Problems with MSG filter

[thorsten.erdmann at daimler.com]

Hi

I have some problems filtering entries from the msg test. I have several 
hosts, running SuSE which often produce the following messages in 
/var/log/messages:

Jan  7 08:09:22 s068c320 ntpd[4944]: kernel time sync error 0001

The hosts are named s068c320, s068c321, s068c322, ...

So I made the following entries in the hobbit-clients.cfg on the 
Hobbitserver, to filter out these messages:

HOST=%s068c32*
        LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

It does not work. The messages come up as an error anyway.
Here is my whole hobbit-clients.cfg



HOST=s068310i
        DISK    %^/platform.*  IGNORE

HOST=s068310b
        DISK    %^/platform.*  IGNORE

HOST=s068a300
        LOG     %.* %(fatal|error)   COLOR=red 
IGNORE=%(smb_proc_readdir_long|peer)
        LOG     %.* warning          COLOR=yellow
#        DISK    * 10 15

HOST=s068c327
        DISK    /mnt           IGNORE

HOST=%s068c32*
        LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

HOST=s068c320,s068c321,s068c322
        PROC    "lmgrd -c" 1 1
        PROC    "pam_lmd" 1 1

DEFAULT
        # These are the built-in defaults.
        UP      1h
        LOAD    5.0 10.0
        DISK    * 90 95
        DISK    /media/cdrom 101 101
        MEMPHYS 100 101
        MEMSWAP 50 80
        MEMACT  90 97

        LOG     %.* %(fatal|error)   COLOR=red 
IGNORE=%(read_socket_data|peer)
        LOG     %.* warning          COLOR=yellow

What's wrong there?
BTW: the smb_proc_readdir_log filter also does not work.

Thank you
Thorsten Erdmann


If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation.  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20100107/69c8319b/attachment.html>