[hobbit] LOG Pattern IGNORE syntax

[Asif Iqbal]

On 7/13/07, Asif Iqbal <vadud3 at gmail.com> wrote:
>
> OK here is another PCRE issue with IGNORE pattern
>
> I have this on ~hobbit/server/etc/hobbit-clients.cfg
>
> HOST=host.domain.net
> LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
> IGNORE=%Power.*Supply.*0.*NOT.*okay



Is it suppose to be a bug in hobbit?


But I still get alert as following
>
> &red Critical entries in <a href="/hobbit-cgi/bb-hostsvc.sh?CLIENT=
> host.domain.net&SECTION=msgs:/var/adm/messages">/var/adm/messages</a>
> &red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
> Power Supply 0 NOT okay
>
> I did a pcretest and it did match so why is hobbit still alerting?
>
> (hobbit)@hobbit:~/server/etc$ pcretest
> PCRE version 4.5 01-December-2003
>
>   re> "Power.*Supply.*0.*NOT.*okay"
> data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
> Power Supply 0 NOT okay
>  0: Power Supply 0 NOT okay
>
>
>
>
>
> On 6/3/07, Giovanni - Gestor Redix <giovanni at redix.com.br<https://mail.google.com/mail?view=cm&tf=0&to=giovanni@redix.com.br>> wrote:
> >
> >  Everything ok with your syntax, i just would try removing the
> > double-quotes...
> >
> > BTW, If you need to ignore a phrase that uses spaces, use \s to
> > separate, like the following syntax:
> > LOG blablabla %blablabla IGNORE=%one\stwo\swords
> >
> > Another example: IGNORE=%one\stwo|other\sword|word
> >
> > Cheers
> >
> > Asif Iqbal wrote:
> >
> > Is this a valid syntax?
> >
> > LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
> > IGNORE=%SUNWsrspx|srsxfer
> >
> > I want no alert for lines, in `/var/adm/messages',  that has either or
> > both of these two words
> >
> > SUNWsrspx
> > srsxfer
> >
> > Thanks
> >
> > --
> >
> > Asif Iqbal
> > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
> >
> >
> >
>
>
> --
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>
>
>


-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070717/767526df/attachment.html>