<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 10">
<meta name=Originator content="Microsoft Word 10">
<link rel=File-List href="cid:filelist.xml@01CA3C22.C79C14D0">
<!--[if gte mso 9]><xml>
<o:OfficeDocumentSettings>
<o:DoNotRelyOnCSS/>
</o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:WordDocument>
<w:SpellingState>Clean</w:SpellingState>
<w:GrammarState>Clean</w:GrammarState>
<w:DocumentKind>DocumentEmail</w:DocumentKind>
<w:EnvelopeVis/>
<w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
</w:WordDocument>
</xml><![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;
mso-font-charset:0;
mso-generic-font-family:swiss;
mso-font-pitch:variable;
mso-font-signature:1627421319 -2147483648 8 0 66047 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;
text-underline:single;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
span.EmailStyle18
{mso-style-type:personal-reply;
mso-style-noshow:yes;
mso-ansi-font-size:10.0pt;
mso-bidi-font-size:10.0pt;
font-family:Arial;
mso-ascii-font-family:Arial;
mso-hansi-font-family:Arial;
mso-bidi-font-family:Arial;
color:navy;}
span.SpellE
{mso-style-name:"";
mso-spl-e:yes;}
span.GramE
{mso-style-name:"";
mso-gram-e:yes;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman";}
</style>
<![endif]-->
</head>
<body lang=EN-US link=blue vlink=blue style='tab-interval:.5in'>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Sorry I was off yesterday…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Here it <span class=GramE>goes,</span> I
tested first for string “session opened for user root” and here is
how the log entry looks like in the hobbit-<span class=SpellE>clients.cfg</span>
for one of client servers<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>LOG /<span class=SpellE>var</span>/log/messages
%failure*|failed*|error*|Warning*|</span></font><font size=2 color=red
face=Arial><span style='font-size:10.0pt;font-family:Arial;color:red'>session\s+opened\s+for\s+user\s+root*</span></font><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>|Out\s+of\s+Memory* COLOR=red GROUP=admin<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thanks,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Camelia <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Josh Luthman
[mailto:josh@imaginenetworksllc.com] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, September 21, 2009
4:08 PM<br>
<b><span style='font-weight:bold'>To:</span></b> hobbit@hswn.dk<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [hobbit] how to
search for exact word patterns</span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:
12.0pt;margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Could you post your working config, please?<br>
<br clear=all>
Josh Luthman<br>
Office: 937-552-2340<br>
Direct: 937-552-2343<br>
1100 Wayne St<br>
Suite 1337<br>
Troy, OH 45373<br>
<br>
"When you have eliminated the impossible, that which remains, however
improbable, must be the truth."<br>
--- Sir Arthur Conan Doyle<br style='mso-special-character:line-break'>
<![if !supportLineBreakNewLine]><br style='mso-special-character:line-break'>
<![endif]><o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>On Mon, Sep 21, 2009 at 3:00 PM, Camelia Anghel <<a
href="mailto:canghel@cjh.org">canghel@cjh.org</a>> wrote:<o:p></o:p></span></font></p>
<div link=blue vlink=blue>
<div>
<p style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Greg,</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>That worked!!!</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Thanks a lot!</span></font><o:p></o:p></p>
<p style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Camelia </span></font><o:p></o:p></p>
<div>
<p style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Greg Hubbard [mailto:<a
href="mailto:glh.forums@gmail.com" target="_blank">glh.forums@gmail.com</a>] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, September 18, 2009
3:09 PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a href="mailto:hobbit@hswn.dk"
target="_blank">hobbit@hswn.dk</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [hobbit] how to
search for exact word patterns</span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Yes -- you only need one % at the beginning of your
string to tell Xymon you are going to use a regular expression. You do
not need the other % unless they are expected to appear in the log.<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>When using a regular expression, the | character means
"or". So if your example will "fire" if any message
contains and of those words. Also you seem to be using * by itself, which
means "match the preceding 0 or more times". Normally we use
"dot star" ".*" to mean "match anything no matter how
long."<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Regular expressions are a bit of a mystery, but are
very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so
you might be able to Google some examples.<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>If you are searching for "Out of memory" in
a log file, you can use "%Out of memory" as your regex string.
