LOG IGNORE matching

[Steve Holmes]

I may still not be understanding how the pattern matching is done for the
LOG keyword.

I have:

        LOG /var/adm/messages %(?-i)auth.error COLOR=yellow
IGNORE="%(?-i)sshd|flavor_basic: (null)"

Which I think should mean: look for the string "auth.error" in
/var/adm/messages and then ignore lines with "sshd" OR "flavor_basic:
(null)" in them.

If I *only* have IGNORE=sshd that seems to work, but I really need to ignore
both (at least for my testing), but when I do it as above, I get yellow
screens for auth.error lines even if they have the string "sshd" in them.

Am I missing something?

BTW, in BB I have a very long list of strings to ignore. Is there an easier
way to do that in hobbit other than to put each string into an IGNORE
clause?

Thanks,
Steve Holmes
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070514/a6386122/attachment.html>