I am using a regex to filter out a portion of a username as such in my nxlog.conf:
if $auth =~ s/^(domain|DOMAIN|Domain)(\.lan|\.LAN)?([^\w])?//g; \
I am noticing that on some usernames it actually strips off the first char of the username but seems to only affect the 'r' character:
DOMAIN\robert.smith becomes obert.smith whereas DOMAIN\josh.smith becomes josh.smith, which is correct. I thought it had something to do with the backslash possibly causing it but when I change it to this:
if $auth =~ s/^(domain|DOMAIN|Domain)(\.lan|\.LAN)?([(\\|\/)])?//g; \
I get an error stating the following:
2013-08-21 12:49:02 ERROR Couldn't parse Exec block at /etc/nxlog.conf:102;couldn't parse statement at line 102, character 323 in /etc/nxlog.conf;failed to compile regular _expression_ '^(domain|DOMAIN|Domain)(\.lan|\.LAN)?([(\\|\', error at position 59: \ at end of pattern
It seems that its not honoring the escaped forward slash at the end. Perhaps I am doing something wrong. Any help is great appreciated. nxlog is an amazing product, already using to filter several sets of ESXi logs and getting some awesome metrics on my outlook web access.
Thanks,
Josh
------------------------------------------------------------------------------ Introducing Performance Central, a new site from SourceForge and AppDynamics. Performance Central is your source for news, insights, analysis and resources for efficient Application Performance Management. Visit us today! http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________ nxlog-ce-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
