patterndb parser: undocumented feature about syslog-ng

[MrAnno]

This has been fixed in syslog-ng v3.8.1 (#1032, 82b473e#diff-d9f8b4f62fd3294230ca43a28a2c0cb1R308).

Since then, only the following actions are supported:

• create-context
• message

<value> as an action is not valid anymore:

Error parsing pattern database file; filename='pdb.xml', error='pdb.xml:12:1: Unexpected <values> tag, expected <message> or <create-context>'

If you want to achieve the same behavior, it can be done with the following cleaner syntax:

<?xml version='1.0' encoding='UTF-8'?>
<patterndb version='4' pub_date='2014-06-16'>
  <ruleset name='myname' id='123456789'>
    <rules>
      <rule id='123' class='myclass' provider='bcn'>
        <patterns>
            <pattern>@ESTRING:greeting: @@ANYSTRING:who@</pattern>
        </patterns>
        <values>
          <value  name="answer">hi</value>
        </values>
      </rule>
    </rules>
  </ruleset>
</patterndb>

[talien]

It seems to be an unfortunate coincidence of xml parsing mistakes and celestial object aligments :D. So, when you omit the "message" tag, patterndb does not set the action's content type, so the action is simply not triggered (That's why no new message is created). But because there is a "value" tag there, patterndb try to attach it to the last valid message context, which is the rule's own message context ("message" tag creates new message context during patterndb parsing). If you don't need condition, then you can use something like this without actions (and pretty much this happens in your case):

<?xml version='1.0' encoding='UTF-8'?>
<patterndb version='4' pub_date='2014-06-16'>
  <ruleset name='myname' id='123456789'>
    <rules>
      <rule id='123' class='myclass' provider='bcn'>
        <patterns>
            <pattern>@ESTRING:greeting: @@ANYSTRING:who@</pattern>
        </patterns>
        <values>
          <value  name="answer">hi</value>
        </values>
      </rule>
    </rules>
  </ruleset>
</patterndb>

If you need condition, then we should implement rewrite rule action. But you can still create new message with trigger, use inherit-properties attribute in "message" tag, set or overwrite properties from "value" tags, and then drop the original message.

[faxm0dem]

yeah, indeed. But I've figured many ppl find it misleading to get message duplication. They expect the original message to be dropped, the "enriched" one to be promoted. I personally think this is a minor issue. Thanks for looking into this!

[ihrwein]

@bazsi should we mark this as a feature or a bug?

[ihrwein]

@bazsi What do you think? I'd expect from an action that it creates a new message so I'd consider this as a bug.

[faxm0dem]

/me votes for a bug

[bazsi]

I agree its a bug. In intended actions to generate a separate message. If
you want to enrich the current message it should just be added to the rule
tag.
On Dec 2, 2015 4:20 PM, "Fabien Wernli" [email protected] wrote:

/me votes for a bug

—
Reply to this email directly or view it on GitHub
#147 (comment).