<font size=2 face="sans-serif">I think (someone correct me if I'm wrong)
you might need the line to match to first, then what you'd like to ignore
afterward. Our ignore rules, which I believe work (notice the double
quotes, the ?i is case insensitive):</font>
<br>
<br><font size=2 face="sans-serif"> LOG /var/adm/messages
\</font>
<br><font size=2 face="sans-serif">
%(?i)ERROR \</font>
<br><font size=2 face="sans-serif">
"IGNORE=%(?i)(nres_gethostbyaddr|simple bind failed
- Invalid credentials|please upgrade FCSM|WARNING|NOTICE|fctl|FCSM|SRS
Proxy|xrx8825tlh2|ImportAcsError|AcsError|File \{.*\}, error 2|No such
file or directory|ViewMgr|Bad file format|Exec call for FormTek|cache_trif_image|UserQry|DESKTOP_EDMOSRV.STARTUP|Error
Level: Informational|sshd.*Authentication failed for|DESKTOP_EDMOSRV.STARTUP.*local0.error|httpd.*(modsecurity|password))"</font>
<br>
<br><font size=2 face="sans-serif">Spaces are okay. For any rules
you'd like to test, you can use the pcretool command (available on my CentOS
box, maybe not in your environment). Syntax is as follows:</font>
<br>
<br><font size=2 face="sans-serif">-bash-3.2$ pcretest </font>
<br><font size=2 face="sans-serif">PCRE version 6.6 06-Feb-2006</font>
<br>
<br><font size=2 face="sans-serif"> re> /(corrupt label|wrong
magic number)/</font>
<br><font size=2 face="sans-serif">data> corrupt</font>
<br><font size=2 face="sans-serif">No match</font>
<br><font size=2 face="sans-serif">data> corrupt label</font>
<br><font size=2 face="sans-serif"> 0: corrupt label</font>
<br><font size=2 face="sans-serif"> 1: corrupt label</font>
<br><font size=2 face="sans-serif">data> wrong magic number</font>
<br><font size=2 face="sans-serif"> 0: wrong magic number</font>
<br><font size=2 face="sans-serif"> 1: wrong magic number</font>
<br>
<br><font size=2 face="sans-serif">Or for a case insensitive match:</font>
<br>
<br><font size=2 face="sans-serif">-bash-3.2$ pcretest </font>
<br><font size=2 face="sans-serif">PCRE version 6.6 06-Feb-2006</font>
<br>
<br><font size=2 face="sans-serif"> re> /(?i)(corrupt label|wrong
magic number)/</font>
<br><font size=2 face="sans-serif">data> Corrupt label</font>
<br><font size=2 face="sans-serif"> 0: Corrupt label</font>
<br><font size=2 face="sans-serif"> 1: Corrupt label</font>
<br><font size=2 face="sans-serif">data> corrupt label</font>
<br><font size=2 face="sans-serif"> 0: corrupt label</font>
<br><font size=2 face="sans-serif"> 1: corrupt label</font>
<br><font size=2 face="sans-serif">data> asdf</font>
<br><font size=2 face="sans-serif">No match</font>
<br><font size=2 face="sans-serif">data> WRONG MAGIC NUMBER</font>
<br><font size=2 face="sans-serif"> 0: WRONG MAGIC NUMBER</font>
<br><font size=2 face="sans-serif"> 1: WRONG MAGIC NUMBER</font>
<br><font size=2 face="sans-serif">data> wrong magic number</font>
<br><font size=2 face="sans-serif"> 0: wrong magic number</font>
<br><font size=2 face="sans-serif"> 1: wrong magic number</font>
<br>
<br><font size=2 face="sans-serif">Good luck, hope that helps,</font>
<br><font size=2 face="sans-serif">Matt.</font>
<br>
<br><font size=2 face="sans-serif">Unix System Administrator<br>
Computer Science Corporation<br>
General Dynamics Land Systems<br>
<br>
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. <br>
NOTE: Regardless of content, this e-mail shall not operate to bind CSC
to any order or other contract unless pursuant to explicit written agreement
or government initiative expressly permitting the use of e-mail for such
purpose.</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">From:</font>
<td><font size=1 face="sans-serif">"Kevin Kelly" <kkelly@lifetouch.com></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">To:</font>
<td><font size=1 face="sans-serif"><xymon@xymon.com></font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Date:</font>
<td><font size=1 face="sans-serif">08/26/2010 10:52 AM</font>
<tr valign=top>
<td><font size=1 color=#5f5f5f face="sans-serif">Subject:</font>
<td><font size=1 face="sans-serif">[xymon] ignore certain things in a log
file</font></table>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 face="Courier New">Could somebody tell me why this won’t
work?</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">HOST=testserver</font>
<br><font size=2 face="Courier New"> LOG
%/var/adm/messages kern "IGNORE=%(corrupt label|wrong magic
number)"</font>
<br><font size=2 face="Calibri"> </font>
<br><font size=2 face="Calibri">Trying to ignore all lines in the messages
file that contain those key words.</font>
<br><font size=2 face="Calibri"> </font>
<br><font size=2 face="Calibri">Thanks</font>
<br><font size=2 face="Calibri"> </font>
<br><font size=2 face="Times New Roman">Kevin </font>
<br><font size=2 face="Calibri"> </font>
<p><font size=3><br>
______________________________________________________________________<br>
This email has been scanned by the MessageLabs Email Security System.<br>
For more information please visit </font><a href=http://www.messagelabs.com/email><font size=3>http://www.messagelabs.com/email</font></a><font size=3>
<br>
_____________________________________________________________________<br>
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information.
No one else may read, print, store, copy, forward or act in reliance on
it or its attachments. If you are not the intended recipient, please return
this message to the sender and delete the message and any attachments from
your computer. Your cooperation is appreciated. </font>
<p>
<p>