[syslog-ng] syslog-ng-3.38.1 causing type hint errors in patterndb - bug?

[Balazs Scheidler]

Hi,

Thanks for the report. I am looking into this asap. Indeed, db-parser()
would now accept type hints on that field, but should give you a warning
instead of an error.

On Mon, Nov 21, 2022, 17:22 Evan Rempel <erempel at uvic.ca> wrote:

> We have a patterndb file that contains both patterns and values with
> fixed text that include a strings of the form "xxxx (yyy)" which now can
> not be loaded by the patterndb.
>
> Syslog-ng throws the error
>
> Error parsing pattern database file; ... Error compiling value template,
> rule=FLARE-3543, name=AUTHPROGRAM, value=su(pam_unix), error=Unknown
> type specified in type hinting: su'
>
> I have not enabled the version 4.0 testing of type hinting. The version
> configuration is
>
> @version: 3.36
>
> I am unable to find documentation for the full syntax of the patterndb
> file (seems to have been lost from the docs since perhaps 3.16?)
>
> Is there a patterndb syntax specification document?
>
> I would expect that even when type hinting is enabled in the patterndb
> file, given that it is an XML document, that the type hinting would be
> part of the XML tag metadata, rather than part of the XML static data.
>
> --
> Evan
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20221121/e6a7338e/attachment.htm>