[Lognorm] Question on special characters

[Rainer Gerhards]

> -----Original Message-----
> From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> bounces at lists.adiscon.com] On Behalf Of Lay, James
> Sent: Friday, December 02, 2011 4:17 PM
> To: lognorm
> Subject: Re: [Lognorm] Question on special characters
> 
> Thanks Rainer....is there anything I can do on my end to troubleshoot or
> make things easier?

Get me a 36 hr day ;-) Let me check on the original question, maybe I see it.
Did you try with liblognorm's normalizer tool in verbose (-v) mode - that is
often quite educating.

Rainer

> 
> James
> 
> > -----Original Message-----
> > From: lognorm-bounces at lists.adiscon.com
> [mailto:lognorm-bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards
> > Sent: Friday, December 02, 2011 7:54 AM
> > To: lognorm
> > Subject: Re: [Lognorm] Question on special characters
> >
> > Sorry...all of my time has been taken by that journald proposal. I
> hope to
> > resume regular work next week...
> >
> > rainer
> >
> > > -----Original Message-----
> > > From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> > > bounces at lists.adiscon.com] On Behalf Of Lay, James
> > > Sent: Friday, December 02, 2011 3:52 PM
> > > To: lognorm at lists.adiscon.com
> > > Subject: Re: [Lognorm] Question on special characters
> > >
> > > Any movement on this?  I am unable to move forward with rule
> creation for
> > > one of my devices until this is ironed out.  Thank you.
> > >
> > >
> > >
> > > James
> > >
> > >
> > >
> > > From: lognorm-bounces at lists.adiscon.com [mailto:lognorm-
> > > bounces at lists.adiscon.com] On Behalf Of Lay, James
> > > Sent: Thursday, November 24, 2011 11:32 AM
> > > To: lognorm at lists.adiscon.com
> > > Subject: [Lognorm] Question on special characters
> > >
> > >
> > >
> > > Hey all!
> > >
> > >
> > >
> > > So...I think I'm getting down to the bottom of something that I've
> had an
> > > issue with.  Here's some tests:
> > >
> > >
> > >
> > > Log contents to pass to normalizer, blick.txt:
> > >
> > > Test one)
> > >
> > >
> > >
> > > Rulebase file blick-rulebase:
> > >
> > > prefix=
> > >
> > > rule=: Test one)
> > >
> > >
> > >
> > > normalizer -r blick-rulebase < blick.txt
> > >
> > > this works, and returns nothing, since no normalizing was required
> (as I
> > > understand it).
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > Now...if I make the below change to the blick-rulebase file:
> > >
> > >
> > >
> > > prefix=
> > >
> > > rule=: Test %-:word%)
> > >
> > >
> > >
> > > normalizer -r blick-rulebase < blick.txt
> > >
> > > [cee at 115 originalmsg=" Test one)" unparsed-data=" "]
> > >
> > >
> > >
> > > Then it looks like something isn't working.
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > If I remove the ")" in both blick.txt and blick-rulebase to reflect:
> > >
> > > Test one
> > >
> > >
> > >
> > > prefix=
> > >
> > > rule=: Test %-:word%
> > >
> > >
> > >
> > > then it works:
> > >
> > > normalizer -r blick-rulebase < blick.txt
> > >
> > > [cee at 115 -="one"]
> > >
> > >
> > >
> > > This seems to happen with matching %word% within parenthesis.  Is
> there
> > > something I can do to check this on my end?  Thank you.
> > >
> > >
> > >
> > > James
> >
> > _______________________________________________
> > Lognorm mailing list
> > Lognorm at lists.adiscon.com
> > http://lists.adiscon.net/mailman/listinfo/lognorm
> _______________________________________________
> Lognorm mailing list
> Lognorm at lists.adiscon.com
> http://lists.adiscon.net/mailman/listinfo/lognorm