Zurück
-
Titel
Filter "NOT" Statements fail to be evaluated by Syslog-ng PE -
Beschreibung
After upgrading or installing Syslog-ng PE 7.0.28 filter statements containing "NOT" are not being processed leading to possible log loss. -
Ursache
A defect has been found in version 7.0.28 of Syslog-ng PE where "NOT" filter statements are not being evaluated by Syslog-ng PE causing invalid results.
When a filter containing a "not" operator is reused in the config or a non-trivial filter containing "not" is referenced by its name within other filters could cause invalid results.
Product Defect: SYSLOGDEV-6244CAUSE:
Example # 1################################filter f_f1{not ( host("a") or host("b"));};destination dout { file("/dev/stdout"); };log {source{ network(port(4444)); };filter(f_f1); # first reference worksdestination(dout);};log {source{ network(port(5555)); };filter(f_f1); # second reference failsdestination(dout);};############################Example # 2############################filter f_f2 {not (program("a") and message("b"));};filter f_f3 {filter(f_f2)};log {source { stdin(); };filter(f_f3); # invalid resultdestination { file("/dev/stdout"); };};############################ -
Lösung
Resolution:
Version 7.0.29 of Syslog-ng PE has addressed this defect and resolved this issue.
Please upgrade to 7.0.29 or the next latest version of Syslog-ng PE to resolve this issue. -
Änderungsanforderung
SYSLOGDEV-6244