[hobbit] how to search for exact word patterns

[Camelia Anghel]

Right now looks like this:
 
LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%memory*
Color=Red
 
But if I type 
LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out of
memory* Color=Red
 
I'm getting all the messages that have one of these words: out or of or
memory somewhere in their string.
 
Camelia 
-----Original Message-----
From: Greg Hubbard [mailto:glh.forums at gmail.com] 
Sent: Friday, September 18, 2009 1:25 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] how to search for exact word patterns
 
Try making it a regex (with % prefix) instead of "simple" expression.
On 9/18/09, Camelia Anghel <canghel at cjh.org> wrote: 
Did that but it look for all messages that have one of the 3 words
Thanks anyway
Camelia 
 
-----Original Message-----
From: Josh Luthman [mailto:josh at imaginenetworksllc.com] 
Sent: Friday, September 18, 2009 11:22 AM
To: hobbit at hswn.dk
Subject: Re: [hobbit] how to search for exact word patterns
 
I think it's:

HOST=my.host.com <http://my.host.com/> 
    LOG /var/log/messages "out of memory" COLOR=red

Not tested.

Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

"When you have eliminated the impossible, that which remains, however
improbable, must be the truth."
--- Sir Arthur Conan Doyle
On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <canghel at cjh.org> wrote:

Hello all,
I am trying to set up an alert to search for exact word patterns in
/var/log/messages.  For example: "Out of Memory"

Any help would be appreciated.

Thanks,
Camelia

To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk
 



-- 
Disclaimer:  1) all opinions are my own, 2) I may be completely wrong,
3) my advice is worth at least as much as what you are paying for it, or
your money cheerfully refunded. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20090918/be052378/attachment.html>