On Wed, Jul 12, 2006 at 10:19:35PM -0500, Brodie, Kent wrote:
I'm not sure I understand the docs here... is something like this
correct?
[snip]
HOST=lp4.phys.mcw.edu
IGNORE
Looks right, this will drop all alerts for this host.
##HOST=%^pr*.hmgc.mcw.edu
## IGNORE
I know you commented this out, but I just want to say that
you've probably hit one of the common "gotchas" in regular
expressions: If you want to match "anything", you must use
".*" - not just "*". So to match any hostname beginning with
"pr" and ending in ".hmgc.mcw.edu" you would use
HOST=%^pr.*.hmgc.mcw.edu
or if you want to be really picky (because the dots in
".hmgc.mcw.edu" will really match any character:
HOST=%^pr.*\.hmgc\.mcw\.edu
The "*" in a reg. exp. means "zero or more occurrences of
the previous". So "pr*" will match "p" (zero r's), as well
as "pr", "prr", "prrr", "prrrrrrrr" etc.
Regards,
Henrik