{"action":"opened","issue":{"url":"https://api.github.com/repos/balabit/syslog-ng/issues/1455","repository_url":"https://api.github.com/repos/balabit/syslog-ng","labels_url":"https://api.github.com/repos/balabit/syslog-ng/issues/1455/labels{/name}","comments_url":"https://api.github.com/repos/balabit/syslog-ng/issues/1455/comments","events_url":"https://api.github.com/repos/balabit/syslog-ng/issues/1455/events","html_url":"https://github.com/balabit/syslog-ng/issues/1455","id":225420245,"number":1455,"title":"syslog-ng 3.9.1 erroneously matching regex ","user":{"login":"soumyadipdm","id":9334127,"avatar_url":"https://avatars2.githubusercontent.com/u/9334127?v=3","gravatar_id":"","url":"https://api.github.com/users/soumyadipdm","html_url":"https://github.com/soumyadipdm","followers_url":"https://api.github.com/users/soumyadipdm/followers","following_url":"https://api.github.com/users/soumyadipdm/following{/other_user}","gists_url":"https://api.github.com/users/soumyadipdm/gists{/gist_id}","starred_url":"https://api.github.com/users/soumyadipdm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/soumyadipdm/subscriptions","organizations_url":"https://api.github.com/users/soumyadipdm/orgs","repos_url":"https://api.github.com/users/soumyadipdm/repos","events_url":"https://api.github.com/users/soumyadipdm/events{/privacy}","received_events_url":"https://api.github.com/users/soumyadipdm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-05-01T11:11:19Z","updated_at":"2017-05-01T11:11:19Z","closed_at":null,"body":"# Issue\r\n\r\nsyslog-ng 3.9.1 is erroneously matching the following filter:\r\n\r\n```\r\nfilter f_notifier_filter    { not match(\"ASA-4-302015|ASA-4-302013|TRAFFIC|permitted|Deny|Denied|denied\", value(\"MESSAGE\")); };\r\n```\r\nand the filter is used like this:\r\n\r\n```\r\nlog {\r\n\r\n    source(s_net);\r\n    source(s_udp);\r\n    source(s_tcp);\r\n    source(s_sys);\r\n    source(s_windows);\r\n<<snipped>>\r\n        log {\r\n            filter(f_local5);\r\n            destination(d_networkx);\r\n            log {\r\n                filter(f_notifier_filter);\r\n                destination(d_notifier);\r\n            };\r\n        };\r\n};\r\n```\r\nIf I comment out the filter, it forwards the log just fine. But with the filter in, it does not forward.\r\n\r\nHere's the `tcpdump` capture of the incoming log payload:\r\n```\r\n10:09:46.248243 IP (tos 0x0, ttl 244, id 1827, offset 0, flags [none], proto UDP (17), length 124)\r\n    172.23.144.254.52606 > 10.252.194.48.514: [udp sum ok] SYSLOG, length: 96\r\n        Facility local5 (21), Severity notice (5)\r\n        Msg: 1829: May  1 10:09:45.151 UTC: %BGP-5-ADJCHANGE: neighbor 172.19.254.6 Down Admin. shutdown\r\n        0x0000:  3c31 3733 3e31 3832 393a 204d 6179 2020\r\n        0x0010:  3120 3130 3a30 393a 3435 2e31 3531 2055\r\n        0x0020:  5443 3a20 2542 4750 2d35 2d41 444a 4348\r\n        0x0030:  414e 4745 3a20 6e65 6967 6862 6f72 2031\r\n        0x0040:  3732 2e31 392e 3235 342e 3620 446f 776e\r\n        0x0050:  2041 646d 696e 2e20 7368 7574 646f 776e\r\n        0x0000:  4500 007c 0723 0000 f411 b50b ac17 90fe  E..