[hobbit] alert rules

[Henrik Stoerner]

On Thu, May 05, 2005 at 11:12:07AM -0400, Sue Bauer-Lee wrote:
> My epxressions here must be really confusing:
> 
> $WINOPS=winops at xyz.com
> 
> # CCRT Windows
> HOST="%(cctfep3*|cctapp3*|cctfep1[0-9]||cctfep0*|cctapp[0-9]|cctpdp0*|cctdbp0*)" SERVICE=conn
> (164)     MAIL $WINOPS  REPEAT=10 RECOVERED
> 
> (172) HOST="%(tucwbs1*|ttucfes1*|tucaps1*|tucwbq1*|tucfeq1*|tucapq1*)" SERVICE=conn
>       MAIL $UNIXOPS REPEAT=10 RECOVERED

I think you've been bitten by a common pitfall in converting shell
"globbing" strings into regexp's: If you want to match "anything",
you must use '.*' in a regexp, not just '*' - because "*" just means
"0 or more occurrences of the token to the left of the *".

E.g. "abc*" means "ab followed by c or more c's", and is matched by "ab", 
"abc", "abcc", "abccc", "abccccc" ... "abc.*" means "abc following by
zero or more characters", and is matched by "abc", "abcdjweerp903485" etc.

So those two lines should probably be

 HOST="%(cctfep3.*|cctapp3.*|cctfep1[0-9]|cctfep0.*|cctapp[0-9]|cctpdp0.*|cctdbp0.*)" SERVICE=conn
      MAIL $WINOPS  REPEAT=10 RECOVERED
 
 HOST="%(tucwbs1*|ttucfes1.*|tucaps1.*|tucwbq1.*|tucfeq1.*|tucapq1.*)" SERVICE=conn
       MAIL $UNIXOPS REPEAT=10 RECOVERED


Regards,
Henrik