I do not remember how you deal with spaces in the string and the Xymon help is
not helpful. One way to do it would be to change your spaces into \s+ so
it would be %Out\s+of\s+memory which removes the embedded spaces (so the
Xymon parser does not think part of your regex is some other token on the
commend) and also means that you will match of the is at least one whitespace
character between each word -- slightly more robust than using a single space.<br>
<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>I know the above is a jumble, but if you will post the
exact string you want to match we can help you create the matching expression
to help you get the hang of it.<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>GLH<br>
<o:p></o:p></span></font></p>
</div>
</div>
<div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>On 9/18/09, <b><span style='font-weight:bold'>Camelia
Anghel</span></b> <<a href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>>
wrote: <o:p></o:p></span></font></p>
</div>
<div vlink=blue link=blue>
<div>
<div>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Right now looks like
this:</span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>LOG /var/log/messages
%failure*|%failed*|%error*|%Warning*|%memory* Color=Red</span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>But if I type </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>LOG /var/log/messages %failure*|%failed*|%error*|%Warning*|%out
of memory* Color=Red</span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>I’m getting all the
messages that have one of these words: out or of or memory somewhere in their
string.</span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<p style='margin-left:1.0in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Camelia </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Greg Hubbard [mailto:<a
href="mailto:glh.forums@gmail.com" target="_blank">glh.forums@gmail.com</a>] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, September 18, 2009
1:25 PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a href="mailto:hobbit@hswn.dk"
target="_blank">hobbit@hswn.dk</a><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><b><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re:
[hobbit] how to search for exact word patterns<o:p></o:p></span></font></p>
</div>
<div>
<p style='margin-left:1.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;
margin-left:1.5in'><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Try making it a regex (with % prefix) instead of "simple"
expression.<o:p></o:p></span></font></p>
</div>
<div>
<div>
<p style='margin-left:1.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>On 9/18/09, <b><span style='font-weight:bold'>Camelia
Anghel</span></b> <<a href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>>
wrote: <o:p></o:p></span></font></p>
</div>
<div vlink=blue link=blue>
<div>
<div>
<p style='margin-left:1.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Did that but it look for
all messages that have one of the 3 words</span></font><o:p></o:p></p>
<p style='margin-left:1.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Thanks anyway</span></font><o:p></o:p></p>
<p style='margin-left:1.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Camelia </span></font><o:p></o:p></p>
</div>
<div>
<p style='margin-left:1.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'> </span></font><o:p></o:p></p>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Josh Luthman [mailto:<a
href="mailto:josh@imaginenetworksllc.com" target="_blank">josh@imaginenetworksllc.com</a>]
<br>
<b><span style='font-weight:bold'>Sent:</span></b> Friday, September 18, 2009
11:22 AM<br>
<b><span style='font-weight:bold'>To:</span></b> <a href="mailto:hobbit@hswn.dk"
target="_blank">hobbit@hswn.dk</a><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><b><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re:
[hobbit] how to search for exact word patterns<o:p></o:p></span></font></p>
</div>
<p style='margin-left:2.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>I think it's:<br>
<br>
HOST=<a href="http://my.host.com/" target="_blank">my.host.com</a><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> LOG /var/log/messages "out of
memory" COLOR=red<br>
<br>
Not tested.<br>
<br clear=all>
Josh Luthman<br>
Office: 937-552-2340<br>
Direct: 937-552-2343<br>
1100 Wayne St<br>
Suite 1337<br>
Troy, OH 45373<br>
<br>
"When you have eliminated the impossible, that which remains, however
improbable, must be the truth."<br>
--- Sir Arthur Conan Doyle<o:p></o:p></span></font></p>
</div>
<div>
<div>
<p style='margin-left:2.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <<a
href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>> wrote:<o:p></o:p></span></font></p>
<p style='mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:12.0pt;
margin-left:2.0in'><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><br>
Hello all,<br>
I am trying to set up an alert to search for exact word patterns in<br>
/var/log/messages. For example: "Out of Memory"<br>
<br>
Any help would be appreciated.<br>
<br>
Thanks,<br>
Camelia<br>
<br>
To unsubscribe from the hobbit list, send an e-mail to<br>
<a href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank">hobbit-unsubscribe@hswn.dk</a><o:p></o:p></span></font></p>
</div>
<p style='margin-left:2.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
</div>
</div>
</div>
</div>
<p style='margin-left:1.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'><br>
<br clear=all>
<br>
-- <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>Disclaimer: 1) all opinions are my own, 2)
I may be completely wrong, 3) my advice is worth at least as much as what you
are paying for it, or your money cheerfully refunded. <o:p></o:p></span></font></p>
</div>
</div>
</div>
</div>
</div>
<div>
<p style='margin-left:1.0in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'><br>
<br clear=all>
<br>
-- <br>
Disclaimer: 1) all opinions are my own, 2) I may be completely
wrong, 3) my advice is worth at least as much as what you are paying for it, or
your money cheerfully refunded. <o:p></o:p></span></font></p>
</div>
</div>
</div>
</div>
<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
</div>
</body>
</html>