[hobbit] msgs - Multiple ignore patterns

[Charles Jones]

I had similar RE issues with hobbit-alerts.cfg. I reported it several 
times but never got any response.

-Charles

Steve Holmes wrote:
> I have been having similar problem. RE which pcretest says will work 
> don't. I've tried with and without quotes, etc.
> I believe that the RE processing within hobbit is buggy. I haven't had 
> time to track down where that is handled in the code, but would like 
> to look at it if I can find it (hint, if you know where to look let me 
> know). I'm assuming that hobbit is munging the RE before handing it 
> off to PCRE. If not why would pcretest pass the RE and then it not 
> work within hobbit.
>
> Steve Holmes
>
> On 5/18/07, *Sean Hennessey* <sean.hennessey1 at verizonbusiness.com 
> <mailto:sean.hennessey1 at verizonbusiness.com>> wrote:
>
>     Looking at your original regex in pcretest, it should have worked.
>
>     PCRE version 4.5 01-December-2003
>
>       re> /plugin create statement from userPassword|plugin doing query/
>     data> plugin create statement from userPassword
>     0: plugin create statement from userPassword
>     data> pluging create statement from plugin
>     No match
>     data> plugin doing query
>     0: plugin doing query
>
>     Did you wrap your regexp in "" in the file. They don't appear in your
>     snippet below. I'm not sure if that is required or not.
>
>     -----Original Message-----
>     From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
>     <mailto:giovanni at redix.com.br>]
>     Sent: Friday, May 18, 2007 4:06 PM
>     To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
>     Subject: Re: [hobbit] msgs - Multiple ignore patterns
>
>     Didn't worked... :-(
>
>     This syntax work for you ?
>
>     Thank you!
>
>
>     Sean Hennessey wrote:
>     > I'd hazard a quess that what your regex is saying is
>     >
>     > Plugin create statement from [userPassword or plugin] doing
>     query. Try
>     > putting () around the statements.
>     >
>     > (Plugin create statement from userPassword)|(plugin doing
>     query). Not sure
>     > if you need to escape the ()'s or not.
>     >
>     > Sean
>     >
>     > -----Original Message-----
>     > From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
>     <mailto:giovanni at redix.com.br> ]
>     > Sent: Friday, May 18, 2007 1:35 PM
>     > To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
>     > Subject: [hobbit] msgs - Multiple ignore patterns
>     >
>     > Hi everyone,
>     >
>     >     I've applied the all-in-one patch but i still couldn't get
>     multiple
>     > patterns to work in IGNORE parameter... Here is my configuration:
>     >
>     > LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted"
>     > COLOR=red IGNORE=%plugin create statement from
>     userPassword|plugin doing
>     > query SELECT
>     > LOG /var/log/auth.log
>     > "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso"
>     COLOR=red
>     > IGNORE=%plugin create statement from userPassword|plugin doing query
>     SELECT
>     >
>     >     Why this regex don't work ? Any idea ?
>     >
>     >     Thank you all the attention...
>     >
>     >     Cheers
>     >
>     >
>
>     To unsubscribe from the hobbit list, send an e-mail to
>     hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>
>
>
>
>
>
>     To unsubscribe from the hobbit list, send an e-mail to
>     hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>
>
>
>
>
>
> -- 
> Lots of people think they're charitable if they give away their old 
> clothes
> and things they don't want. It isn't charity to give away things you want
> to get rid of and it isn't a sacrifice to do things you don't mind doing.
> -Myrtle Reed, author (1874-1911) 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070518/c20c7973/attachment.html>