We've upgraded our DHCP server to debian 9. Now the dhcp log is written differently then on our old server
log lines contains now: dhcpd[1569]: instead of dhcpd:
Jul 18 09:12:43 dhcp-server-name dhcpd[1569]: DHCPACK on ip-address to 00:00:00:00:00:00 (modem-type) via ip-address
the app: Linux DHCP can not handle this
can we change the regex in transform.conf
from:
\s(dhcpd):\s
to:
\sdhcpd(:\s|[\d+]:\s)
or should we change more? I tested it, but this change to transform.conf does not work
Try escaping those [ ]
characters. They have special meaning in regular expressions, so if you want to match actual brackets, they need to be escaped: \sdhcpd(\:\s|\[\d+\]\:\s)
https://regex101.com/r/pRwz3z/1
I've fixed it by changing all the regex in the transforms.conf
from:
\s(dhcpd)\:\s
to:
\sdhcpd(\:\s|\[\d+\]:\s)
Also we need to change the file: eventtypes.conf
from:
[dhcpd_event]
search = process=dhcpd
to:
[dhcpd_event]
search = dhcpd
After this, it is working for the old and new log lines
Why the double backslashes?
Sorry, my mistake. I changed it.