[syslog-ng] syslog-ng vs pcre2 without jit vs disable-jit config feature

[Balazs Scheidler]

Hi,

I've now tried the disable-jit example from the documentation and it does
seem to work for me. I've set a breakpoint where it would do the jit
compilation, and it didn't do it.

btw, I was using Axoflow produced documentation, which is somewhat more
usable to me:
https://axoflow.com/docs/axosyslog-core/chapter-manipulating-messages/regular-expressions/reference-regexp-types/regexp-flags-options/regexp-flags-options-pcre/

This is the config I have checked:

```
@version: 3.32

log {
source { tcp(port(2000)); };

filter { match("(?<DN>foo)|(?<DN>bar)" value(MSG) flags(store-matches,
disable-jit, dupnames)); };
destination { file("/tmp/log" template("$(format-json *)\n")); };
};
```

I am using the latest master, but 4.4.0 should be the same. How do you know
that jit is enabled?


On Tue, Nov 21, 2023 at 10:59 AM "Tóth Attila" <atoth at atoth.sote.hu> wrote:

> I'm using syslog-ng-4.4.0 on a Gentoo system, that also employs PaX
> hardening. Due to the necessity to elevate restrictions on pcre2 with jit
> enabled, I keep it disabled for this particular installation. Syslog-ng
> emits error messages during startup complaining about pcre2 and jit. I had
> studied the manual and found the disable-jit feature.
>
> https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.30/administration-guide/72
> Maybe I'm using a wrong syntax, but syslog-ng doesn't seem to respect the
> option. Commenting out the jit feature in the source code works, but it
> would be much more comfortable to find the proper way to disable jit.
>
> Are there any other who managed to use disable-jit in action?
>
> Are there any tips or tricks aboutv what to pay attention on?
>
> Thx:
> Dw.
> --
> dr Tóth Attila, Radiológus, 06-20-825-8057
> Attila Toth MD, Radiologist, +36-20-825-8057
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.balabit.com/wiki/syslog-ng-faq
>
>

-- 
Bazsi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.balabit.hu/pipermail/syslog-ng/attachments/20231122/3289d2d4/attachment.htm>