Rev 192 | Blame | Compare with Previous | Last modification | View Log | RSS feed
# Generic configuration items (to be used as interpolations) in other# filters or actions configurations#[INCLUDES]# Load customizations if any availableafter = common.local[DEFAULT]# Type of log-file resp. log-format (file, short, journal, rfc542):logtype = file# Daemon definition is to be specialized (if needed) in .conf file_daemon = \S*## Shortcuts for easier comprehension of the failregex## PID.# EXAMPLES: [123]__pid_re = (?:\[\d+\])# Daemon name (with optional source_file:line or whatever)# EXAMPLES: pam_rhosts_auth, [sshd], pop(pam_unix)__daemon_re = [\[\(]?<_daemon>(?:\(\S+\))?[\]\)]?:?# extra daemon info# EXAMPLE: [ID 800047 auth.info]__daemon_extra_re = \[ID \d+ \S+\]# Combinations of daemon name and PID# EXAMPLES: sshd[31607], pop(pam_unix)[4920]__daemon_combs_re = (?:<__pid_re>?:\s+<__daemon_re>|<__daemon_re><__pid_re>?:?)# Some messages have a kernel prefix with a timestamp# EXAMPLES: kernel: [769570.846956]__kernel_prefix = kernel:\s?\[ *\d+\.\d+\]:?__hostname = \S+# A MD5 hex# EXAMPLES: 07:06:27:55:b0:e3:0c:3c:5a:28:2d:7c:7e:4c:77:5f__md5hex = (?:[\da-f]{2}:){15}[\da-f]{2}# bsdverbose is where syslogd is started with -v or -vv and results in <4.3> or# <auth.info> appearing before the host as per testcases/files/logs/bsd/*.__bsd_syslog_verbose = <[^.]+\.[^.]+>__vserver = @vserver_\S+__date_ambit = (?:\[\])# Common line prefixes (beginnings) which could be used in filters## [bsdverbose]? [hostname] [vserver tag] daemon_id spaces## This can be optional (for instance if we match named native log files)__prefix_line = <lt_<logtype>/__prefix_line># PAM authentication mechanism check for failures, e.g.: pam_unix, pam_sss,# pam_ldap__pam_auth = pam_unix# standardly all formats using prefix have line-begin anchored date:datepattern = <lt_<logtype>/datepattern>[lt_file]# Common line prefixes for logtype "file":__prefix_line = <__date_ambit>?\s*(?:<__bsd_syslog_verbose>\s+)?(?:<__hostname>\s+)?(?:<__kernel_prefix>\s+)?(?:<__vserver>\s+)?(?:<__daemon_combs_re>\s+)?(?:<__daemon_extra_re>\s+)?datepattern = {^LN-BEG}[lt_short]# Common (short) line prefix for logtype "journal" (corresponds output of formatJournalEntry):__prefix_line = \s*(?:<__hostname>\s+)?(?:<_daemon><__pid_re>?:?\s+)?(?:<__kernel_prefix>\s+)?datepattern = %(lt_file/datepattern)s[lt_journal]__prefix_line = %(lt_short/__prefix_line)sdatepattern = %(lt_short/datepattern)s[lt_rfc5424]# RFC 5424 log-format, see gh-2309:#__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ \S+\s+__prefix_line = \s*<__hostname> <__daemon_re> \d+ \S+ (?:[^\[\]\s]+|(?:\[(?:[^\]"]*|"[^"]*")*\])+)\s+datepattern = ^<\d+>\d+\s+{DATE}# Author: Yaroslav Halchenko, Sergey G. Brester (aka sebres)