 2013-08-26 12:21:15 --- You can use something like this: <values> <value name=".classifier.context-id">$CONTEXT_ID</value> </values> To achieve the desired effect. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 --- Comment #2 from Fabien Wernli <bugzilla.balabit@faxm0dem.org> 2013-08-27 08:51:56 --- That's good to know, thanks. However, I still think this should be added globally: having to add this to all rules is error-prone -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 --- Comment #3 from Balazs Scheidler <bazsi@balabit.hu> 2013-08-29 17:20:21 --- You were right, this is a good idea, so I quickly threw together a patch. Can you please test it? Thanks. https://github.com/balabit/syslog-ng-3.5/commit/16cacab348a15dfc1d15f4a6eb9a... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 --- Comment #4 from Fabien Wernli <bugzilla.balabit@faxm0dem.org> 2013-08-30 15:37:08 --- I can confirm it is working correctly. How about adding context_length too? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 --- Comment #5 from Balazs Scheidler <bazsi@balabit.hu> 2013-08-30 17:49:19 --- I've added a testcase and merged it to 3.5/master what about the context-length? the size of the context when the match was found? can you describe in short terms what you'd like to accomplish? thanks. -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 --- Comment #6 from Fabien Wernli <bugzilla.balabit@faxm0dem.org> 2013-08-30 22:37:18 --- Exactly. I have a few actions triggered when context-length > some_value. It would be useful to have this value too, IMHO. Thanks -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 Balint Kovacs <blint@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |blint@balabit.hu --- Comment #7 from Balint Kovacs <blint@balabit.hu> 2013-09-02 17:29:41 --- This is available through the context-length template function. At the time it was implemented, the rationale behind having this as a template function rather than a macro was speed, it would have degraded the patterndb performace, as inserting it in the nvtable would require a fair amount of locking and synchronization. You can find further info and examples in the condition section of the 3.4 admin guide here: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.4-guide... -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bazsi@balabit.hu |algernon@balabit.hu -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 Gergely Nagy <algernon@balabit.hu> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #8 from Gergely Nagy <algernon@balabit.hu> 2013-09-04 14:48:53 --- As Balint said, context-length is available as the $(context-length) template function, and not as an always-available property, mostly for performance reasons. Since the context-id is now always available as .classifier.context-id, I would close this issue. Is that ok? -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
https://bugzilla.balabit.com/show_bug.cgi?id=247 Fabien Wernli <bugzilla.balabit@faxm0dem.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution| |FIXED Status|ASSIGNED |RESOLVED --- Comment #9 from Fabien Wernli <bugzilla.balabit@faxm0dem.org> 2013-09-06 15:34:46 --- As it's a performance argument, I won't complain. Thanks for the patch, I'm closing this issue -- Configure bugmail: https://bugzilla.balabit.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (2)
-
Balazs Scheidler
-
bugzilla＠bugzilla.balabit.com