<div>Yes -- you only need one % at the beginning of your string to tell Xymon you are going to use a regular expression. You do not need the other % unless they are expected to appear in the log.</div>
<div> </div>
<div>When using a regular expression, the | character means "or". So if your example will "fire" if any message contains and of those words. Also you seem to be using * by itself, which means "match the preceding 0 or more times". Normally we use "dot star" ".*" to mean "match anything no matter how long."</div>
<div> </div>
<div>Regular expressions are a bit of a mystery, but are very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so you might be able to Google some examples.</div>
<div> </div>
<div>If you are searching for "Out of memory" in a log file, you can use "%Out of memory" as your regex string. I do not remember how you deal with spaces in the string and the Xymon help is not helpful. One way to do it would be to change your spaces into \s+ so it would be %Out\s+of\s+memory which removes the embedded spaces (so the Xymon parser does not think part of your regex is some other token on the commend) and also means that you will match of the is at least one whitespace character between each word -- slightly more robust than using a single space.<br>
</div>
<div>I know the above is a jumble, but if you will post the exact string you want to match we can help you create the matching expression to help you get the hang of it.</div>
<div> </div>
<div>GLH<br> </div>
<div><span class="gmail_quote">On 9/18/09, <b class="gmail_sendername">Camelia Anghel</b> <<a href="mailto:canghel@cjh.org">canghel@cjh.org</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div lang="EN-US" vlink="blue" link="blue">
<div>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Right now looks like this:</span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LOG /<span>var</span>/log/messages %failure*|%failed*|%error*|%Warning*|%memory<span>* <span> </span>Color</span>=Red</span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">But if I type </span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">LOG /<span>var</span>/log/messages %failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red</span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">I’m getting all the messages that have one of these words: out or of or memory somewhere in their string.</span></font></p>
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p><span class="sg">
<p><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Camelia </span></font></p></span>
<div><span class="e" id="q_123ce6550ae7253a_2">
<p style="MARGIN-LEFT: 0.5in"><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">-----Original Message-----<br><b><span style="FONT-WEIGHT: bold">From:</span></b> Greg Hubbard [mailto:<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:glh.forums@gmail.com" target="_blank">glh.forums@gmail.com</a><span>] <br>
<b><span style="FONT-WEIGHT: bold">Sent</span></b></span><b><span style="FONT-WEIGHT: bold">:</span></b> </span></font><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">Friday, September 18, 2009</span></font><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma"> </span></font><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">1:25 PM</span></font><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma"><br>
<b><span style="FONT-WEIGHT: bold">To:</span></b> <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a><br><b><span style="FONT-WEIGHT: bold">Subject:</span></b> Re: [hobbit] how to search for exact word patterns</span></font></p>
<p style="MARGIN-LEFT: 0.5in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt"> </span></font></p>
<p style="MARGIN-BOTTOM: 12pt; MARGIN-LEFT: 0.5in; MARGIN-RIGHT: 0in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt">Try making it a regex (with % prefix) instead of "simple" expression.</span></font></p>
<div>
<p style="MARGIN-LEFT: 0.5in"><span><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt">On 9/18/09, <b><span style="FONT-WEIGHT: bold">Camelia Anghel</span></b> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>> wrote:</span></font></span> </p>
<div vlink="blue" link="blue">
<div>
<p style="MARGIN-LEFT: 0.5in"><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Did that but it look for all messages that have one of the 3 words</span></font></p>
<p style="MARGIN-LEFT: 0.5in"><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Thanks anyway</span></font></p>
<p style="MARGIN-LEFT: 0.5in"><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Camelia </span></font></p>
<div><span>
<p style="MARGIN-LEFT: 0.5in"><font face="Arial" color="navy" size="2"><span style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"> </span></font></p>
<p style="MARGIN-LEFT: 1in"><font face="Tahoma" size="2"><span style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">-----Original Message-----<br><b><span style="FONT-WEIGHT: bold">From:</span></b> Josh Luthman [mailto:<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:josh@imaginenetworksllc.com" target="_blank">josh@imaginenetworksllc.com</a>] <br>
<b><span style="FONT-WEIGHT: bold">Sent:</span></b> Friday, September 18, 2009 11:22 AM<br><b><span style="FONT-WEIGHT: bold">To:</span></b> <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a><br>
<b><span style="FONT-WEIGHT: bold">Subject:</span></b> Re: [hobbit] how to search for exact word patterns</span></font></p>
<p style="MARGIN-LEFT: 1in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt"> </span></font></p>
<p style="MARGIN-BOTTOM: 12pt; MARGIN-LEFT: 1in; MARGIN-RIGHT: 0in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt">I think it's:<br><br>HOST=<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://my.host.com/" target="_blank">my.host.com</a><br>
LOG /var/log/messages "out of memory" COLOR=red<br><br>Not tested.<br><br clear="all">Josh Luthman<br>Office: 937-552-2340<br>Direct: 937-552-2343<br>1100 Wayne St<br>Suite 1337<br>Troy, OH 45373<br><br>"When you have eliminated the impossible, that which remains, however improbable, must be the truth."<br>
--- Sir Arthur Conan Doyle</span></font></p>
<div>
<p style="MARGIN-LEFT: 1in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt">On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>> wrote:</span></font></p>
<p style="MARGIN-BOTTOM: 12pt; MARGIN-LEFT: 1in; MARGIN-RIGHT: 0in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt"><br>Hello all,<br>I am trying to set up an alert to search for exact word patterns in<br>
/var/log/messages. For example: "Out of Memory"<br><br>Any help would be appreciated.<br><br>Thanks,<br>Camelia<br><br>To unsubscribe from the hobbit list, send an e-mail to<br><a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank">hobbit-unsubscribe@hswn.dk</a></span></font></p>
</div>
<p style="MARGIN-LEFT: 1in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt"> </span></font></p></span></div></div></div></div>
<p style="MARGIN-LEFT: 0.5in"><font face="Times New Roman" size="3"><span style="FONT-SIZE: 12pt"><br><br clear="all"><br>-- <br>Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded. </span></font></p>
</span></div></div></div></blockquote></div><br><br clear="all"><br>-- <br>Disclaimer: 1) all opinions are my own, 2) I may be completely wrong, 3) my advice is worth at least as much as what you are paying for it, or your money cheerfully refunded.