[syslog-ng] 3.3.x conditional rewrite bug

Martin Holste mcholste at gmail.com
Mon Nov 7 08:45:32 CET 2011


The following will not work in the 3.3.x branch:

filter f_rewrite_cisco_program {
match('^(%(?:ASA|PIX|FWSM)\-\d\-\d{6}): ([^\n]+)' value("MESSAGE")
type("pcre") flags("store-matches" "nobackref")); };
rewrite r_cisco_program {
        set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program)));
        set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program)));
};

It will process a few lines and then hang indefinitely.  It will
process ok if the condition is taken off of the filter, so I am
assuming this is a PCRE issue, though I found it made no difference to
remove the PCRE requirement and use a simpler matching expression.

All works perfectly in 3.2.4.


More information about the syslog-ng mailing list