On Thu, Feb 7, 2019 at 5:09 PM Ingo Schwarze <[email protected]> wrote: > [...] > > I was playing a little bit with !progname in syslog.conf and it does > > not match pattern if there is "/", > > Right, as was recently documented in syslog.conf(5): > > If a received message matches the specified facility and is of the > specified level (or a higher level), and the first word in the message > after the date matches the program, the action specified in the action > field will be taken. In this context, ascii(7) letters, digits, hyphens > ('-'), periods ('.'), and underscores ('_') can be contained in a word; > other bytes end the word. > > The reason for being restrictive in what the word can contain is that > the word needs to be parsed from the message, and allowing too many > characters might cause the word to run away into the message text. > I don't think we want to allow slashes.
Thank you for clarification. I should have check syslog.conf(5) from -current. Two notes. As not native English speaker, the part from man page is not very clear, ie. 'this context' means beginning of the word which should match program? Also 'other bytes' is not clear to me as non-native English speaker. Ad pattern matching - wouldn't just be possible to match everything in the message so one would not need to use syslog-ng/rsyslog for some more precise filtering? httpd already uses patterns(7) which could, if used in syslogd, offer better pattern matching, couldn't it? > Not sure what you are testing, though, you appear to start the > syslogd(8) *after* sending the messages with the logger(1). That was just "displayed" order of blocks in the mail message. syslogd was of course running before logger was used, and three messages are visible in the output. Jiri
