Match TCP::payload to Newline

This is using TCP via syslog-ng.

 

 

I am not able to get inside of the If statement with either \x0D\x0A or \x0d\x0a. I also tried via this method of converting the payload to hex which didn't work either:

 

 

when CLIENT_DATA {

 

log local0. "In Client Data: [TCP::payload]"

 

binary scan [TCP::payload] H* payload_hex

 

log local0. "In Binary Data: $payload_hex"

 

Also tried to match payload_hex to "\x0d\x0a"

 

if { $payload_hex contains "0d0a" } {

 

log local0. "XXXXXInside of IF"

 

LB::detach

 

TCP::release

 

TCP::collect

 

}

 

}

 

 

Not sure how to convert \x0d\x0a to binary, but the reverse did not work so I assume this would not either.

 

 

Any other ideas? Do you think this is a bug or a irule logic issue?

 

 

-Dan