<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Having no luck in ignoring the following messages from
/var/adm/messages<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:35 testserver Corrupt label; wrong
magic number<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver scsi: [ID 107833
kern.warning] WARNING: /pci@7c0/pci@0/pci@9/SUNW,qlc@0/fp@0,0/ssd@w50060e8<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>005723700,0 (ssd3):<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver Corrupt label; wrong
magic number<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver scsi: [ID 107833
kern.warning] WARNING: /pci@7c0/pci@0/pci@9/SUNW,qlc@0/fp@0,0/ssd@w50060e8<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>005723700,0 (ssd3):<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver Corrupt label; wrong
magic number<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver scsi: [ID 107833
kern.warning] WARNING: /pci@7c0/pci@0/pci@8/SUNW,qlc@0/fp@0,0/ssd@w50060e8<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>005723710,1 (ssd0):<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver Corrupt label; wrong
magic number<o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='font-size:10.0pt;
font-family:"Courier New"'>Aug 27 10:43:36 testserver scsi: [ID 107833
kern.warning] WARNING: /pci@7c0/pci@0/pci@8/SUNW,qlc@0/fp@0,0/ssd@w50060e8<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>005723710,1
(ssd0):<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Have I tried the following:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>LOG
%/var/adm/messages kern "IGNORE=%(corrupt label|wrong magic
number)”<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>LOG
%/var/adm/messages %kern IGNORE=%(ID 107833|corrupt label|wrong magic number)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>LOG
%/var/adm/messages %kern IGNORE=%ID 107833|corrupt label|wrong magic number<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>LOG
%/var/adm/messages IGNORE=%(ID 107833|corrupt label|wrong magic number)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'>Any
suggestions?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Matthew Moldvan
[mailto:mmoldvan@csc.com] <br>
<b>Sent:</b> Thursday, August 26, 2010 11:06 AM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [xymon] ignore certain things in a log file<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'>I think (someone correct me if I'm wrong) you
might need the line to match to first, then what you'd like to ignore
afterward. Our ignore rules, which I believe work (notice the double
quotes, the ?i is case insensitive):</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>
LOG /var/adm/messages \</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>
%(?i)ERROR \</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>
"IGNORE=%(?i)(nres_gethostbyaddr|simple bind failed - Invalid
credentials|please upgrade FCSM|WARNING|NOTICE|fctl|FCSM|SRS
Proxy|xrx8825tlh2|ImportAcsError|AcsError|File \{.*\}, error 2|No such file or
directory|ViewMgr|Bad file format|Exec call for
FormTek|cache_trif_image|UserQry|DESKTOP_EDMOSRV.STARTUP|Error Level:
Informational|sshd.*Authentication failed
for|DESKTOP_EDMOSRV.STARTUP.*local0.error|httpd.*(modsecurity|password))"</span>
<br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Spaces are
okay. For any rules you'd like to test, you can use the pcretool command
(available on my CentOS box, maybe not in your environment). Syntax is as
follows:</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>-bash-3.2$
pcretest </span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>PCRE version
6.6 06-Feb-2006</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> re>
/(corrupt label|wrong magic number)/</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data>
corrupt</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>No match</span>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data>
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0:
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1:
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data> wrong
magic number</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0: wrong
magic number</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1: wrong
magic number</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Or for a case
insensitive match:</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>-bash-3.2$
pcretest </span><br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>PCRE version
6.6 06-Feb-2006</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> re>
/(?i)(corrupt label|wrong magic number)/</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data>
Corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0:
Corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1:
Corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data>
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0:
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1:
corrupt label</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data> asdf</span>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>No match</span>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data> WRONG
MAGIC NUMBER</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0: WRONG
MAGIC NUMBER</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1: WRONG
MAGIC NUMBER</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>data> wrong
magic number</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 0: wrong
magic number</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'> 1: wrong
magic number</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Good luck, hope
that helps,</span> <br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Matt.</span> <br>
<br>
<span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Unix System
Administrator<br>
Computer Science Corporation<br>
General Dynamics Land Systems<br>
<br>
This is a PRIVATE message. If you are not the intended recipient, please delete
without copying and kindly advise us by e-mail of the mistake in delivery. <br>
NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any
order or other contract unless pursuant to explicit written agreement or
government initiative expressly permitting the use of e-mail for such purpose.</span>
<br>
<br>
<o:p></o:p></p>
<table class=MsoNormalTable border=0 cellpadding=0 width="100%"
style='width:100.0%'>
<tr>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";
color:#5F5F5F'>From:</span> <o:p></o:p></p>
</td>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif"'>"Kevin
Kelly" <kkelly@lifetouch.com></span> <o:p></o:p></p>
</td>
</tr>
<tr>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";
color:#5F5F5F'>To:</span> <o:p></o:p></p>
</td>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif"'><xymon@xymon.com></span>
<o:p></o:p></p>
</td>
</tr>
<tr>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";
color:#5F5F5F'>Date:</span> <o:p></o:p></p>
</td>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif"'>08/26/2010
10:52 AM</span> <o:p></o:p></p>
</td>
</tr>
<tr>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";
color:#5F5F5F'>Subject:</span> <o:p></o:p></p>
</td>
<td valign=top style='padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif"'>[xymon]
ignore certain things in a log file</span><o:p></o:p></p>
</td>
</tr>
</table>
<p class=MsoNormal><o:p> </o:p></p>
<div class=MsoNormal align=center style='text-align:center'>
<hr size=2 width="100%" noshade style='color:#A0A0A0' align=center>
</div>
<p class=MsoNormal><br>
<br>
<br>
<span style='font-size:10.0pt;font-family:"Courier New"'>Could somebody tell me
why this won’t work?</span> <br>
<span style='font-size:10.0pt;font-family:"Courier New"'> </span> <br>
<span style='font-size:10.0pt;font-family:"Courier New"'>HOST=testserver</span>
<br>
<span style='font-size:10.0pt;font-family:"Courier New"'>
LOG %/var/adm/messages kern "IGNORE=%(corrupt
label|wrong magic number)"</span> <br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> </span>
<br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Trying to
ignore all lines in the messages file that contain those key words.</span> <br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> </span>
<br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Thanks</span>
<br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> </span>
<br>
<span style='font-size:10.0pt'>Kevin </span><br>
<span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> </span>
<o:p></o:p></p>
<p><br>
______________________________________________________________________<br>
This email has been scanned by the MessageLabs Email Security System.<br>
For more information please visit <a href="http://www.messagelabs.com/email">http://www.messagelabs.com/email</a>
<br>
_____________________________________________________________________<br>
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information. No one
else may read, print, store, copy, forward or act in reliance on it or its
attachments. If you are not the intended recipient, please return this message
to the sender and delete the message and any attachments from your computer.
Your cooperation is appreciated. <o:p></o:p></p>
</div>
<BR>
______________________________________________________________________<BR>
This email has been scanned by the MessageLabs Email Security System.<BR>
For more information please visit http://www.messagelabs.com/email <BR>
_____________________________________________________________________<BR>
</body>
</html>