[syslog-ng] Using patterndb to rewrite any and all macros

Gergely Nagy algernon at balabit.hu
Thu Jan 10 10:56:27 CET 2013

Balazs Scheidler <bazsi77 at gmail.com> writes:

> ----- Original message -----
>>   I am considering using the patterndb to rewrite messages that do not
>> conform to syslog standards. 
>> Can the patterndb change all normally defined macros?   I need to be able
>> to change MSGHDR MESSAGE PROGRAM PID MSG MSGONLY and I think that is
>> all. I know that macros such as MSGHDR can not be changed by the rewrite
>> command but can it be changed by the patterndb?
> there are two kinds of 'macros' within syslog-ng (and I'm considering
> a name change because of that). some of them are like registers,
> contain a given value, can be changed at will. I plan to name these
> properties in the future.
> others are basically derived values, where syslog-ng programmatically
> creates the value when needed. these cannot be changed. these would be
> called read-only properties.

Wouldn't it be clearer if the read-only values would be turned into
template functions? Or at least, make them appear like one? Then the
whole confusion could be avoided, as far as I see.

(Though, for backwards compatibility, they'd still work as 'ordinary'
read-only macros)

Another option would be to trigger updating these select macros whenever
the values that they depend on change, but only when they weren't
explicitly set. But this would add a noticable cost to paths we may not
want that cost on...


More information about the syslog-ng mailing list