Yeah, that's why I as always opposed against "rest" and similar
approaches. But there was so much pressure to have them, so I gave in.
Now we see that it really doesn't work out ;)
The longer term solution (summer?) is what I am currently working on.
It'll solve these problems.
Rainer
2015-04-03 5:51 GMT+02:00 David Lang <[email protected]>:
I'm getting back to looking at the cisco log parsing problem and I'm
seeing
odd behavior with the matching. I initially thought that it was tied to
the
descent stuff, but then testing just that subset and I'm seeing issues
related to the 'rest' type.
with the command:
echo "Outside:6.65.60.79/53 (6.65.60.79/53)"
|/usr/lib/lognorm/lognormalizer
-r rules
any of the following three lines will match if I comment out the other
two
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number%
(%label2:char-to:)%)
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number%
(%label2:char-to:)%)%tail:rest%
rule=:%iface:char-to:\x3a%\x3a%ip:ipv4%/%port:number%%tail:rest%
The later lines override the earlier ones.
I would expect that the first line would be the one used as it's the best
match.
According to our earlier discussion, the second line should not match
because there is nothing left to match after the ), but in this test it
does
and tail=""
However, the real problem is that the last line is being preferred over
the
others, rest is not a last-chance match, it's being matched in
preference to
the ' (' literal text. it doesn't matter what the order is (including
when
this is used as a descent target where the order sometimes matters)
the system is running liblognorm1 1.1.1-0adiscon1trusty1 amd64
David Lang
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7ffabbbd4870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7ffabbbd6840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7ffabbbd4530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare succeeded, still valid
liblognorm: 21:trying parser for field 'tail': 0x7ffabbbd63a0
liblognorm: parser returns 0, parsed 16
liblognorm: potential hit, trying subtree
liblognorm: 37 returns 0
liblognorm: 21: parser matches at 21
liblognorm: 21 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7ffabe37b210,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 tail=" (6.65.60.79/53)" port="53" ip="6.65.60.79"
iface="Outside"]'
[cee@115 tail=" (6.65.60.79/53)" port="53" ip="6.65.60.79"
iface="Outside"]
comment out the last line
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7f41f814e870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7f41f8150840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7f41f814e530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare ' ', ' '
liblognorm: 22: prefix compare '(', '('
liblognorm: 23: prefix compare succeeded, still valid
liblognorm: 23:trying parser for field 'label2': 0x7f41f814e870
liblognorm: parser returns 0, parsed 13
liblognorm: potential hit, trying subtree
liblognorm: 36: prefix compare ')', ')'
liblognorm: 37: prefix compare succeeded, still valid
liblognorm: 37:trying parser for field 'tail': 0x7f41f81503a0
liblognorm: parser returns 0, parsed 0
liblognorm: potential hit, trying subtree
liblognorm: 37 returns 0
liblognorm: 37: parser matches at 37
liblognorm: 37 returns 0
liblognorm: 23: parser matches at 23
liblognorm: 23 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7f41f97df170,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 tail="" label2="6.65.60.79/53" port="53"
ip="6.65.60.79" iface="Outside"]'
[cee@115 tail="" label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]
and finally just the first line
To normalize: 'Outside:6.65.60.79/53 (6.65.60.79/53)'
liblognorm: 0: prefix compare succeeded, still valid
liblognorm: 0:trying parser for field 'iface': 0x7fb1029a9870
liblognorm: parser returns 0, parsed 7
liblognorm: potential hit, trying subtree
liblognorm: 7: prefix compare ':', ':'
liblognorm: 8: prefix compare succeeded, still valid
liblognorm: 8:trying parser for field 'ip': 0x7fb1029ab840
liblognorm: parser returns 0, parsed 10
liblognorm: potential hit, trying subtree
liblognorm: 18: prefix compare '/', '/'
liblognorm: 19: prefix compare succeeded, still valid
liblognorm: 19:trying parser for field 'port': 0x7fb1029a9530
liblognorm: parser returns 0, parsed 2
liblognorm: potential hit, trying subtree
liblognorm: 21: prefix compare ' ', ' '
liblognorm: 22: prefix compare '(', '('
liblognorm: 23: prefix compare succeeded, still valid
liblognorm: 23:trying parser for field 'label2': 0x7fb1029a9870
liblognorm: parser returns 0, parsed 13
liblognorm: potential hit, trying subtree
liblognorm: 36: prefix compare ')', ')'
liblognorm: 37: prefix compare succeeded, still valid
liblognorm: 37 returns 0
liblognorm: 23: parser matches at 23
liblognorm: 23 returns 0
liblognorm: 19: parser matches at 19
liblognorm: 19 returns 0
liblognorm: 8: parser matches at 8
liblognorm: 8 returns 0
liblognorm: 0: parser matches at 0
liblognorm: 0 returns 0
liblognorm: final result for normalizer: left 0, endNode 0x7fb1033027f0,
isTerminal 1, tagbucket (nil)
normalized: '[cee@115 label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]'
[cee@115 label2="6.65.60.79/53" port="53" ip="6.65.60.79"
iface="Outside"]
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad
of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