|.#..........\r\n        0x0010:  0afc c230 cd7e 0202 0068 8b5a 3c31 3733  ...0.~...h.Z<173\r\n        0x0020:  3e31 3832 393a 204d 6179 2020 3120 3130  >1829:.May..1.10\r\n        0x0030:  3a30 393a 3435 2e31 3531 2055 5443 3a20  :09:45.151.UTC:.\r\n        0x0040:  2542 4750 2d35 2d41 444a 4348 414e 4745  %BGP-5-ADJCHANGE\r\n        0x0050:  3a20 6e65 6967 6862 6f72 2031 3732 2e31  :.neighbor.172.1\r\n        0x0060:  392e 3235 342e 3620 446f 776e 2041 646d  9.254.6.Down.Adm\r\n        0x0070:  696e 2e20 7368 7574 646f 776e            in..shutdown\r\n10:09:46.248250 IP (tos 0x0, ttl 244, id 1828, offset 0, flags [none], proto UDP (17), length 176)\r\n    172.23.144.254.52606 > 10.252.194.48.514: [udp sum ok] SYSLOG, length: 148\r\n        Facility local5 (21), Severity notice (5)\r\n        Msg: 1830: May  1 10:09:45.151 UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 172.19.254.6 IPv4 Unicast topology base removed from session  Admin. shutdown\r\n        0x0000:  3c31 3733 3e31 3833 303a 204d 6179 2020\r\n        0x0010:  3120 3130 3a30 393a 3435 2e31 3531 2055\r\n        0x0020:  5443 3a20 2542 4750 5f53 4553 5349 4f4e\r\n        0x0030:  2d35 2d41 444a 4348 414e 4745 3a20 6e65\r\n        0x0040:  6967 6862 6f72 2031 3732 2e31 392e 3235\r\n        0x0050:  342e 3620 4950 7634 2055 6e69 6361 7374\r\n        0x0060:  2074 6f70 6f6c 6f67 7920 6261 7365 2072\r\n        0x0070:  656d 6f76 6564 2066 726f 6d20 7365 7373\r\n        0x0080:  696f 6e20 2041 646d 696e 2e20 7368 7574\r\n        0x0090:  646f 776e\r\n        0x0000:  4500 00b0 0724 0000 f411 b4d6 ac17 90fe  E....$..........\r\n        0x0010:  0afc c230 cd7e 0202 009c 0cbf 3c31 3733  ...0.~......<173\r\n        0x0020:  3e31 3833 303a 204d 6179 2020 3120 3130  >1830:.May..1.10\r\n        0x0030:  3a30 393a 3435 2e31 3531 2055 5443 3a20  :09:45.151.UTC:.\r\n        0x0040:  2542 4750 5f53 4553 5349 4f4e 2d35 2d41  %BGP_SESSION-5-A\r\n        0x0050:  444a 4348 414e 4745 3a20 6e65 6967 6862  DJCHANGE:.neighb\r\n        0x0060:  6f72 2031 3732 2e31 392e 3235 342e 3620  or.172.19.254.6.\r\n        0x0070:  4950 7634 2055 6e69 6361 7374 2074 6f70  IPv4.Unicast.top\r\n        0x0080:  6f6c 6f67 7920 6261 7365 2072 656d 6f76  ology.base.remov\r\n        0x0090:  6564 2066 726f 6d20 7365 7373 696f 6e20  ed.from.session.\r\n        0x00a0:  2041 646d 696e 2e20 7368 7574 646f 776e  .Admin..shutdown\r\n10:09:54.612079 IP (tos 0x0, ttl 243, id 1829, offset 0, flags [none], proto UDP (17), length 107)\r\n    172.23.144.254.52606 > 10.252.194.48.514: [udp sum ok] SYSLOG, length: 79\r\n        Facility local5 (21), Severity notice (5)\r\n        Msg: 1831: May  1 10:09:53.513 UTC: %BGP-5-ADJCHANGE: neighbor 172.19.254.6 Up\r\n        0x0000:  3c31 3733 3e31 3833 313a 204d 6179 2020\r\n        0x0010:  3120 3130 3a30 393a 3533 2e35 3133 2055\r\n        0x0020:  5443 3a20 2542 4750 2d35 2d41 444a 4348\r\n        0x0030:  414e 4745 3a20 6e65 6967 6862 6f72 2031\r\n        0x0040:  3732 2e31 392e 3235 342e 3620 5570 20\r\n        0x0000:  4500 006b 0725 0000 f311 b61a ac17 90fe  E..k.