[syslog-ng] How to send tracebacks through syslog-ng? (Jakub Jankowski)

[Luis Pugoy]

On Sun, Sep 25, 2011 at 1:57 AM, Luis Pugoy <lpugoy at insynchq.com> wrote:

> Message: 4
>> Date: Sat, 24 Sep 2011 09:31:34 +0200 (CEST)
>> From: Jakub Jankowski <shasta at toxcorp.com>
>> Subject: Re: [syslog-ng] How to send tracebacks through syslog-ng?
>> To: Syslog-ng users' and developers' mailing list
>>        <syslog-ng at lists.balabit.hu>
>> Message-ID: <alpine.LNX.2.00.1109240928240.15891 at bluzg.slackware.pl>
>> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>>
>> On 2011-09-24, Luis Pugoy wrote:
>>
>> > rewrite r_rewrite_subst {  subst("a*", "?", value("MESSAGE")
>> type("pcre")
>> > flags("utf8" "global"));  };
>> >
>> > I thought that it would replace 0 or more occurrences of 'a' with a
>> question
>> > mark. However, when the input is 'a', the output becomes 'a?'. It just
>> > appends a question mark at the end. 'aa' also becomes 'aa?'. What is
>> weirder
>> > still is that even if the input does not contain 'a', the question mark
>> is
>> > still appended. So '1' becomes '1?'.
>>
>> Well, does "1" match /a*/ ? :)
>> It doesn't make any difference if that's /a*/, /b*/ or /.*/ - this kind of
>> regexp matches everything, even an empty string.
>>
>> HTH
>>
>> --
>> Jakub Jankowski|shasta at toxcorp.com|http://toxcorp.com/
>> GPG: FCBF F03D 9ADB B768 8B92 BB52 0341 9037 A875 942D
>
>
> Hello Jakub.
>
> Thanks for the reply. You're right in that "1" matches /a*/, but wouldn't
> the resulting replacement be "?" instead of "1?" ? Also, if I just use /a/
> and use "a" as input, it does not seem to match. The text is still outputted
> as "a".
>

I don't know the policy regarding bumping threads here, but I'd like to bump
this. Can anyone confirm the results I'm getting? Is there also something
wrong with my understanding of pcre? I'm sorry if this is not allowed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20110926/ca08fff4/attachment.htm