[syslog-ng] Matching against an embedded @

[Peter Mills]

I have just found the answer to my own question by trial and error:  @@
 
Peter

________________________________

From: Peter Mills 
Sent: 17 September 2010 09:56
To: syslog-ng at lists.balabit.hu.
Cc: Sam Moore
Subject: Matching against an embedded @


Since @ is a special character, how do you match against strings
containing an @?  Do you escape them e.g. \@ in order to parse them
correctly? I am trying to skip over/match the string 
 
[wx-event at juniper.net 
 
and have had no success.
 
Thanks
 
Peter
 
root at nagios-collector:/opt/syslog-ng/var
<mailto:root at nagios-collector:/opt/syslog-ng/var> #
/opt/syslog-ng/bin/pdbtool match -D -c -p
/opt/syslog-ng/var/db/patterns/v1/test2.xml  -M "- - WXC-192.168.61.202
register 1102 [wx-event at juniper.net eventtime="1284641119"
metric="Primary Reg Server Unreachable" sev="major" type="sys"] REG:
Self registration failed. IP=192.168.61.242"
Pattern matching part:
- - WXC- at IPv4:.wxc.host_ip=192.168.61.202
<mailto:WXC- at IPv4:.wxc.host_ip=192.168.61.202> @
@STRING:.wxc.process=register@ @NUMBER:.wxc.pid=1102@
@ANYSTRING:rest=[wx-event at juniper.net eventtime=1284641119
metric=Primary@
Matching part:
- - WXC-192.168.61.202 register 1102 [wx-event at juniper.net
eventtime=1284641119 metric=Primary
Values:
MESSAGE=- - WXC-192.168.61.202 register 1102 [wx-event at juniper.net
eventtime=1284641119 metric=Primary
.classifier.class=system
.classifier.rule_id=1
.wxc.host_ip=192.168.61.202
.wxc.process=register
.wxc.pid=1102
rest=[wx-event at juniper.net eventtime=1284641119 metric=Primary


Imtech Telecom Global is a limited company registered in England and Wales. Registered number: GB04407184. Registered office: Viables 3, Jays Close, Basingstoke, Hampshire, RG22 4BS.
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20100917/da12612f/attachment.htm