I'm getting back to looking at the cisco log parsing problem and I'm seeing odd
behavior with the matching. I initially thought that it was tied to the descent
stuff, but then testing just that subset and I'm seeing issues related to the
'rest' type.
with the command:
echo "Outside:6.65.60.79/53 (6.65.60.79/53)" |/usr/lib/lognorm/lognormalizer -r
rules
any of the following three lines will match if I comment out the other two
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number% (%label2:char-to:)%)
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number%
(%label2:char-to:)%)%tail:rest%
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number%%tail:rest%
The later lines override the earlier ones.
I would expect that the first line would be the one used as it's the best match.
According to our earlier discussion, the second line should not match because
there is nothing left to match after the ), but in this test it does and tail=""
However, the real problem is that the last line is being preferred over the
others, rest is not a last-chance match, it's being matched in preference to the
' (' literal text. it doesn't matter what the order is (including when this is
used as a descent target where the order sometimes matters)
the system is running liblognorm1 1.1.1-0adiscon1trusty1 amd64
David Lang
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7ffabbbd4870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7ffabbbd6840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7ffabbbd4530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare succeeded, still valid
liblognorm: 21:trying parser for field 'tail': 0x7ffabbbd63a0
liblognorm: parser returns 0, parsed 16
liblognorm: potential hit, trying subtree
liblognorm: 37 returns 0
liblognorm: 21: parser matches at 21
liblognorm: 21 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7ffabe37b210,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 tail=" (6.65.60.79/53)" port="53" ip="6.65.60.79"
iface="Outside"]'
[cee@115 tail=" (6.65.60.79/53)" port="53" ip="6.65.60.79" iface="Outside"]
comment out the last line
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7f41f814e870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7f41f8150840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7f41f814e530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare ' ', ' '
liblognorm: 22: prefix compare '(', '('
liblognorm: 23: prefix compare succeeded, still valid
liblognorm: 23:trying parser for field 'label2': 0x7f41f814e870
liblognorm: parser returns 0, parsed 13
liblognorm: potential hit, trying subtree
liblognorm: 36: prefix compare ')', ')'
liblognorm: 37: prefix compare succeeded, still valid
liblognorm: 37:trying parser for field 'tail': 0x7f41f81503a0
liblognorm: parser returns 0, parsed 0
liblognorm: potential hit, trying subtree
liblognorm: 37 returns 0
liblognorm: 37: parser matches at 37
liblognorm: 37 returns 0
liblognorm: 23: parser matches at 23
liblognorm: 23 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7f41f97df170,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 tail="" label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]'
[cee@115 tail="" label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]
and finally just the first line
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7fb1029a9870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7fb1029ab840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7fb1029a9530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare ' ', ' '
liblognorm: 22: prefix compare '(', '('
liblognorm: 23: prefix compare succeeded, still valid
liblognorm: 23:trying parser for field 'label2': 0x7fb1029a9870
liblognorm: parser returns 0, parsed 13
liblognorm: potential hit, trying subtree
liblognorm: 36: prefix compare ')', ')'
liblognorm: 37: prefix compare succeeded, still valid
liblognorm: 37 returns 0
liblognorm: 23: parser matches at 23
liblognorm: 23 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7fb1033027f0,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]'
[cee@115 label2="6.65.60.79/53" port="53" ip="6.65.60.79" iface="Outside"]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
