[syslog-ng] QSTRING with @

[Peter Czanik]

Hello,

On 09/30/2010 03:51 PM, Matthew Hall wrote:
> Hello CzP,
>
> Unfortunately I think it might be forbidden.
>
> @STRING@: A sequence of alphanumeric characters (0-9, A-z), not 
> including any whitespace. Optionally, other accepted characters can be 
> listed as parameters (e.g., to parse a complete sentence, add the 
> whitespace as parameter, like: @STRING:: @). Note that the @ character 
> cannot be a parameter, nor can line-breaks or tabs.
>
> http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.1-guide-admin-en.html/reference_parsers_pattern_databases.html
>
> The documentation is confusing because the restriction is only listed 
> for @STRING@ but seems like it applies to everything from my experience.
>   
Thanks. Any idea how could this be solved here:

<pattern>(czanik at 192.168.2.52) [INFO] Logout.</pattern>

"czanik" is a username here, but that might use other characters, not
just letters and numbers.

Well, QSTRING or ESTRING does not work here, but I found the necessary
information in "man useradd":
"
       The  account  name must begin with an alphabetic character and
the rest
       of the string should be from the POSIX portable character class
([A-Za-
       z_][A-Za-z0-9_-.]*[A-Za-z0-9_-.$]).
"
So it can be solved with: @STRING::_-.$@

> It would be good if this could be fixed somehow.
>   
Forwarded to the documentation team.
Bye,
CzP
-- 

Peter Czanik (CzP) <czanik at balabit.hu>
BalaBit IT Security / syslog-ng upstream
http://czanik.blogs.balabit.com/