%..........\r\n        0x0010:  0afc c230 cd7e 0202 0057 bddc 3c31 3733  ...0.~...W..<173\r\n        0x0020:  3e31 3833 313a 204d 6179 2020 3120 3130  >1831:.May..1.10\r\n        0x0030:  3a30 393a 3533 2e35 3133 2055 5443 3a20  :09:53.513.UTC:.\r\n        0x0040:  2542 4750 2d35 2d41 444a 4348 414e 4745  %BGP-5-ADJCHANGE\r\n        0x0050:  3a20 6e65 6967 6862 6f72 2031 3732 2e31  :.neighbor.172.1\r\n        0x0060:  392e 3235 342e 3620 5570 20              9.254.6.Up.\r\n``` \r\n\r\nWith the filter disabled, syslog-ng forwards the log without any issue. Here's a `tcpdump` of same log being forwarded (outgoing log):\r\n```\r\n    10.252.194.35.36290 > 10.252.226.170.6000: Flags [.], cksum 0xc63c (incorrect -> 0x0cf8), seq 5611006:5613902, ack 1, win 58, options [nop,nop,TS val 79335807 ecr 3718637777],length 2896\r\n        0x0000:  4500 0b84 b493 4000 4006 c01a 0afc c223  E.....@.@......#\r\n        0x0010:  0afc e2aa 8dc2 1770 9f09 14c5 610a 6912  .......p....a.i.\r\n        0x0020:  8010 003a c63c 0000 0101 080a 04ba 917f  ...:.<..........\r\n        0x0030:  dda5 e8d1 3239 2e31 3230 2e32 3033 2f36  ....29.120.203/6\r\n        0x0040:  3234 3937 2074 6f20 6c61 6e30 312d 7469  2497.to.lan01-ti\r\n        0x0050:  6572 3a31 3732 2e32 312e 3230 2e32 312f  er:172.21.20.21/\r\n        0x0060:  3730 3030 2077 6974 6820 6469 6666 6572  7000.with.differ\r\n        0x0070:  656e 7420 696e 6974 6961 6c20 7365 7175  ent.initial.sequ\r\n        0x0080:  656e 6365 206e 756d 6265 720a 3c31 3634  ence.number.<164\r\n        0x0090:  3e4d 6179 2020 3120 3130 3a30 393a 3534  >May..1.10:09:54\r\n        0x00a0:  206e 7367 372d 7670 6e30 312e 636f 7270  .abc-vpn01.corp\r\n        0x00b0:  2e6c 696e 6b65 6469 6e2e 636f 6d20 2541  .xyz.com.%A\r\n        0x00c0:  5341 2d34 2d34 3139 3030 323a 2044 7570  SA-4-419002:.Dup\r\n        0x00d0:  6c69 6361 7465 2054 4350 2053 594e 2066  licate.TCP.SYN.f\r\n        0x00e0:  726f 6d20 6c61 6e30 312d 7469 6572 3a31  rom.lan01-tier:1\r\n        0x00f0:  3732 2e32 392e 3132 302e 3230 332f 3632  72.29.120.203/62\r\n        0x0100:  3439 3720 746f 206c 616e 3031 2d74 6965  497.to.lan01-tie\r\n        0x0110:  723a 3137 322e 3231 2e32 302e 3231 2f37  r:172.21.20.21/7\r\n        0x0120:  3030 3020 7769 7468 2064 6966 6665 7265  000.with.differe\r\n        0x0130:  6e74 2069 6e69 7469 616c 2073 6571 7565  nt.initial.seque\r\n        0x0140:  6e63 6520 6e75 6d62 6572 0a3c 3136 343e  nce.number.<164>\r\n        0x0150:  4d61 7920 2031 2031 303a 3039 3a35 3420  May..1.10:09:54.\r\n        0x0160:  6e73 6737 2d76 706e 3031 2e63 6f72 702e  abc-vpn01.corp.\r\n        0x0170:  6c69 6e6b 6564 696e 2e63 6f6d 2025 4153  xyz.com.