[Lognorm] Question on special characters

[Lay, James]

Any movement on this?  I am unable to move forward with rule creation
for one of my devices until this is ironed out.  Thank you.

 

James

 

From: lognorm-bounces at lists.adiscon.com
[mailto:lognorm-bounces at lists.adiscon.com] On Behalf Of Lay, James
Sent: Thursday, November 24, 2011 11:32 AM
To: lognorm at lists.adiscon.com
Subject: [Lognorm] Question on special characters

 

Hey all!

 

So...I think I'm getting down to the bottom of something that I've had
an issue with.  Here's some tests:

 

Log contents to pass to normalizer, blick.txt:

Test one)

 

Rulebase file blick-rulebase:

prefix=

rule=: Test one)

 

normalizer -r blick-rulebase < blick.txt

this works, and returns nothing, since no normalizing was required (as I
understand it).

 

 

 

Now...if I make the below change to the blick-rulebase file:

 

prefix=

rule=: Test %-:word%)

 

normalizer -r blick-rulebase < blick.txt

[cee at 115 originalmsg=" Test one)" unparsed-data=" "]

 

Then it looks like something isn't working.

 

 

 

If I remove the ")" in both blick.txt and blick-rulebase to reflect:

Test one

 

prefix=

rule=: Test %-:word%

 

then it works:

normalizer -r blick-rulebase < blick.txt

[cee at 115 -="one"]

 

This seems to happen with matching %word% within parenthesis.  Is there
something I can do to check this on my end?  Thank you.

 

James

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20111202/f48dbf00/attachment.htm>