[hobbit] msgs - Multiple ignore patterns
Sean Hennessey
sean.hennessey1 at verizonbusiness.com
Fri May 18 22:19:17 CEST 2007
Looking at your original regex in pcretest, it should have worked.
PCRE version 4.5 01-December-2003
re> /plugin create statement from userPassword|plugin doing query/
data> plugin create statement from userPassword
0: plugin create statement from userPassword
data> pluging create statement from plugin
No match
data> plugin doing query
0: plugin doing query
Did you wrap your regexp in "" in the file. They don't appear in your
snippet below. I'm not sure if that is required or not.
-----Original Message-----
From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br]
Sent: Friday, May 18, 2007 4:06 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] msgs - Multiple ignore patterns
Didn't worked... :-(
This syntax work for you ?
Thank you!
Sean Hennessey wrote:
> I'd hazard a quess that what your regex is saying is
>
> Plugin create statement from [userPassword or plugin] doing query. Try
> putting () around the statements.
>
> (Plugin create statement from userPassword)|(plugin doing query). Not sure
> if you need to escape the ()'s or not.
>
> Sean
>
> -----Original Message-----
> From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br]
> Sent: Friday, May 18, 2007 1:35 PM
> To: hobbit at hswn.dk
> Subject: [hobbit] msgs - Multiple ignore patterns
>
> Hi everyone,
>
> I've applied the all-in-one patch but i still couldn't get multiple
> patterns to work in IGNORE parameter... Here is my configuration:
>
> LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted"
> COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing
> query SELECT
> LOG /var/log/auth.log
> "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red
> IGNORE=%plugin create statement from userPassword|plugin doing query
SELECT
>
> Why this regex don't work ? Any idea ?
>
> Thank you all the attention...
>
> Cheers
>
>
To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk
More information about the Xymon
mailing list