[hobbit] LOG IGNORE matching

[John G]

On 5/14/07, Steve Holmes <sholmes42 at mac.com> wrote:
> I may still not be understanding how the pattern matching is done for the
> LOG keyword.
>
> I have:
>
>         LOG /var/adm/messages %(?-i)auth.error COLOR=yellow
> IGNORE="%(?-i)sshd|flavor_basic: (null)"
>
> Which I think should mean: look for the string "auth.error" in
> /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic:
> (null)" in them.
>
> If I *only* have IGNORE=sshd that seems to work, but I really need to ignore
> both (at least for my testing), but when I do it as above, I get yellow
> screens for auth.error lines even if they have the string "sshd" in them.
>
> Am I missing something?
>
> BTW, in BB I have a very long list of strings to ignore. Is there an easier
> way to do that in hobbit other than to put each string into an IGNORE
> clause?
>
> Thanks,
> Steve Holmes
>
>

Try adding back slashes.
IGNORE="%(?-i)sshd|flavor_basic: \(null\)"

$ pcretest
PCRE version 6.7 04-Jul-2006

  re> /(?-i)sshd|flavor_basic: (null)/
data> flavor_basic: (null)
No match
$ pcretest
PCRE version 6.7 04-Jul-2006

  re> /(?-i)sshd|flavor_basic: \(null\)/
data> flavor_basic: (null)
 0: flavor_basic: (null)
data> sshd
 0: sshd