[syslog-ng]syslog-ng and regex

[Micha Holzmann]

--n8g4imXOkfNTN/H1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hello,

i am very new at syslog-ng and at its list. I am running two Debian
GNU/Linux boxes. One as a DSL Router and the other as my workstation.

Today i have installed syslog-ng via apt-get (1.5.15-1.1).

I tried to setup remote logging. I want my router/firewall logging
additional to my workstation. On the router i have the following entries
in syslog-ng.conf


Hostname of router =3D xenia

>---  cut here  ----
destination loghost {udp("192.168.1.1" port(514));};
log { source(src); destination(loghost); };
>---  cut here  ----


Hostname of workstation =3D kaliba
On my workstation i have in syslog-ng.conf:

>---  cut here  ----
destination rlogging { file("/var/log/syslog-ng/$HOST/syslog.log"
            sync(0) log_fifo_size(10) create_dirs(yes) owner(root)
            group(system) perm(0660) dir_perm(0770)); };

filter f_xenia { match("xenia"); };

log { source(src); filter(f_xenia); destination(rlogging); };
>---  cut here  ----


I am not sure if this setup is correct. May you can give me some
advices. If it is necessary to have my configs, please tell me, i will
post them afterwards.

Now i have a seceond question, on my workstation runs a cron job which
looks for new antivir definition file or new program version (binary
file). I tried to put the syslog entries in a separate file.

Can i use regex in the match()? May like this:
match("antivir\[[0-9]+\]") to catch antivir[19129]


>---  cut here  ----
destination antivir { file("/var/log/antivir.log"); };
filter f_antivir { match("kaliba antivir"); };
log { source(src); filter(f_antivir); destination(antivir); };
>---  cut here  ----

But the logfile entries does not arrive in /var/log/antivir.log.
Did i anything wrong?

Best regards,
Micha Holzmann

--=20
My software never has bugs. It just develops random features.

--n8g4imXOkfNTN/H1
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+WllcZrmPvQ66gg8RAp7AAJ0V/kh6pSfs64IphsIBuDwgCpzXuQCfXf80
YglKVt9MqnvAI6Y57jwKLoo=
=yvQ/
-----END PGP SIGNATURE-----

--n8g4imXOkfNTN/H1--