Re: [hobbit] msgs column match-pattern

[John Glowacki <johng (at) idttechnology.com>]

John Glowacki wrote:
> Dominique Frise wrote:
>
> > Hi
> >
> > In hobbit-client.cfg we tried following rule:
> >
> >     LOG %.* WARNING yellow
> >
> > But messages with "WARNING" never trigger a yellow status.
> >
> >
> > When we put a regexp like this:
> >
> >     LOG %.* %WARNING yellow
> >
> >
> > Messages with "WARNING" AND "warning" (small caps) trigger a yellow 
> > status
> > Is this the expected behaviour?
> >
> >
> > Dominique
>
> I would hope that is not the expected behavior. But I can confirm that I 
> am having the same. It matched on upper and lower cases.
>
> John
>
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe (at) hswn.dk

Dominique,

It seems that pcre is defaulted to caseless matching. Set (?-i) to turn 
off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.

Example my testing using that setting.

hobbit.clients.cfg:
        LOG     /var/log/messages %(?-i)WARNING yellow
        LOG     /var/log/messages %(?-i)FAILED red

/var/log/messages file:
test FAIL 1
test FAILED 1
test fail 1
test failed 1
test WARN 1
test WARNING 1
test warn 1
test warning 1

Web page results:
Critical entries in /var/log/messages
yellow test WARNING 1
red test FAILED 1

John