On Tue, Oct 1, 2013 at 5:25 PM, David Lang <[email protected]> wrote: > On Tue, 1 Oct 2013, Rainer Gerhards wrote: > > Hi all, >> >> please have a look at >> >> http://bugzilla.adiscon.com/**show_bug.cgi?id=477<http://bugzilla.adiscon.com/show_bug.cgi?id=477> >> >> I think I will change mmanon so that it does no longer check if the "stop >> character" after an IP address is valid. If done unconditional, this has >> potential to break existing configurations. However, I have the feeling >> this is the right thing to do. >> > > There are so many things that can follow the end of an IP address that > restricting the match to only a few characters seems wrong > > the IP may be at the end of the line, it may be inside some variety of > braces (in this bug report [], but there's no reason it can't be (), {}, or > <>), I know some software that does IP/port > > there are so many reasonable possibilities that I'm not sure that there > are any rules that can reasonably rule out possibilities. the only one that > I can think of that seems remotely sane is IP followed by an alpha > character, and I'm sure someone, somewhere does that in a log as well. > > I'd say remove this restriction, just make sure that it doesn't match a > subset of a string (i.e. 1.1.1.2555). This whole module is based on a > huristic, if someone has log messages broken by this, it should be easy > enough to make the mmanon call be conditional, avoiding the particular > message that it breaks. > > > > Thanks, this is the confirmation I was looking for. So I will remove that check and just look at the numbers. Note that the module checks that all four octets are in the range 0..255, so anything else will not be detected as IP address.
Give the context, I would consider this to be a bug-fix and consequently going directly into v7-stable (even though it is a change of behaviour). Anyone disagree? Rainer _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