%AS\r\n        0x0180:  412d 342d 3431 3930 3032 3a20 4475 706c  A-4-419002:.Dupl\r\n        0x0190:  6963 6174 6520 5443 5020 5359 4e20 6672  icate.TCP.SYN.fr\r\n        0x01a0:  6f6d 206c 616e 3031 2d74 6965 723a 3137  om.lan01-tier:17\r\n        0x01b0:  322e 3239 2e31 3230 2e32 3033 2f36 3234  2.29.120.203/624\r\n        0x01c0:  3937 2074 6f20 6c61 6e30 312d 7469 6572  97.to.lan01-tier\r\n        0x01d0:  3a31 3732 2e32 312e 3230 2e32 312f 3730  :172.21.20.21/70\r\n        0x01e0:  3030 2077 6974 6820 6469 6666 6572 656e  00.with.differen\r\n        0x01f0:  7420 696e 6974 6961 6c20 7365 7175 656e  t.initial.sequen\r\n        0x0200:  6365 206e 756d 6265 720a 3c31 3634 3e4d  ce.number.<164>M\r\n        0x0210:  6179 2020 3120 3130 3a30 393a 3534 206e  ay..1.10:09:54.n\r\n        0x0220:  7367 372d 7670 6e30 312e 636f 7270 2e6c  sg7-vpn01.corp.l\r\n        0x0230:  696e 6b65 6469 6e2e 636f 6d20 2541 5341  inkedin.com.%ASA\r\n        0x0240:  2d34 2d34 3139 3030 323a 2044 7570 6c69  -4-419002:.Dupli\r\n        0x0250:  6361 7465 2054 4350 2053 594e 2066 726f  cate.TCP.SYN.fro\r\n        0x0260:  6d20 6c61 6e30 312d 7469 6572 3a31 3732  m.lan01-tier:172\r\n        0x0270:  2e32 392e 3132 302e 3230 332f 3632 3439  .29.120.203/6249\r\n        0x0280:  3720 746f 206c 616e 3031 2d74 6965 723a  7.to.lan01-tier:\r\n        0x0290:  3137 322e 3231 2e32 302e 3231 2f37 3030  172.21.20.21/700\r\n        0x02a0:  3020 7769 7468 2064 6966 6665 7265 6e74  0.with.different\r\n        0x02b0:  2069 6e69 7469 616c 2073 6571 7565 6e63  .initial.sequenc\r\n        0x02c0:  6520 6e75 6d62 6572 0a3c 3136 343e 4d61  e.number.<164>Ma\r\n        0x02d0:  7920 2031 2031 303a 3039 3a35 3420 6e73  y..1.10:09:54.ns\r\n        0x02e0:  6737 2d76 706e 3031 2e63 6f72 702e 6c69  g7-vpn01.corp.li\r\n        0x02f0:  6e6b 6564 696e 2e63 6f6d 2025 4153 412d  nkedin.com.%ASA-\r\n        0x0300:  342d 3431 3930 3032 3a20 4475 706c 6963  4-419002:.Duplic\r\n        0x0310:  6174 6520 5443 5020 5359 4e20 6672 6f6d  ate.TCP.SYN.from\r\n        0x0320:  206c 616e 3031 2d74 6965 723a 3137 322e  .lan01-tier:172.\r\n        0x0330:  3239 2e31 3230 2e32 3033 2f36 3234 3937  29.120.203/62497\r\n        0x0340:  2074 6f20 6c61 6e30 312d 7469 6572 3a31  .to.lan01-tier:1\r\n        0x0350:  3732 2e32 312e 3230 2e32 312f 3730 3030  72.21.20.21/7000\r\n        0x0360:  2077 6974 6820 6469 6666 6572 656e 7420  .with.different.\r\n        0x0370:  696e 6974 6961 6c20 7365 7175 656e 6365  initial.sequence\r\n        0x0380:  206e 756d 6265 720a 3c31 3637 3e4d 6179  .number.<167>May\r\n        0x0390:  2020 3120 3130 3a30 393a 3534 2031 3732  ..1.10:09:54.172\r\n        0x03a0:  2e32 392e 3735 2e31 3238 2048 6f73 7464  .29.75.128.Hostd\r\n        0x03b0:  3a20 7472 6976 6961 2068 6f73 7464 5b33  :.trivia.hostd[3\r\n        0x03c0:  3239 3430 4237 305d 205b 4f72 6967 696e  2940B70].[Origin\r\n        0x03d0:  6174 6f72 4036 3837 3620 7375 623d 5072  ator@6876.sub=Pr\r\n        0x03e0:  6f70 6572 7479 4a6f 7572 6e61 6c20 6f70  opertyJournal.op\r\n        0x03f0:  4944 3d37 6461 3138 6130 385d 205b 456e  ID=7da18a08].