[syslog-ng] program filter regex

Matt Zagrabelny mzagrabe at d.umn.edu
Fri Sep 2 21:44:09 CEST 2011


Hi,

I've looked through the OSE reference PDF and have a question about
the program filter regex.

I've done some experimentation and I would have thought the following to work:

I'm trying to match puppet programs in syslog-ng (version 3.1)

log entry:
Sep  2 14:36:25 hornet puppet-agent[15008]: Finished catalog run in 0.75 seconds

This filter works:
filter      f_puppet { program("puppet.*"); };

But this does not:
filter      f_puppet { program("puppet"); };

For things like grep, perl, and ruby the latter regex ("puppet") would
have matched the program string "puppet-agent". Syslog-ng does not
seem to behave the same way. Is there a way to get the grep/perl
behavior? If not, it seems like it doesn't follow the conventions of
other free software. Would anyone consider it a wishlist bug?

Thanks for the info or advice!

-matt zagrabelny


More information about the syslog-ng mailing list