[syslog-ng] Which macros are available for filtering ?

Balazs Scheidler bazsi at balabit.hu
Wed Mar 4 10:30:04 CET 2009


On Tue, 2009-03-03 at 17:06 +0100, Vincent Panel wrote:
> 
> On a test machine, I've set up syslog-ng with a filter which looks
> like this :
> 
> filter filter1 { match(".+" VALUE ("MACRO")); };
> 
> I've tried many MACROS and it seems only a few of them are not empty
> (easy to spot using this regex). The most surprising is that several
> documented macros are empty : for instance, MSGHDR and MSG (MSG should
> be the same than MESSAGE, but looks like it's not).

Hmm.. must be a bug then... It really seems to be a bug, I've just tried
it with $MSG and it didn't work.

I'll look into this, thanks for reporting it.

-- 
Bazsi




More information about the syslog-ng mailing list