[En\r\n        0x0400:  7472 793a 3a48 6173 4368 616e 6765 645d  try::HasChanged]\r\n        0x0410:  3a20 7570 7065 725f 626f 756e 6420 7265  :.upper_bound.re\r\n        0x0420:  7475 726e 206e 756c 6c2c 206f 703d 454d  turn.null,.op=EM\r\n        0x0430:  5054 592c 2072 6574 7572 6e20 4641 4c53  PTY,.return.FALS\r\n        0x0440:  450a 3c31 3634 3e4d 6179 2020 3120 3130  E.<164>May..1.10\r\n        0x0450:  3a30 393a 3534 206e 7367 372d 7670 6e30  :09:54.abc-vpn0\r\n        0x0460:  312e 636f 7270 2e6c 696e 6b65 6469 6e2e  1.corp.xyz.\r\n        0x0470:  636f 6d20 2541 5341 2d34 2d34 3139 3030  com.%ASA-4-41900\r\n        0x0480:  323a 2044 7570 6c69 6361 7465 2054 4350  2:.Duplicate.TCP\r\n        0x0490:  2053 594e 2066 726f 6d20 6c61 6e30 312d  .SYN.from.lan01-\r\n        0x04a0:  7469 6572 3a31 3732 2e32 392e 3132 302e  tier:172.29.120.\r\n        0x04b0:  3230 332f 3632 3439 3720 746f 206c 616e  203/62497.to.lan\r\n        0x04c0:  3031 2d74 6965 723a 3137 322e 3231 2e32  01-tier:172.21.2\r\n        0x04d0:  302e 3231 2f37 3030 3020 7769 7468 2064  0.21/7000.with.d\r\n        0x04e0:  6966 6665 7265 6e74 2069 6e69 7469 616c  ifferent.initial\r\n        0x04f0:  2073 6571 7565 6e63 6520 6e75 6d62 6572  .sequence.number\r\n        0x0500:  0a3c 3136 343e 4d61 7920 2031 2031 303a  .<164>May..1.10:\r\n        0x0510:  3039 3a35 3420 6e73 6737 2d76 706e 3031  09:54.abc-vpn01\r\n        0x0520:  2e63 6f72 702e 6c69 6e6b 6564 696e 2e63  .corp.xyz.c\r\n        0x0530:  6f6d 2025 4153 412d 342d 3431 3930 3032  om.%ASA-4-419002\r\n        0x0540:  3a20 4475 706c 6963 6174 6520 5443 5020  :.Duplicate.TCP.\r\n        0x0550:  5359 4e20 6672 6f6d 206c 616e 3031 2d74  SYN.from.lan01-t\r\n        0x0560:  6965 723a 3137 322e 3239 2e31 3230 2e32  ier:172.29.120.2\r\n        0x0570:  3033 2f36 3234 3937 2074 6f20 6c61 6e30  03/62497.to.lan0\r\n        0x0580:  312d 7469 6572 3a31 3732 2e32 312e 3230  1-tier:172.21.20\r\n        0x0590:  2e32 312f 3730 3030 2077 6974 6820 6469  .21/7000.with.di\r\n        0x05a0:  6666 6572 656e 7420 696e 6974 6961 6c20  fferent.initial.\r\n        0x05b0:  7365 7175 656e 6365 206e 756d 6265 720a  sequence.number.\r\n        0x05c0:  3c31 3637 3e4d 6179 2020 3120 3130 3a30  <167>May..1.10:0\r\n        0x05d0:  393a 3534 2031 3732 2e32 392e 3735 2e31  9:54.172.29.75.1\r\n        0x05e0:  3238 2048 6f73 7464 3a20 7472 6976 6961  28.Hostd:.trivia\r\n        0x05f0:  2068 6f73 7464 5b33 3239 3430 4237 305d  .hostd[32940B70]\r\n        0x0600:  205b 4f72 6967 696e 6174 6f72 4036 3837  .[Originator@687\r\n        0x0610:  3620 7375 623d 5072 6f70 6572 7479 4a6f  6.sub=PropertyJo\r\n        0x0620:  7572 6e61 6c20 6f70 4944 3d37 6461 3138  urnal.opID=7da18\r\n        0x0630:  6130 385d 205b 456e 7472 793a 3a48 6173  a08].[Entry::Has\r\n        0x0640:  4368 616e 6765 645d 3a20 7570 7065 725f  Changed]:.upper_\r\n        0x0650:  626f 756e 6420 7265 7475 726e 206e 756c  bound.return.nul\r\n        0x0660:  6c2c 206f 703d 454d 5054 592c 2072 6574  l,.op=EMPTY,.ret\r\n        0x0670:  7572 6e20 4641 4c53 450a 3c31 3634 3e4d  urn.FALSE.