[syslog-ng] ESTRING terminated by a colon?
frobert at balabit.com
Tue Apr 13 13:00:20 CEST 2010
you can escape the colon using another colon, like @ESTRING:CISCO.DATE::: @
Similarly, if you need to use @ in a parser, you can escape it like @@
I'll include this in the next version of the adminguide.
Glen Johnson wrote:
> Hopefully this is a new question. I've been trying to write patterns
> for error messages sent by Cisco IOS devices. For example:
> 20: *Feb 28 15:00:08.556 AKST: %LINEPROTO-5-UPDOWN: Line protocol on
> Interface BVI1, changed state to up
> A pattern that works:
> @NUMBER:seqno@: @ESTRING:CISCO.DATE: %@LINEPROTO-5-UPDOWN: Line
> protocol on Interface @ESTRING:arg1:,@ changed state to
> But to avoid capturing the colon an space, the end-match needs to be
> ": " (i.e. colon space), like so:
> @ESTRING:CISCO.DATE:: @
> However, I'm unsure how to quote the colon, when it's already the
> ESTRING param delimiter?
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
More information about the syslog-ng