1

In a similar vein to my previous question regarding syslog-ng's patterndb patterns to match an empty description, I am now trying to match "--MARK--" messages. The messages look like this:

-- MARK --

Their ${PROGRAM} is apparently set to null/blank. I currently have the following XML for my ruleset, which doesn't match the messages:

<ruleset name='my-null' id='my-null'>
  <pattern></pattern>
  <rules>

    <rule class='system' id='null_dashed_mark' provider='me'>
    <description></description>
      <patterns>
        <pattern>-- MARK --</pattern>
      </patterns>
      <values>
      </values>
      <examples>
       <example>
        <test_message program="">-- MARK --</test_message>
        <test_values>
        </test_values>
       </example>
      </examples>
    </rule>
  </rules>
</ruleset>

I have also tried various combinations of newlines and spaces between <pattern> and </pattern>, to no avail.

So how can I construct my ruleset specification to match/catch these "MARK" messages?

Improve this question
2
  • -- MARK -- is output by syslog, and easily configurable to go away. Why would you want to match it ?
    – adaptr
    Feb 14, 2012 at 15:41
  • I am tagging every log message so I can apply "artificial ignorance". I want to keep "--MARK--" messages because they're useful, but I'm still going to need to tag them. Also, it is conceivable that other possibly-malformed log messages would arrive with an empty/blank ${PROGRAM}, so this would be useful in those cases as well.
    – EdwardTeach
    Feb 14, 2012 at 16:00

1 Answer 1

Reset to default
3

omit the <pattern> element of the ruleset, then syslog-ng should match the rules of this ruleset for messages without a PROGRAM field.

Regards,

Robert

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .