[syslog-ng] Backslash before quote

Pennington, Philip philip.pennington at credit-suisse.com
Wed Jun 10 20:14:40 CEST 2009


Ok thanks, I think that does look like what I need.   I assume you meant
template_escape(no)  (underscore not hyphen).

I've tried a bit of experimentation and for some reason I can't seem to
get it to drop the backslashes

Is it correct to say this is required on the first and every "tcp"
destination syslog relay in a chain as well as the final "file"
destination?  (I was trying with relays).

The admin guide does suggest that template_escape is a common option for
every destination (presumably including tcp), are you aware of any known
issues with this on version 2.0.5 ? 



-----Original Message-----
From: syslog-ng-bounces at lists.balabit.hu
[mailto:syslog-ng-bounces at lists.balabit.hu] On Behalf Of Balazs
Sent: 10 June 2009 15:56
To: Syslog-ng users' and developers' mailing list
Subject: Re: [syslog-ng] Backslash before quote

On Wed, 2009-06-10 at 15:04 +0100, Pennington, Philip wrote:
> Syslog-ng version 2.
> Can anyone please explain the purpose of the backslash being added 
> before each quote in syslog output ?
> Is there any way to disable this feature ?   Is this
> flags(noparse) ?   
> Is there any other way to do it (other than stripping it out on an 
> output process)?

you probably need template-escape(no)

this is the default setting starting from 3.0 and was introduced to
avoid SQL injections if using templates to format SQL INSERT statements.

since that use is replaced by the native SQL destination, the default
was changed with 3.0.


Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html

 Please access the attached hyperlink for an important electronic communications disclaimer: 

More information about the syslog-ng mailing list