[syslog-ng] Rewrite backreference oddity

[Ti Leggett]

I have a rewrite rule that is used to replace private IPs that have no DNS name to an internally used name. It looks like:

rewrite r_ddn { subst("172.30.60.(\d*)", "d9550-$1.example.com", value("HOST"), type("pcre")); };


For IP 172.30.60.1 I should get a HOST that is d9550-1.example.com, but what I actually get is d9550-.example.com1. Any ideas what I'm doing incorrectly? I've tried encapsulating the back reference in {}. Here's info about my syslog-ng:

[root at admin 02]# syslog-ng -V
syslog-ng 3.3.4
Installer-Version: 3.3.4
Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-ng-ose--mainline--3.3#master#5e44eb46b0d7b86b62f17698e2b6de875ac8d7c6
Compile-Date: Feb 17 2012 10:55:40
Default-Modules: affile,afprog,afsocket,afuser,basicfuncs,csvparser,dbparser,syslogformat
Available-Modules: affile,afsocket,dummy,afsocket-tls,afprog,syslogformat,csvparser,afmongodb,confgen,afuser,basicfuncs,dbparser,convertfuncs
Enable-Debug: off
Enable-GProf: off
Enable-Memtrace: off
Enable-IPv6: on
Enable-Spoof-Source: on
Enable-TCP-Wrapper: on
Enable-Linux-Caps: on
Enable-Pcre: on



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 203 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://lists.balabit.hu/pipermail/syslog-ng/attachments/20120227/797dec21/attachment.pgp