Hi,
some days ago Wietse mentioned auxiliary/collate/collate.pl in the
Postfix 3.2 source-code distribution. I did try my luck with it and it
is pretty impressive.
There remains one problem for me: it got this regular expression:
my $instre = qr{(?x)
\A # Absolute line start
(?:\S+ \s+){3} # Timestamp, adjust for other time formats
\S+ \s+ # Hostname
(postfix(?:-\S+)?)/ # postfix instance
};
and later:
while (<>) {
next unless m{$instre}ogc; my $inst = $1;
For something like
Aug 23 17:07:25 host postfix/smtp[16110]: 16C3436A25A: to=...
it extracts "postfix" as instance name.
For something like
Aug 23 17:07:25 host postfix-sec/smtp[16110]: 16C3436A25A: to=...
it extracts "postfix-sec" as instance name.
I have a habit of using syslog_name in master.cf when using copies of
existing lines to distinguish them from the original. For example:
smtp unix - - y - - smtp
slow unix - - y - - smtp -o syslog_name=postfix_slow
This would give me:
Aug 23 17:07:25 host postfix_slow/smtp[16110]: 16C3436A25A: to=...
In a secondary instance I would change that to
Aug 23 17:07:25 host postfix_slow-sec/smtp[16110]: 16C3436A25A: to=...
I would like to have postfix and postfix_slow in one block, while
postfix-sec and postfix_slow-sec in another block. Could someone help me
modify this part of the regular expression:
(postfix(?:-\S+)?)/ # postfix instance
so that it spits out "postfix" and "postfix-sec" while deleting the
"_slow" part? Much appreciated!
Kind regards,
Robert
