On Thu, Feb 7, 2019 at 5:09 PM Ingo Schwarze <schwa...@usta.de> wrote:
> [...]
> > I was playing a little bit with !progname in syslog.conf and it does
> > not match pattern if there is "/",
>
> Right, as was recently documented in syslog.conf(5):
>
> If a received message matches the specified facility and is of the
> specified level (or a higher level), and the first word in the message
> after the date matches the program, the action specified in the action
> field will be taken. In this context, ascii(7) letters, digits, hyphens
> ('-'), periods ('.'), and underscores ('_') can be contained in a word;
> other bytes end the word.
>
> The reason for being restrictive in what the word can contain is that
> the word needs to be parsed from the message, and allowing too many
> characters might cause the word to run away into the message text.
> I don't think we want to allow slashes.
Thank you for clarification. I should have check syslog.conf(5) from
-current.
Two notes. As not native English speaker, the part from man page
is not very clear, ie. 'this context' means beginning of the word which
should match program? Also 'other bytes' is not clear to me as non-native
English speaker.
Ad pattern matching - wouldn't just be possible to match everything
in the message so one would not need to use syslog-ng/rsyslog for some
more precise filtering? httpd already uses patterns(7) which could, if used
in syslogd, offer better pattern matching, couldn't it?
> Not sure what you are testing, though, you appear to start the
> syslogd(8) *after* sending the messages with the logger(1).
That was just "displayed" order of blocks in the mail message. syslogd was
of course running before logger was used, and three messages are visible
in the output.
Jiri
