[hobbit] msgs - Multiple ignore patterns

[Giovanni - Gestor Redix]

Hi Charles!

How do you work with this limitation ? Any workaround ?

Cheers


Charles Jones wrote:
> I had similar RE issues with hobbit-alerts.cfg. I reported it several 
> times but never got any response.
>
> -Charles
>
> Steve Holmes wrote:
>> I have been having similar problem. RE which pcretest says will work 
>> don't. I've tried with and without quotes, etc.
>> I believe that the RE processing within hobbit is buggy. I haven't 
>> had time to track down where that is handled in the code, but would 
>> like to look at it if I can find it (hint, if you know where to look 
>> let me know). I'm assuming that hobbit is munging the RE before 
>> handing it off to PCRE. If not why would pcretest pass the RE and 
>> then it not work within hobbit.
>>
>> Steve Holmes
>>
>> On 5/18/07, *Sean Hennessey* <sean.hennessey1 at verizonbusiness.com 
>> <mailto:sean.hennessey1 at verizonbusiness.com>> wrote:
>>
>>     Looking at your original regex in pcretest, it should have worked.
>>
>>     PCRE version 4.5 01-December-2003
>>
>>       re> /plugin create statement from userPassword|plugin doing query/
>>     data> plugin create statement from userPassword
>>     0: plugin create statement from userPassword
>>     data> pluging create statement from plugin
>>     No match
>>     data> plugin doing query
>>     0: plugin doing query
>>
>>     Did you wrap your regexp in "" in the file. They don't appear in your
>>     snippet below. I'm not sure if that is required or not.
>>
>>     -----Original Message-----
>>     From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
>>     <mailto:giovanni at redix.com.br>]
>>     Sent: Friday, May 18, 2007 4:06 PM
>>     To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
>>     Subject: Re: [hobbit] msgs - Multiple ignore patterns
>>
>>     Didn't worked... :-(
>>
>>     This syntax work for you ?
>>
>>     Thank you!
>>
>>
>>     Sean Hennessey wrote:
>>     > I'd hazard a quess that what your regex is saying is
>>     >
>>     > Plugin create statement from [userPassword or plugin] doing
>>     query. Try
>>     > putting () around the statements.
>>     >
>>     > (Plugin create statement from userPassword)|(plugin doing
>>     query). Not sure
>>     > if you need to escape the ()'s or not.
>>     >
>>     > Sean
>>     >
>>     > -----Original Message-----
>>     > From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
>>     <mailto:giovanni at redix.com.br> ]
>>     > Sent: Friday, May 18, 2007 1:35 PM
>>     > To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
>>     > Subject: [hobbit] msgs - Multiple ignore patterns
>>     >
>>     > Hi everyone,
>>     >
>>     >     I've applied the all-in-one patch but i still couldn't get
>>     multiple
>>     > patterns to work in IGNORE parameter... Here is my configuration:
>>     >
>>     > LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted"
>>     > COLOR=red IGNORE=%plugin create statement from
>>     userPassword|plugin doing
>>     > query SELECT
>>     > LOG /var/log/auth.log
>>     > "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso"
>>     COLOR=red
>>     > IGNORE=%plugin create statement from userPassword|plugin doing
>>     query
>>     SELECT
>>     >
>>     >     Why this regex don't work ? Any idea ?
>>     >
>>     >     Thank you all the attention...
>>     >
>>     >     Cheers
>>     >
>>     >
>>
>>     To unsubscribe from the hobbit list, send an e-mail to
>>     hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>
>>
>>
>>
>>
>>
>>     To unsubscribe from the hobbit list, send an e-mail to
>>     hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>
>>
>>
>>
>>
>>
>> -- 
>> Lots of people think they're charitable if they give away their old 
>> clothes
>> and things they don't want. It isn't charity to give away things you 
>> want
>> to get rid of and it isn't a sacrifice to do things you don't mind doing.
>> -Myrtle Reed, author (1874-1911) 
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070521/790edd18/attachment.html>