{"action":"created","issue":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/2148","repository_url":"https://api.github.com/repos/balabit/syslog-ng","labels_url":"https://api.github.com/repos/balabit/syslog-ng/issues/2148/labels{/name}","comments_url":"https://api.github.com/repos/balabit/syslog-ng/issues/2148/comments","events_url":"https://api.github.com/repos/balabit/syslog-ng/issues/2148/events","html_url":"https://github.com/balabit/syslog-ng/issues/2148","id":336507687,"node_id":"MDU6SXNzdWUzMzY1MDc2ODc=","number":2148,"title":"Possible PCRE compatibility issue in substitution rules","user":{"login":"T4iga","id":38498928,"node_id":"MDQ6VXNlcjM4NDk4OTI4","avatar_url":"https://avatars0.githubusercontent.com/u/38498928?v=4","gravatar_id":"","url":"https://api.github.com/users/T4iga","html_url":"https://github.com/T4iga","followers_url":"https://api.github.com/users/T4iga/followers","following_url":"https://api.github.com/users/T4iga/following{/other_user}","gists_url":"https://api.github.com/users/T4iga/gists{/gist_id}","starred_url":"https://api.github.com/users/T4iga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/T4iga/subscriptions","organizations_url":"https://api.github.com/users/T4iga/orgs","repos_url":"https://api.github.com/users/T4iga/repos","events_url":"https://api.github.com/users/T4iga/events{/privacy}","received_events_url":"https://api.github.com/users/T4iga/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-28T07:38:41Z","updated_at":"2018-06-28T10:09:18Z","closed_at":null,"author_association":"NONE","body":"# syslog-ng\r\n\r\nPlease tell me if I am missing any important information.\r\n\r\n## Version of syslog-ng\r\nsyslog-ng 3.8.1\r\n\r\n\r\noutput of syslog-ng --version\r\nsyslog-ng 3.8.1\r\nInstaller-Version: 3.8.1\r\nRevision: \r\nModule-Directory: /usr/lib64/syslog-ng\r\nModule-Path: /usr/lib64/syslog-ng\r\nAvailable-Modules: add-contextual-data,afamqp,affile,afmongodb,afprog,afsocket,afstomp,afuser,basicfuncs,cef,confgen,cryptofuncs,csvparser,date,dbparser,disk-buffer,graphite,json-plugin,kvformat,linux-kmsg-format,pseudofile,sdjournal,syslogformat,system-source\r\nEnable-Debug: off\r\nEnable-GProf: off\r\nEnable-Memtrace: off\r\nEnable-IPv6: on\r\nEnable-Spoof-Source: on\r\nEnable-TCP-Wrapper: on\r\nEnable-Linux-Caps: off\r\n\r\n\r\n## Platform\r\nopenSuse 42.3\r\n\r\n## Debug bundle\r\n\r\n# Issue\r\nrewrite / substituttion rules do not fully support PCRE. More specifically regular expression character classes as for example listed here are not working: https://www.debuggex.com/cheatsheet/regex/pcre\r\n\r\nThis appears to be true for \\s and \\S too as I tried using those in a different configuration and they did not work either. I just post the simple example here as it should prove my point sufficiently.\r\n## Steps to reproduce\r\n\r\n1. start syslog-ng\r\n2. observe unmodified messages coming in\r\n\r\n## Configuration\r\n```\r\n@version:3.8\r\n@include \"scl.conf\"\r\n\r\noptions {\r\n\tchain_hostnames(off);\t# Standard\r\n\tflush_lines(0); \t# Standard\r\n\tperm(0640); \t\t# Standard\r\n\tstats_freq(3600); \t# Standard\r\n\tthreaded(yes);\t\t# Standard \r\n\tcreate-dirs(yes);       \r\n\tdir-owner(root);        \r\n\tdir-perm(0640);         # entspricht -rw-r-----, Besitzer: Lesen, Schreiben; Gruppe: Lesen; Alle: Nichts\r\n\tfile-template(t_myLoggingFormat); # legt Standart-Template fuer file Destinations fest\r\n};\r\n\r\nsource s_myNetworkSource {\r\n\tnetwork(\r\n                ip(\"0.0.0.0\")\t # \r\n                