[hobbit] LOG IGNORE matching

[Steve Holmes]

Thanks for the hint. I'm still having a little trouble getting it to do what
I want, but at least no I know about pcretest, which I didn't before.

Thanks,
Steve.


On 5/14/07, John G <jg2727 at gmail.com> wrote:
>
> On 5/14/07, Steve Holmes <sholmes42 at mac.com> wrote:
> > I may still not be understanding how the pattern matching is done for
> the
> > LOG keyword.
> >
> > I have:
> >
> >         LOG /var/adm/messages %(?-i)auth.error COLOR=yellow
> > IGNORE="%(?-i)sshd|flavor_basic: (null)"
> >
> > Which I think should mean: look for the string "auth.error" in
> > /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic:
> > (null)" in them.
> >
> > If I *only* have IGNORE=sshd that seems to work, but I really need to
> ignore
> > both (at least for my testing), but when I do it as above, I get yellow
> > screens for auth.error lines even if they have the string "sshd" in
> them.
> >
> > Am I missing something?
> >
> > BTW, in BB I have a very long list of strings to ignore. Is there an
> easier
> > way to do that in hobbit other than to put each string into an IGNORE
> > clause?
> >
> > Thanks,
> > Steve Holmes
> >
> >
>
> Try adding back slashes.
> IGNORE="%(?-i)sshd|flavor_basic: \(null\)"
>
> $ pcretest
> PCRE version 6.7 04-Jul-2006
>
>   re> /(?-i)sshd|flavor_basic: (null)/
> data> flavor_basic: (null)
> No match
> $ pcretest
> PCRE version 6.7 04-Jul-2006
>
>   re> /(?-i)sshd|flavor_basic: \(null\)/
> data> flavor_basic: (null)
> 0: flavor_basic: (null)
> data> sshd
> 0: sshd
>
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
>
>
>


-- 
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070515/1093d4b3/attachment.html>