[hobbit] msgs column match-pattern

[John Glowacki]

John Glowacki wrote:
> Dominique Frise wrote:
> 
>> Hi
>>
>> In hobbit-client.cfg we tried following rule:
>>
>>     LOG %.* WARNING yellow
>>
>> But messages with "WARNING" never trigger a yellow status.
>>
>>
>> When we put a regexp like this:
>>
>>     LOG %.* %WARNING yellow
>>
>>
>> Messages with "WARNING" AND "warning" (small caps) trigger a yellow 
>> status
>> Is this the expected behaviour?
>>
>>
>> Dominique
>>
> 
> I would hope that is not the expected behavior. But I can confirm that I 
> am having the same. It matched on upper and lower cases.
> 
> John
> 
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
> 

Dominique,

It seems that pcre is defaulted to caseless matching. Set (?-i) to turn 
off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.

Example my testing using that setting.

hobbit.clients.cfg:
         LOG     /var/log/messages %(?-i)WARNING yellow
         LOG     /var/log/messages %(?-i)FAILED red

/var/log/messages file:
test FAIL 1
test FAILED 1
test fail 1
test failed 1
test WARN 1
test WARNING 1
test warn 1
test warning 1

Web page results:
Critical entries in /var/log/messages
yellow test WARNING 1
red test FAILED 1

John