[syslog-ng] 3.3.x conditional rewrite bug
Martin Holste
mcholste at gmail.com
Mon Nov 7 08:45:32 CET 2011
The following will not work in the 3.3.x branch:
filter f_rewrite_cisco_program {
match('^(%(?:ASA|PIX|FWSM)\-\d\-\d{6}): ([^\n]+)' value("MESSAGE")
type("pcre") flags("store-matches" "nobackref")); };
rewrite r_cisco_program {
set("$1", value("PROGRAM") condition(filter(f_rewrite_cisco_program)));
set("$2", value("MESSAGE") condition(filter(f_rewrite_cisco_program)));
};
It will process a few lines and then hang indefinitely. It will
process ok if the condition is taken off of the filter, so I am
assuming this is a PCRE issue, though I found it made no difference to
remove the PCRE requirement and use a simpler matching expression.
All works perfectly in 3.2.4.
More information about the syslog-ng
mailing list