Does anyone have any suggestions on this? I would suspect that I have just hit a limitation of the regex implementation in rsyslog except that it crashes with no errors which doesn't strike me as standard behavior. If it would help I can get some valgrind output from it.
Let me know. -- James --- Sent from my mobile phone --- ----- Reply message ----- From: "Boylan, James" <[email protected]> To: "rsyslog-users" <[email protected]> Subject: [rsyslog] re_extract does not support all regex Date: Tue, Jan 27, 2015 2:45 PM I was trying to use the regex '^[ ]?.+?(?=\\|)\\|.+?(?=\\|)\\|.+?(?=\\^)\\^(.*)' with re_extract and found that it would cause rsyslogd to crash on 8.4.2. However the pattern '^[ ]?[A-Za-z0-9._-]+\\|[A-Za-z0-9._-]+\\|[A-Za-z0-9._-]+[\\^](.*)' works fine. I didn't see anything specific in the debugging output as to why it crashed. It just stopped running. I can see the first instance of applying the regex, but after that the -dn output just stops. Debug log snippet: 1050.148857834:currAppLog.main_Q:Reg/w0: SET !cleanmessage = 1050.148883306:currAppLog.main_Q:Reg/w0: function 're_extract 1050.148923362:imptcp.c : Parser 'rsyslog.rfc3164' returned 0 1050.148936254:7fe0a6495700: Parser 'rsyslog.rfc3164' returned 0 1050.148948996:currAppLog.main_Q:Reg/w0: ' (id:8, params:5) 1050.148959121:currAppLog.main_Q:Reg/w0: var 'msg' 1050.148991421:currAppLog.main_Q:Reg/w0: string '^[ ]?(.+?)(?=\|)\|(.+?)(?=\|)\|(.+?)(?=\^)\^(.*)' 1050.149030510:currAppLog.main_Q:Reg/w0: 3 1050.149061644:currAppLog.main_Q:Reg/w0: 1 1050.149090836:currAppLog.main_Q:Reg/w0: string 'Unknown' 1050.149130293:currAppLog.main_Q:Reg/w0: END SET 1050.149151199:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba41500, type 'F[70]' 1050.149158854:currAppLog.main_Q:Reg/w0: rainerscript: executing function id 8 1050.149167329:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3aeb0, type 'V[86]' 1050.149193316:imptcp.c : msg parser: flags 30, from 'server2.example.com', msg '<190>Jan 27 20:37:30 server2.example.com -[-]: wl|28.143|' 1050.149203171:imptcp.c : parse using parser list 0x7fe12ba23c60 (the default list). 1050.149212163:imptcp.c : Parser 'rsyslog.rfc5424' returned -2160 1050.149219838:imptcp.c : Message will now be parsed by the legacy syslog parser (one size fits all... ;)). 1050.149228720:currAppLog.main_Q:Reg/w0: rainerscript: var 1: ' appname|20.409|0-logtype^20150127-143709.812|W|server.example.com|app-20.409-0||~|refnumber||class:102|payload' 1050.149239397:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3aeb0, return datatype 'S' 1050.149247727:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3c6f0, type 'N[78]' 1050.149256037:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3c6f0, return datatype 'N' 1050.149263919:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3b0a0, type 'N[78]' 1050.149272074:currAppLog.main_Q:Reg/w0: eval expr 0x7fe12ba3b0a0, return datatype 'N' 1050.149281129:imptcp.c : Parser 'rsyslog.rfc3164' returned 0 1050.149294324:7fe0a6495700: msg parser: flags 30, from 'server.example.com', msg '<190>Jan 27 20:37:30 server.example.com -[-]: hs' 1050.149306763:7fe0a6495700: parse using parser list 0x7fe12ba23c60 (the default list). 1050.149312069:7fe0a6495700: Parser 'rsyslog.rfc5424' returned -2160 1050.149316878:7fe0a6495700: Message will now be parsed by the legacy syslog parser (one size fits all... ;)). 1050.149322165:7fe0a6495700: Parser 'rsyslog.rfc3164' returned 0 1050.149329690:imptcp.c : msg parser: flags 30, from 'server2.example.com', msg '<190>Jan 27 20:37:30 server2.example.com -[-]: appname|28.143|' -- James _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
