GYP@BalaBit

The next long-time-supported release of SSB version 3 LTS is just around the corner; we're just committing our final patches and performing the final release testing right now. This release includes a switch to 64-bit architecture, a huge performance improvement in the indexing/searching feature for a large number of message and search patterns and a couple of new features, too. In the following posts I plan to introduce those new features to you. The updated User's Manual will contain a detailed description of them -- these posts are written more to serve as teasers and to highlight some of the use cases we had in mind when we'd planned the features, and, of course, to ask for your feedback about them. One of the new features is the the capability to rewrite log messages. On the surface, the feature is quite easy to use and configure. On the Log/Paths page if you roll down the details section of a log path, you will now be able to find a new section called "Rewrites". There are two types of filters: one that gets applied before the filtering is performed (so that you can use the rewritten message part in your filter expression) and one that is only applied after the filtering is performed (so that you can use the original information in the filtering and only change the data that gets stored or forwarded). A rewrite rule, as any kind of assignment, has two sides: the left side is the name of the message part you'd like to change and the right side is the value you'd like to assign to it. For the left side, you can choose from a number of built-in message parts (eg. MESSAGE, HOST) or add an arbitrarily named new part. The right side works as all message templates do in SSB or syslog-ng: you can use a combination of macros and plain text. In case of both fields, autocompletion of suggested and possible values facilitates configuring the rewrite rule.. You can add any number of rewrite rules to a log path, the rules are applied in order (you can use the result of a previous rewrite in a following one) and rewrite rules in distinct log paths are independent from each other. But what can it be used for?