[syslog-ng] pdbtool 'patternize'

[Fabien Wernli]

Hello David,

On Thu, Apr 17, 2014 at 04:21:34PM +0000, David Hauck wrote:
> Great, thanks for clarifying this. I'd asked this originally because I thought that I'd seen that this wasn't happening (I must have mistook the result for something else). By extension then I guess that  rulesets without 'program pattern' elements provide default rules for *any* incoming message with a non-zero $PROGRAM value (right?).

Quoting from the "syslog-ng-ose-v3.5-guide-admin", §13.5.3 "The syslog-ng
pattern database format":

"If the <pattern> element of a ruleset is not specified, syslog-ng OSE will
use this ruleset as a fallback ruleset: it will apply the ruleset to
messages that have an empty PROGRAM header, or if none of the program
patterns matched the PROGRAM header of the incoming message."

That seems pretty crystal clear to me :)


cheers