[syslog-ng] quick question on host() in syslog-ng 3.1.4

Mishou Michael Michael.Mishou at csirc.irs.gov
Thu Jun 16 19:00:59 CEST 2011


Folks,

I want host() to do a literal, exact string match instead of regex.  For message() you can do this: message("foo" type("string")) and get an exact string match.  Does this type() and flags() (so you can do substrings) also work on the host() operator?

This is on syslog-ng 3.1.4.  I finally moved off of Solaris (easier to just get a Linux box up and running it turned out) and am attempting to modify the insane config I have to be more performance friendly.  I've got about 300 host() matches going on, dumping hosts to various folder structures, and figured that if I could get it to do an exact match instead of regex it would be that much more efficient.

Of course, I could always do host("^192\.168\.1\.1$") but that seems kind of silly when I don't need regex at all.

FWIW, syslog-ng -s doesn't complain about this in the config, and it starts/runs fine, I just can't tell if it's still using regex or not.

Thanks,

--Mike


More information about the syslog-ng mailing list