PDBTOOL(1)

NAME
pdbtool - An application to test and convert syslog-ng pattern database rules

SYNOPSIS
pdbtool <command> [options..]

DESCRIPTION

The pdbtool program can be used to test message patterns, convert an old pattern database to the latest format, to merge pattern databases into a single file, or to dump the RADIX tree to explore how the pattern matching works.

COMMANDS

  match
Match a pattern against the pattern database.
    Options

        -p, --pdb=<patterndb_file>
            Name of the patterndb file

        -P, --program=<program>
            Program name to match as $PROGRAM

        -M, --message=<message>
            Message to match as $MSG

        -D, --debug-pattern
            Print debuging information on pattern matching

        -C, --debug-csv
            Output debuging information in parseable format

        -c, --color-out
            Color terminal output

        -T, --template=template
            Template string to be used to format the output

        -f, --file
            Read the messages from the file specified

        -F, --filter=expr
            Only print messages matching the specified syslog-ng filter

  merge
Merge pattern databases.
    Options

        -p, --pdb=<patterndb_file>
            Name of the patterndb output file

        -r, --recursive
            Recurse into subdirectories

        -G, --glob=<pattern>
            Filenames to consider for merging

        -D, --directory=<directory>
            Directory from merge pattern databases

  test
Test pattern databases.
    Options

        --validate
            Validate the pdb file against the xsd (requires xmllint from libxml2)

        -r, --rule-id
            Rule ID of the patterndb rule to be tested against its example

        -D, --debug
            Print debuging information on non-matching patterns

        -c, --color-out
            Color terminal output

  patternize
Create a pattern database from log samples.
    Options

        -f, --file=<path>
            Logfile to create pattern database from, use '-' for stdin

        -p, --no-parse
            Do try to parse the input file, consider the whole lines as the message part of the log

        -S, --support=<support>
            Percentage of lines that have to support a pattern (default: 4.0)

        -o, --iterate-outliers
            Recursively iterate on the log lines that do not make it into a cluster in the previous step

        -n, --named-parsers
            Give the parsers a name in the patterns, eg.: .dict.string1, .dict.string2... (default: no)

        -d, --delimiters=<delimiters>
            Set of characters based on which the log messages are tokenized, defaults to :&~?![]=,;()'"

        --samples=<samples>
            Number of example lines to add for the patterns (default: 1)

  dump
Dump (parts of) a pattern database tree.
    Options

        -P, --program=<program>
            Program name ($PROGRAM) to dump

        -T, --program-tree
            Dump the program ($PROGRAM) tree

SEE ALSO
For the full documentation of syslog-ng, see The syslog-ng Administrator Guide, available from

    http://www.balabit.com/support/documentation/

AUTHOR

This manual page was written by Gergely Nagy <algernon@madhouse-project.org>.

COPYRIGHT

Copyright © 2011 Gergely Nagy <algernon@madhouse-project.org>. Published under the GNU General Public License version 3, or at your opinion, any later version as published by the FSF.