[syslog-ng] [Bug 225] New: patterndb can not use HOST as variable in pattern

[Fekete Robert]

Hi Evan,

My guess would be that HOST is a reserved macro name, but a developer should 
confirm this.

(And if this is the problem, I should clarify this in the docs.)

Robert

On 03/05/2013 08:34 PM, bugzilla at bugzilla.balabit.com wrote:
> https://bugzilla.balabit.com/show_bug.cgi?id=225
>
>             Summary: patterndb can not use HOST as variable in pattern
>             Product: syslog-ng
>             Version: 3.4.x
>            Platform: PC
>          OS/Version: Linux
>              Status: NEW
>            Severity: normal
>            Priority: unspecified
>           Component: syslog-ng
>          AssignedTo: bazsi at balabit.hu
>          ReportedBy: erempel at uvic.ca
> Type of the Report: ---
>     Estimated Hours: 0.0
>
>
> This fails in the patterndb test --validate with the error
>
> ERROR:logmsg.c:540:log_msg_set_value_indirect: assertion failed: (handle >= LM_V_MAX)
>
>
> <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic">
>      <patterns>
>          <pattern>replace HOST with @ANYSTRING:HOST@</pattern>
>      </patterns>
>
>      <examples>
>          <example>
>              <test_message program="something">replace HOST with some.host.here</test_message>
>              <test_values>
>                  <test_value name="HOST">some.host.here</test_value>
>              </test_values>
>          </example>
>      </examples>
> </rule>
>
>
> but this succeeds and replaces the HOST macro
>
> <rule id="50b9250d-2191-43af-8008-089c50224dc2" class="erempel" provider="UVic">
>      <patterns>
>          <pattern>replace HOST with @ANYSTRING:tempHost@</pattern>
>      </patterns>
>      <values>
>          <value name="HOST">$tempHost</value>
>      </values>
>      <examples>
>          <example>
>              <test_message program="something">replace HOST with some.host.here</test_message>
>              <test_values>
>                  <test_value name="tempHost">some.host.here</test_value>
>              </test_values>
>          </example>
>      </examples>
> </rule>
>
> I would expect the both to work.
>
>