<164>M\r\n        0x0680:  6179 2020 3120 3130 3a30 393a 3534 206e  ay..1.10:09:54.n\r\n        0x0690:  7367 372d 7670 6e30 312e 636f 7270 2e6c  sg7-vpn01.corp.l\r\n        0x06a0:  696e 6b65 6469 6e2e 636f 6d20 2541 5341  inkedin.com.%ASA\r\n        0x06b0:  2d34 2d34 3139 3030 323a 2044 7570 6c69  -4-419002:.Dupli\r\n        0x06c0:  6361 7465 2054 4350 2053 594e 2066 726f  cate.TCP.SYN.fro\r\n        0x06d0:  6d20 6c61 6e30 312d 7469 6572 3a31 3732  m.lan01-tier:172\r\n        0x06e0:  2e32 392e 3132 302e 3230 332f 3632 3439  .29.120.203/6249\r\n        0x06f0:  3720 746f 206c 616e 3031 2d74 6965 723a  7.to.lan01-tier:\r\n        0x0700:  3137 322e 3231 2e32 302e 3231 2f37 3030  172.21.20.21/700\r\n        0x0710:  3020 7769 7468 2064 6966 6665 7265 6e74  0.with.different\r\n        0x0720:  2069 6e69 7469 616c 2073 6571 7565 6e63  .initial.sequenc\r\n        0x0730:  6520 6e75 6d62 6572 0a3c 3136 343e 4d61  e.number.<164>Ma\r\n        0x0740:  7920 2031 2031 303a 3039 3a35 3420 6e73  y..1.10:09:54.ns\r\n        0x0750:  6737 2d76 706e 3031 2e63 6f72 702e 6c69  g7-vpn01.corp.li\r\n        0x0760:  6e6b 6564 696e 2e63 6f6d 2025 4153 412d  nkedin.com.%ASA-\r\n        0x0770:  342d 3431 3930 3032 3a20 4475 706c 6963  4-419002:.Duplic\r\n        0x0780:  6174 6520 5443 5020 5359 4e20 6672 6f6d  ate.TCP.SYN.from\r\n        0x0790:  206c 616e 3031 2d74 6965 723a 3137 322e  .lan01-tier:172.\r\n        0x07a0:  3239 2e31 3230 2e32 3033 2f36 3234 3937  29.120.203/62497\r\n        0x07b0:  2074 6f20 6c61 6e30 312d 7469 6572 3a31  .to.lan01-tier:1\r\n        0x07c0:  3732 2e32 312e 3230 2e32 312f 3730 3030  72.21.20.21/7000\r\n        0x07d0:  2077 6974 6820 6469 6666 6572 656e 7420  .with.different.\r\n        0x07e0:  696e 6974 6961 6c20 7365 7175 656e 6365  initial.sequence\r\n        0x07f0:  206e 756d 6265 720a 3c31 3733 3e4d 6179  .number.<173>May\r\n        0x0800:  2020 3120 3130 3a30 393a 3533 2061 7370  ..1.10:09:53.asp\r\n        0x0810:  342d 7772 7430 322e 6774 732e 6c69 6e6b  4-wrt02.gts.link\r\n        0x0820:  6564 696e 2e63 6f6d 2055 5443 3a20 2542  edin.com.UTC:.%B\r\n        0x0830:  4750 2d35 2d41 444a 4348 414e 4745 3a20  GP-5-ADJCHANGE:.\r\n        0x0840:  6e65 6967 6862 6f72 2031 3732 2e31 392e  neighbor.172.19.\r\n        0x0850:  3235 342e 3620 5570 200a 3c31 3634 3e4d  254.6.Up..<164>M\r\n        0x0860:  6179 2020 3120 3130 3a30 393a 3534 206e  ay..1.10:09:54.n\r\n        0x0870:  7367 372d 7670 6e30 312e 636f 7270 2e6c  sg7-vpn01.corp.l\r\n        0x0880:  696e 6b65 6469 6e2e 636f 6d20 2541 5341  inkedin.com.%ASA\r\n        0x0890:  2d34 2d34 3139 3030 323a 2044 7570 6c69  -4-419002:.Dupli\r\n        0x08a0:  6361 7465 2054 4350 2053 594e 2066 726f  cate.TCP.SYN.fro\r\n        0x08b0:  6d20 6c61 6e30 312d 7469 6572 3a31 3732  m.lan01-tier:172\r\n        0x08c0:  2e32 392e 3132 302e 3230 332f 3632 3439  .29.120.203/6249\r\n        0x08d0:  3720 746f 206c 616e 3031 2d74 6965 723a  7.to.lan01-tier:\r\n        0x08e0:  3137 322e 3231 2e32 302e 3231 2f37 3030  172.21.20.21/700\r\n        0x08f0:  3020 7769 7468 2064 6966 6665 7265 6e74  0.with.different\r\n        0x0900:  2069 6e69 7469 616c 2073 6571 7565 6e63  .initial.sequenc\r\n        0x0910:  6520 6e75 6d62 6572 0a3c 3136 343e 4d61  e.number.