<br><font size=2 face="sans-serif">Oops, did I actually say that? Forgot
the ^ is beggining of the line ... must have been a long day. :P</font>
<br>
<br><font size=2 face="sans-serif">Matt.</font>
<br>
<br><font size=2 face="sans-serif">Unix System Administrator<br>
Computer Science Corporation<br>
General Dynamics Land Systems<br>
38500 Mound Rd.<br>
Sterling Heights, MI. 48310<br>
Desk: (586) 825-8294<br>
Oracle IM: moldvanm<br>
<br>
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. <br>
NOTE: Regardless of content, this e-mail shall not operate to bind CSC
to any order or other contract unless pursuant to explicit written agreement
or government initiative expressly permitting the use of e-mail for such
purpose.</font>
<br>
<br>
<br>
<table width=100%>
<tr>
<td><img src=cid:_1_07903BF40790380C00577A00852576A5>
<td width=100%>
<table width=100%>
<tr valign=top>
<td width=100%><font size=2 face="sans-serif"><b>Re: [hobbit] Problems
with MSG filter</b></font></table>
<br>
<table width=100%>
<tr>
<td><font size=2 color=#e26200 face="sans-serif"><b>Matthew Moldvan </b></font>
<td><font size=2 color=#8f8f8f face="sans-serif">to:</font>
<td><font size=2 face="sans-serif">hobbit</font>
<td>
<div align=right><font size=1 face="sans-serif">01/07/2010 04:52 PM</font></div></table>
<br>
<table width=100%>
<tr>
<td><font size=1 face="sans-serif"><b>Please respond to hobbit</b></font>
<td>
<div align=right></div></table>
<br></table>
<br>
<br>
<hr>
<br>
<br>
<br><font size=2 face="sans-serif"><br>
A quick thought: the disk regular expressions start with "%^",
whereas your HOST and LOG portions are missing the caret (^). That
might be a first step...</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
Hope that helps,</font><font size=3> </font><font size=2 face="sans-serif"><br>
Matt.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
Unix System Administrator<br>
Computer Science Corporation<br>
General Dynamics Land Systems<br>
38500 Mound Rd.<br>
Sterling Heights, MI. 48310<br>
Desk: (586) 825-8294<br>
Oracle IM: moldvanm<br>
<br>
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. <br>
NOTE: Regardless of content, this e-mail shall not operate to bind CSC
to any order or other contract unless pursuant to explicit written agreement
or government initiative expressly permitting the use of e-mail for such
purpose.</font><font size=3> <br>
<br>
</font>
<table width=100%>
<tr>
<td width=10%>
<td width=89%>
<table width=100%>
<tr valign=top>
<td width=100%><font size=2 face="sans-serif"><b>[hobbit] Problems with
MSG filter</b></font></table>
<br>
<br>
<table width=100%>
<tr>
<td width=41%><font size=2 color=#e26200 face="sans-serif"><b>thorsten.erdmann
</b></font>
<td width=6%><font size=2 color=#8f8f8f face="sans-serif">to:</font><font size=3>
</font>
<td width=14%><font size=2 face="sans-serif">hobbit</font><font size=3>
</font>
<td width=36%>
<div align=right><font size=1 face="sans-serif">01/07/2010 02:26 AM</font></div></table>
<br>
<br>
<table width=100%>
<tr>
<td width=95%><font size=1 face="sans-serif"><b>Please respond to hobbit</b></font><font size=3>
</font>
<td width=4%></table>
<br></table>
<br><font size=3><br>
<br>
</font>
<hr><font size=3><br>
<br>
</font><font size=2 face="sans-serif"><br>
<br>
Hi<br>
<br>
I have some problems filtering entries from the msg test. I have several
hosts, running SuSE which often produce the following messages in /var/log/messages:<br>
<br>
Jan 7 08:09:22 s068c320 ntpd[4944]: kernel time sync error 0001<br>
<br>
The hosts are named s068c320, s068c321, s068c322, ...<br>
<br>
So I made the following entries in the hobbit-clients.cfg on the Hobbitserver,
to filter out these messages:<br>
<br>
HOST=%s068c32*<br>
LOG %.* %(fatal|error) COLOR=red
IGNORE=ntpd<br>
<br>
It does not work. The messages come up as an error anyway.<br>
Here is my whole hobbit-clients.cfg</font><font size=3><br>
<br>
</font><font size=2 face="sans-serif"><br>
<br>
HOST=s068310i<br>
DISK %^/platform.* IGNORE<br>
<br>
HOST=s068310b<br>
DISK %^/platform.* IGNORE<br>
<br>
HOST=s068a300<br>
LOG %.* %(fatal|error) COLOR=red
IGNORE=%(smb_proc_readdir_long|peer)<br>
LOG %.* warning
COLOR=yellow<br>
# DISK * 10 15<br>
<br>
HOST=s068c327<br>
DISK /mnt
IGNORE<br>
<br>
HOST=%s068c32*<br>
LOG %.* %(fatal|error) COLOR=red
IGNORE=ntpd<br>
<br>
HOST=s068c320,s068c321,s068c322<br>
PROC "lmgrd -c" 1 1<br>
PROC "pam_lmd" 1 1<br>
<br>
DEFAULT<br>
# These are the built-in defaults.<br>
UP 1h<br>
LOAD 5.0 10.0<br>
DISK * 90 95<br>
DISK /media/cdrom 101 101<br>
MEMPHYS 100 101<br>
MEMSWAP 50 80<br>
MEMACT 90 97<br>
<br>
LOG %.* %(fatal|error) COLOR=red
IGNORE=%(read_socket_data|peer)<br>
LOG %.* warning
COLOR=yellow<br>
<br>
What's wrong there?<br>
BTW: the smb_proc_readdir_log filter also does not work.<br>
<br>
Thank you<br>
Thorsten Erdmann</font><font size=2 color=#808080 face="sans-serif"><br>
<br>
If you are not the intended addressee, please inform us immediately that
you have received this e-mail in error, and delete it. We thank you for
your cooperation. </font><font size=3><br>
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information.
No one else may read, print, store, copy, forward or act in reliance on
it or its attachments. If you are not the intended recipient, please return
this message to the sender and delete the message and any attachments from
your computer. Your cooperation is appreciated. <br>
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information.
No one else may read, print, store, copy, forward or act in reliance on
it or its attachments. If you are not the intended recipient, please return
this message to the sender and delete the message and any attachments from
your computer. Your cooperation is appreciated. </font>
<br>