Replying to myself... > I think you should tackle that beast from a different angle. Regex is > NOT the way to go here. Mmnormalize is - that's *the* use case for that > module. Just yesterday I have posted the relevant links to the mailing > list (in reply to a similar question). Please have a look at the > archive, I don't want to dig them out again (also, Google is good at > finding them).
Marcin, if you can provide some actual samples oft he messages you are interested in, we can work together to create the rulebase. I could probably create a tutorial out of that (if nothing decent enough exists). A link to Cisco documentation describing the messages would also be useful. Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