<164>Ma\r\n        0x0920:  7920 2031 2031 303a 3039 3a35 3420 6e73  y..1.10:09:54.ns\r\n        0x0930:  6737 2d76 706e 3031 2e63 6f72 702e 6c69  g7-vpn01.corp.li\r\n        0x0940:  6e6b 6564 696e 2e63 6f6d 2025 4153 412d  nkedin.com.%ASA-\r\n        0x0950:  342d 3431 3930 3032 3a20 4475 706c 6963  4-419002:.Duplic\r\n        0x0960:  6174 6520 5443 5020 5359 4e20 6672 6f6d  ate.TCP.SYN.from\r\n        0x0970:  206c 616e 3031 2d74 6965 723a 3137 322e  .lan01-tier:172.\r\n        0x0980:  3239 2e31 3230 2e32 3033 2f36 3234 3937  29.120.203/62497\r\n        0x0990:  2074 6f20 6c61 6e30 312d 7469 6572 3a31  .to.lan01-tier:1\r\n        0x09a0:  3732 2e32 312e 3230 2e32 312f 3730 3030  72.21.20.21/7000\r\n        0x09b0:  2077 6974 6820 6469 6666 6572 656e 7420  .with.different.\r\n        0x09c0:  696e 6974 6961 6c20 7365 7175 656e 6365  initial.sequence\r\n        0x09d0:  206e 756d 6265 720a 3c31 3634 3e4d 6179  .number.<164>May\r\n        0x09e0:  2020 3120 3130 3a30 393a 3534 206e 7367  ..1.10:09:54.nsg\r\n        0x09f0:  372d 7670 6e30 312e 636f 7270 2e6c 696e  7-vpn01.corp.lin\r\n        0x0a00:  6b65 6469 6e2e 636f 6d20 2541 5341 2d34  kedin.com.%ASA-4\r\n        0x0a10:  2d34 3139 3030 323a 2044 7570 6c69 6361  -419002:.Duplica\r\n        0x0a20:  7465 2054 4350 2053 594e 2066 726f 6d20  te.TCP.SYN.from.\r\n        0x0a30:  6c61 6e30 312d 7469 6572 3a31 3732 2e32  lan01-tier:172.2\r\n        0x0a40:  392e 3132 302e 3230 332f 3632 3439 3720  9.120.203/62497.\r\n        0x0a50:  746f 206c 616e 3031 2d74 6965 723a 3137  to.lan01-tier:17\r\n        0x0a60:  322e 3231 2e32 302e 3231 2f37 3030 3020  2.21.20.21/7000.\r\n        0x0a70:  7769 7468 2064 6966 6665 7265 6e74 2069  with.different.i\r\n        0x0a80:  6e69 7469 616c 2073 6571 7565 6e63 6520  nitial.sequence.\r\n        0x0a90:  6e75 6d62 6572 0a3c 3136 343e 4d61 7920  number.<164>May.\r\n        0x0aa0:  2031 2031 303a 3039 3a35 3420 6e73 6737  .1.10:09:54.abc\r\n        0x0ab0:  2d76 706e 3031 2e63 6f72 702e 6c69 6e6b  -vpn01.corp.link\r\n        0x0ac0:  6564 696e 2e63 6f6d 2025 4153 412d 342d  edin.com.%ASA-4-\r\n        0x0ad0:  3431 3930 3032 3a20 4475 706c 6963 6174  419002:.Duplicat\r\n        0x0ae0:  6520 5443 5020 5359 4e20 6672 6f6d 206c  e.TCP.SYN.from.l\r\n        0x0af0:  616e 3031 2d74 6965 723a 3137 322e 3239  an01-tier:172.29\r\n        0x0b00:  2e31 3230 2e32 3033 2f36 3234 3937 2074  .120.203/62497.t\r\n        0x0b10:  6f20 6c61 6e30 312d 7469 6572 3a31 3732  o.lan01-tier:172\r\n        0x0b20:  2e32 312e 3230 2e32 312f 3730 3030 2077  .21.20.21/7000.w\r\n        0x0b30:  6974 6820 6469 6666 6572 656e 7420 696e  ith.different.in\r\n        0x0b40:  6974 6961 6c20 7365 7175 656e 6365 206e  itial.sequence.n\r\n        0x0b50:  756d 6265 720a 3c31 3634 3e4d 6179 2020  umber.<164>May..