[syslog-ng] issue with rewrite. Please help.

[Balazs Scheidler]

On Mon, 2012-06-18 at 21:23 +0800, Balla, Hithendra (EXT-Other -
IN/Bangalore) wrote:
> Hi Balint,
> Thanks for the reply. 
> 
> I tried the below rewrite
> 
> rewrite r_solaris
>    {
>       subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE") 
> type("pcre") flags(dont-store-matches));
>    };
> 
> It works for auth.info, but it does not work with local7.info  or
> local6.info as the regex does not handle numerals in the facility field.
> I tried changing it as follows (i.e. added [0-9] before .)., but with
> this, this dumps core. Addition of any numeral in this position results
> in a core dump
> 
> 	subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE")
> 

Getting a core is not nice. Can you post a backtrace?

-- 
Bazsi