[hobbit] LOG Pattern IGNORE syntax

[Dominique Frise]

Asif Iqbal wrote:
> On 7/13/07, *Asif Iqbal* <vadud3 at gmail.com <mailto:vadud3 at gmail.com>> wrote:
> 
>     OK here is another PCRE issue with IGNORE pattern
> 
>     I have this on ~hobbit/server/etc/hobbit-clients.cfg
> 
>     HOST= host.domain.net <http://host.domain.net>
>     LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
>     IGNORE=%Power.*Supply.*0.*NOT.*okay 
> 
> 
> 
> Is it suppose to be a bug in hobbit?
> 
> 
>     But I still get alert as following
> 
>     &red Critical entries in <a
>     href="/hobbit-cgi/bb-hostsvc.sh?CLIENT=host.domain.net&SECTION=msgs:/var/adm/messages">/var/adm/messages</a>
>     &red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
>     WARNING: Power Supply 0 NOT okay
> 
>     I did a pcretest and it did match so why is hobbit still alerting?
> 
>     (hobbit)@hobbit:~/server/etc$ pcretest
>     PCRE version 4.5 01-December-2003
> 
>       re> "Power.*Supply.*0.*NOT.*okay"
>     data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
>     WARNING: Power Supply 0 NOT okay
>      0: Power Supply 0 NOT okay
> 
> 
> 
> 
> 
> 
>     On 6/3/07, *Giovanni - Gestor Redix* < giovanni at redix.com.br
>     <https://mail.google.com/mail?view=cm&tf=0&to=giovanni@redix.com.br>
>      > wrote:
> 
>         Everything ok with your syntax, i just would try removing the
>         double-quotes...
> 
>         BTW, If you need to ignore a phrase that uses spaces, use \s to
>         separate, like the following syntax:
>         LOG blablabla %blablabla IGNORE=%one\stwo\swords
> 
>         Another example: IGNORE=%one\stwo|other\sword|word
> 
>         Cheers
> 
> 
>         Asif Iqbal wrote:
>>         Is this a valid syntax?
>>
>>         LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
>>         IGNORE=%SUNWsrspx|srsxfer
>>
>>         I want no alert for lines, in `/var/adm/messages',  that has
>>         either or both of these two words
>>
>>         SUNWsrspx
>>         srsxfer
>>
>>         Thanks
>>
>>         -- 
>>
>>         Asif Iqbal
>>         PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
>>
>>
> 
> 
> 
>     -- 
>     Asif Iqbal
>     PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
> 
> 
> 
> 
> 
> -- 
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
> 
> 

%(?-i) tells Hobbit to turn case-sensitive pattern matching on.
This should be used once per rule.
I would write your rules like this:

      HOST=host.domain.net
      LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
      IGNORE=%(?-i)Power\sSupply\s0\sNOT\sokay

      LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
      IGNORE=%(?-i)SUNWsrspx|srsxfer


Dominique