[syslog-ng] Bazsi's blog: Syslog-ng correllation

[Balazs Scheidler]

On Thu, 2010-09-30 at 14:19 -0500, Martin Holste wrote:
> > you have to generate it. in the example above I've parsed a value out of
> > the log message as $sessionid, but you can use more complex values like:
> >
> 
> Ok, got it.
> 
> > ahh. I've just noted that I didn't blog about $(grep) and $(if), but
> > they certainly do what they imply:
> >
> > $(grep filter template1 template2 template3...)
> >
> > searches for messages in the current correllation state matched by
> > filter expression "filter" and evaluating the templates.
> >
> > $(if filter foo bar)
> >
> 
> Cool!

Thanks. I take this as a compliment. :) In fact I do like template
functions a lot. If only I had a scripting engine embedded into
syslog-ng to make it extending really easy.

But anyway, writing a template function in C is as easy as possible.

> 
> > If filter is true results in foo, otherwise bar.
> 
> So, an example statement might be:
> 
> $(if ${useracct}1 == "?" ${useracct}="unknown" ${useracct}=${useracct}
> 
> Is that right?  I guess I'm not understanding foo and bar in your example.

the foo and bar parts are what the $(if) constructs expands to if the
result of the filter evaluation is true / false respectively.

I'm afraid but I can't understand your example.

> 
> >
> > Filters got extended too, now you can use simple comparison operators
> > a'la perl: numeric comparison is the same as C (<, <=, ==, >=, >, !=),
> > string comparison is the same as perl: lt, le, eq, ge, gt, ne
> >
> > You can compare templates, e.g. "$FACILITY_NUM" > "5"
> >
> 
> Coupled with the inet_aton functionality you've already added, this
> would mean you could do filtering based on IP ranges, right?

Yes.

-- 
Bazsi