[hobbit] msgs - Multiple ignore patterns

[Sean Hennessey]

Looking at your original regex in pcretest, it should have worked.

PCRE version 4.5 01-December-2003

  re> /plugin create statement from userPassword|plugin doing query/
data> plugin create statement from userPassword
 0: plugin create statement from userPassword
data> pluging create statement from plugin
No match
data> plugin doing query
 0: plugin doing query

Did you wrap your regexp in "" in the file. They don't appear in your
snippet below. I'm not sure if that is required or not.

-----Original Message-----
From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] 
Sent: Friday, May 18, 2007 4:06 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] msgs - Multiple ignore patterns

Didn't worked... :-(

This syntax work for you ?

Thank you!


Sean Hennessey wrote:
> I'd hazard a quess that what your regex is saying is
>
> Plugin create statement from [userPassword or plugin] doing query. Try
> putting () around the statements.
>
> (Plugin create statement from userPassword)|(plugin doing query). Not sure
> if you need to escape the ()'s or not.
>
> Sean
>
> -----Original Message-----
> From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] 
> Sent: Friday, May 18, 2007 1:35 PM
> To: hobbit at hswn.dk
> Subject: [hobbit] msgs - Multiple ignore patterns
>
> Hi everyone,
>
>     I've applied the all-in-one patch but i still couldn't get multiple 
> patterns to work in IGNORE parameter... Here is my configuration:
>
> LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted" 
> COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing 
> query SELECT
> LOG /var/log/auth.log 
> "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red 
> IGNORE=%plugin create statement from userPassword|plugin doing query
SELECT
>
>     Why this regex don't work ? Any idea ?
>
>     Thank you all the attention...
>
>     Cheers
>
>   

To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk