[syslog-ng] issue with rewrite. Please help.
bazsi at balabit.hu
Fri Jun 29 15:52:00 CEST 2012
On Mon, 2012-06-18 at 21:23 +0800, Balla, Hithendra (EXT-Other -
> Hi Balint,
> Thanks for the reply.
> I tried the below rewrite
> rewrite r_solaris
> subst("\[ID [0-9]* [a-z]*\.[a-z]*\]\ " "" value("MESSAGE")
> type("pcre") flags(dont-store-matches));
> It works for auth.info, but it does not work with local7.info or
> local6.info as the regex does not handle numerals in the facility field.
> I tried changing it as follows (i.e. added [0-9] before .)., but with
> this, this dumps core. Addition of any numeral in this position results
> in a core dump
> subst("\[ID [0-9]* [a-z]*[0-9]\.[a-z]*\]\ " "" value("MESSAGE")
Getting a core is not nice. Can you post a backtrace?
More information about the syslog-ng