On Tue, 1 Oct 2013, Rainer Gerhards wrote:
Hi all,
please have a look at
http://bugzilla.adiscon.com/show_bug.cgi?id=477
I think I will change mmanon so that it does no longer check if the "stop
character" after an IP address is valid. If done unconditional, this has
potential to break existing configurations. However, I have the feeling
this is the right thing to do.
There are so many things that can follow the end of an IP address that
restricting the match to only a few characters seems wrong
the IP may be at the end of the line, it may be inside some variety of braces
(in this bug report [], but there's no reason it can't be (), {}, or <>), I know
some software that does IP/port
there are so many reasonable possibilities that I'm not sure that there are any
rules that can reasonably rule out possibilities. the only one that I can think
of that seems remotely sane is IP followed by an alpha character, and I'm sure
someone, somewhere does that in a log as well.
I'd say remove this restriction, just make sure that it doesn't match a subset
of a string (i.e. 1.1.1.2555). This whole module is based on a huristic, if
someone has log messages broken by this, it should be easy enough to make the
mmanon call be conditional, avoiding the particular message that it breaks.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
