<br><font size=2 face="sans-serif">Hi</font><br><br><font size=2 face="sans-serif">I have some problems filtering entries
from the msg test. I have several hosts, running SuSE which often produce
the following messages in /var/log/messages:</font><br><br><font size=2 face="sans-serif">Jan 7 08:09:22 s068c320 ntpd[4944]:
kernel time sync error 0001</font><br><br><font size=2 face="sans-serif">The hosts are named s068c320, s068c321,
s068c322, ...</font><br><br><font size=2 face="sans-serif">So I made the following entries in the
hobbit-clients.cfg on the Hobbitserver, to filter out these messages:</font><br><br><font size=2 face="sans-serif">HOST=%s068c32*</font><br><font size=2 face="sans-serif"> LOG
%.* %(fatal|error) COLOR=red IGNORE=ntpd</font><br><br><font size=2 face="sans-serif">It does not work. The messages come
up as an error anyway.</font><br><font size=2 face="sans-serif">Here is my whole hobbit-clients.cfg</font><br><br><br><br><font size=2 face="sans-serif">HOST=s068310i</font><br><font size=2 face="sans-serif"> DISK
%^/platform.* IGNORE</font><br><br><font size=2 face="sans-serif">HOST=s068310b</font><br><font size=2 face="sans-serif"> DISK
%^/platform.* IGNORE</font><br><br><font size=2 face="sans-serif">HOST=s068a300</font><br><font size=2 face="sans-serif"> LOG
%.* %(fatal|error) COLOR=red IGNORE=%(smb_proc_readdir_long|peer)</font><br><font size=2 face="sans-serif"> LOG
%.* warning COLOR=yellow</font><br><font size=2 face="sans-serif"># DISK
* 10 15</font><br><br><font size=2 face="sans-serif">HOST=s068c327</font><br><font size=2 face="sans-serif"> DISK
/mnt IGNORE</font><br><br><font size=2 face="sans-serif">HOST=%s068c32*</font><br><font size=2 face="sans-serif"> LOG
%.* %(fatal|error) COLOR=red IGNORE=ntpd</font><br><br><font size=2 face="sans-serif">HOST=s068c320,s068c321,s068c322</font><br><font size=2 face="sans-serif"> PROC
"lmgrd -c" 1 1</font><br><font size=2 face="sans-serif"> PROC
"pam_lmd" 1 1</font><br><br><font size=2 face="sans-serif">DEFAULT</font><br><font size=2 face="sans-serif"> # These
are the built-in defaults.</font><br><font size=2 face="sans-serif"> UP
1h</font><br><font size=2 face="sans-serif"> LOAD
5.0 10.0</font><br><font size=2 face="sans-serif"> DISK
* 90 95</font><br><font size=2 face="sans-serif"> DISK
/media/cdrom 101 101</font><br><font size=2 face="sans-serif"> MEMPHYS
100 101</font><br><font size=2 face="sans-serif"> MEMSWAP
50 80</font><br><font size=2 face="sans-serif"> MEMACT 90
97</font><br><br><font size=2 face="sans-serif"> LOG
%.* %(fatal|error) COLOR=red IGNORE=%(read_socket_data|peer)</font><br><font size=2 face="sans-serif"> LOG
%.* warning COLOR=yellow</font><br><br><font size=2 face="sans-serif">What's wrong there?</font><br><font size=2 face="sans-serif">BTW: the smb_proc_readdir_log filter
also does not work.</font><br><br><font size=2 face="sans-serif">Thank you</font><br><font size=2 face="sans-serif">Thorsten Erdmann<br></font><font face="sans-serif"><font face="sans-serif, Arial, Helvetica" size="-1" color="#808080"><br>If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation.
<br></br>
</font></font>