MonitorWare Knowledge Base

Hello,

I have some basic problem with MySQL + RegEx. I wanted to extract some data from Cisco log messages and put them to proper columns in the database.

When I use template

Code: Select all

$template tplCisco,"insert into CiscoSystemEvents (Message) values ('%msg:R:.*--end%')",SQL

I get all the message, obvious. but when I use template:

Code: Select all

$template tplCisco,"insert into CiscoSystemEvents (Message) values ('%msg:R,ERE,1,DFLT:(.*)--end%')",SQL

I get NO input to the database, not even **NO MATCH** . Is it a bug or i am doing something wrong?

i am using version 3.18.6-4 that is standard in debian lenny

• Custom written rsyslog.conf?
• Maintenance Contract?
• Installation support?

did you give the regex checker a try?

http://www.rsyslog.com/tool-regex

Hi, thanks for a fast answer.

Yes, I have even just did copy-paste of the most simple phrase from there and still nothing

Probably your version is too old. I guess the submatches are not supported by it. I advise to check the changelog or try the current v3-stable.

You were right, it was too old.

4.2.0 is working perfectly!

glad it worked out