\r\n        0x0b60:  3120 3130 3a30 393a 3534 206e 7367 372d  1.10:09:54.abc-\r\n        0x0b70:  7670 6e30 312e 636f 7270 2e6c 696e 6b65  vpn01.corp.linke\r\n        0x0b80:  6469 6e2e                                din.\r\n```\r\nWith filter enabled, `tcpdump` does not show anything for outgoing log. `syslog-ng -Fevd` shows something like this:\r\n```\r\n[2017-05-01T09:35:47.466778] Filter rule evaluation begins; rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:177:30'\r\n[2017-05-01T09:35:47.466783] Filter node evaluation result; result='match', type='facility'\r\n[2017-05-01T09:35:47.466788] Filter node evaluation result; result='match', type='OR'\r\n[2017-05-01T09:35:47.466793] Filter rule evaluation result; result='match', rule='f_local5', location='/etc/syslog-ng/syslog-ng.conf:177:30'\r\n[2017-05-01T09:35:47.466830] Initializing destination file writer; template='/mnt/u001/syslog/$HOST/$YEAR$MONTH$DAY/network.log', filename='/mnt/u001/syslog/abc-wrt02.gts.xyz.com/20170501/network.log'\r\n[2017-05-01T09:35:47.466935] Filter rule evaluation begins; rule='f_notifier_filter', location='/etc/syslog-ng/syslog-ng.conf:196:30'\r\n[2017-05-01T09:35:47.466947] Filter node evaluation result; result='match'\r\n[2017-05-01T09:35:47.466953] Filter rule evaluation result; result='match', rule='f_notifier_filter', location='/etc/syslog-ng/syslog-ng.conf:196:30'\r\n[2017-05-01T09:35:47.466961] Filter rule evaluation begins; rule='f_notifier_filter', location='/etc/syslog-ng/syslog-ng.conf:196:30'\r\n[2017-05-01T09:35:47.466967] Filter node evaluation result; result='match'\r\n[2017-05-01T09:35:47.466973] Filter rule evaluation result; result='match', rule='f_notifier_filter', location='/etc/syslog-ng/syslog-ng.conf:196:30'\r\n<<snipped>>\r\n--\r\n[2017-05-01T09:35:47.470439] Outgoing message; message='May  1 09:35:31 abc-wrt02.gts.xyz.com UTC: %BGP_SESSION-5-ADJCHANGE: neighbor 172.19.254.11 IPv4 Unicast topology base removed from session  Admin. shutdown\r\n```\r\nBut the message is never forwarded.\r\n\r\nCould you help me understand why the regex is matching even though it should not.\r\n\r\n## Version of syslog-ng\r\n\r\n```\r\nsyslog-ng 3.9.1\r\nInstaller-Version: 3.9.1\r\nRevision:\r\nModule-Directory: //usr/lib64/syslog-ng\r\nModule-Path: //usr/lib64/syslog-ng\r\nAvailable-Modules: dbparser,affile,afuser,basicfuncs,pseudofile,afprog,afsocket,graphite,curl,cef,afstomp,afamqp,date,disk-buffer,add-contextual-data,csvparser,confgen,syslogformat,linux-kmsg-format,json-plugin,kvformat,system-source,cryptofuncs\r\nEnable-Debug: off\r\nEnable-GProf: off\r\nEnable-Memtrace: off\r\nEnable-IPv6: on\r\nEnable-Spoof-Source: off\r\nEnable-TCP-Wrapper: on\r\nEnable-Linux-Caps: on\r\n```\r\n\r\n## Platform\r\n```\r\n$ uname -a\r\nLinux log01.corp.xyz.com 2.6.32-504.8.1.el6.x86_64 #1 SMP Fri Dec 19 12:09:25 EST 2014 x86_64 x86_64 x86_64 GNU/Linux\r\n$ cat /etc/redhat-release\r\nRed Hat Enterprise Linux Server release 6.6 (Santiago)\r\n```\r\n"}}
{"actor":{"display_login":"soumyadipdm"}}