Logging, Syslog and Log Anaylsys Forums
July 30, 2010, 09:57:14 pm
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
:
Home
WIKI
BLOG
Help
Search
Recent Topics
GoogleTagged
Login
Register
Logging, Syslog and Log Anaylsys Forums
>
Forums
>
syslog-ng
>
Regex Help - Filter isn't working as it should
Pages: [
1
]
« previous
next »
Print
Author
Topic: Regex Help - Filter isn't working as it should (Read 1211 times)
phikapjames
Newbie
Offline
Posts: 1
Regex Help - Filter isn't working as it should
«
on:
July 10, 2008, 05:14:47 pm »
I just noticed an issues with my filter using regex, so I'm hoping that someone can help me figure this out. I'm running version 2.0.9. I have internal hostnames that I use with a central log system. The issue is that if I use a host like:
hostr01.w01.primary
It should go to /logs/primary/wireless/hostr01.r01.primary/, but if the router filter is above the wireless filter, the it's actually going into /logs/primary/wireless/hostr01.r01.primary/. It appears to be ignoring or matching the . even thought I have it with a \.. Any help with this would be greatly appreciated. If I didn't have the final(), it would log to both places.
Here is the snippet of the config that deals with this.
filter router_filter { host("^[0-9a-zA-Z\-]+\.r[0-9]{2}\.([0-9a-zA-Z\-]+)$"); };
destination router_logs {
file("/logs/$1/router/$HOST/$YEAR-$MONTH-$DAY.log");
};
log { source(s_external);
filter(router_filter);
destination(router_logs);
flags(final);
};
filter wireless_filter { host("^[0-9a-zA-Z\-]+\.w[0-9]{2}\.([0-9a-zA-Z\-]+)$"); };
destination wireless_logs {
file("/logs/$1/wireless/$HOST/$YEAR-$MONTH-$DAY.log");
};
log { source(s_external);
filter(wireless_filter);
destination(wireless_logs);
flags(final);
};
Logged
Pages: [
1
]
Print
GoogleTagged:
regexp working
regex
regex sarbanes oxley
« previous
next »
Jump to:
Please select a destination:
-----------------------------
Forums
-----------------------------
=> Syslog & syslogd
=> syslog-ng
=> Log Data and Analysis
=> Windows Event Log
=> Web Server Logs
=> Security Event Management
=> General Discussion
===> Red Light District
Loading...