port(514)\t # Standardport für legacy RFC 3164 UDP syslog \r\n                transport(\"udp\") #\r\n        );\r\n\tnetwork(\r\n\t\tip(\"0.0.0.0\")\t #\r\n\t\tport(601)\t # Non-Standardport\r\n\t\ttransport(\"udp\") #\r\n\t);\r\n\tsyslog(\r\n                ip(0.0.0.0)\t \r\n                port(601)\t # Standardport für RFC 5424 TCP Syslog ist 601\r\n                transport(\"tcp\") \r\n        );\r\n        syslog(\r\n\t\tip(0.0.0.0)\t #\r\n\t\tport(514)\t # Non-Standard Port\r\n\t\ttransport(\"tcp\") #\r\n\t);\r\n};\r\n\r\ntemplate t_myLoggingFormat {\r\n\ttemplate(\"$(padding ${FULLHOST} 15 '')|${ISODATE}|PRI:$(padding ${PRI} 3 '')|${MSGHDR}::${MSG}\\n\");\r\n};\r\n\r\ntemplate t_destination {\r\n\ttemplate(\"${FULLHOST}/${YEAR}/${MONTH_ABBREV}/${DAY}-${WEEK_DAY_ABBREV}.log\");\r\n};\r\n\r\nfilter f_checkpoints {\r\n\tnetmask(10.127.27.34/31); \r\n};\r\n\r\nrewrite r_checkpoint_remove_irrelevant {\r\n\tsubst(\r\n\t\t\"psa\\d\",\r\n\t\t\"test\",\r\n                type(\"pcre\"),\r\n\t\tvalue(\"MESSAGE\") flags(\"utf8\" \"global\")\t\r\n\t);\r\n\r\ndestination d_testination{\r\n\tfile(\"/var/log/syslog-ng/test\"\r\n\t\tcreate_dirs(yes)\r\n\t); \r\n};\r\n\r\nlog {\t# for testing purposes\r\n\tsource(s_myNetworkSource);\r\n\tfilter(f_checkpoints);\t   \t# Nur Checkpoint-Non-Standard\r\n\trewrite(r_checkpoint_remove_irrelevant);\r\n\tdestination(d_testination);\r\n};\r\n```\r\n## Input and output logs (if possible)\r\nInput:\r\n   10.127.27.35|2018-06-01T00:00:16+02:00|PRI:134|1 ::2018-05-31T23:59:42+02:00 psa2.XXX.XXX PulseSecure: - - - 2018-05-31 23:59:42 - psa2 - [XXX] ....\r\nOutput (unchanged from input):\r\n   10.127.27.35|2018-06-01T00:00:16+02:00|PRI:134|1 ::2018-05-31T23:59:42+02:00 psa2.XXX.XXX PulseSecure: - - - 2018-05-31 23:59:42 - psa2 - [XXX] ...."},"comment":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/comments/400984647","html_url":"https://github.com/balabit/syslog-ng/issues/2148#issuecomment-400984647","issue_url":"https://api.github.com/repos/balabit/syslog-ng/issues/2148","id":400984647,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMDk4NDY0Nw==","user":{"login":"algernon","id":17243,"node_id":"MDQ6VXNlcjE3MjQz","avatar_url":"https://avatars3.githubusercontent.com/u/17243?v=4","gravatar_id":"","url":"https://api.github.com/users/algernon","html_url":"https://github.com/algernon","followers_url":"https://api.github.com/users/algernon/followers","following_url":"https://api.github.com/users/algernon/following{/other_user}","gists_url":"https://api.github.com/users/algernon/gists{/gist_id}","starred_url":"https://api.github.com/users/algernon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/algernon/subscriptions","organizations_url":"https://api.github.com/users/algernon/orgs","repos_url":"https://api.github.com/users/algernon/repos","events_url":"https://api.github.com/users/algernon/events{/privacy}","received_events_url":"https://api.github.com/users/algernon/received_events","type":"User","site_admin":false},"created_at":"2018-06-28T10:09:18Z","updated_at":"2018-06-28T10:09:18Z","author_association":"MEMBER","body":"Your description is correct.\r\n\r\nAs for the documentation, I think 11.3 is fairly clear about this, but I'm far from being impartial, as this behaviour is the one I'd normally expect anyway, which is something many people don't share. Feel free to open an issue against the [documentation](https://github.com/balabit/syslog-ng-ose-guides), if you think they need clarification."}}
{"actor":{"display_login":"algernon"}}