The syslog-ng 3.0 Administrator Guide

To classify messages using a pattern database, include a db_parser() statement in your syslog-ng configuration file using the following syntax:

Declaration:
        parser <identifier> {db_parser(file("<database_filename>"));};

Note that using the parser in a log statement only performs the classification, but does not automatically do anything with the results of the classification.

	Example 3.39. Defining pattern databases
	The following statement uses the database located at /opt/syslog-ng/var/db/patterndb.xml. parser pattern_db { db_parser( file("/opt/syslog-ng/var/db/patterndb.xml") ); }; To apply the patterns on the incoming messages, include the parser in a log statement: log { source(s_all); parser(pattern_db); destination( di_messages_class); };

	Note
	The default location of the pattern database file is /opt/syslog-ng/var/run/patterndb.xml. The file option of the db-parser statement can be used to specify a different file, thus different db-parser statements can use different pattern databases. Later versions of syslog-ng will be able to dynamically generate a main database from separate pattern database files.

Example 3.40. Using classification results

The following destination separates the log messages into different files based on the class assigned to the pattern that matches the message (e.g., Violation and Security type messages are stored in a separate file), and also adds the ID of the matching rule to the message: destination di_messages_class { file("/var/log/messages-${.classifier.class}" template("${.classifier.rule_id};${S_UNIXTIME};${SOURCEIP};${HOST};${PROGRAM};${PID};${MSG}\n") template_escape(no) ); };

Sample pattern databases are available at the BalaBit Download page http://www.balabit.com/network-security/syslog-ng/log-server-appliance/. However, these are not directly usable in syslog-ng 3.0.x, because they are formatted according to the second version (V2) of the pattern database format, which is supported only by the syslog-ng Store Box (SSB) appliance version 1.0.x. The syslog-ng 3.0.x OSE and PE applications only support the first version (V1) of the pattern database; support for the V2 and V3 pattern database formats will be available in syslog-ng 3.1. In the meantime, you can create your own pattern database: see Section 8.6.2.3, “Creating pattern databases” for details.