msgs - Multiple ignore patterns

Thank you!!! Now multiple ignore patterns works correctly!

       LOG /var/log/syslog %password|error|fail|changed|tcpd|Accepted 
COLOR=red 
IGNORE=%plugin\screate\sstatement\sfrom\suserPassword|plugin\sdoing\squery\sELECTTTT
       LOG /var/log/auth.log %password|error|fail|changed|tcpd|Accepted 
COLOR=red 
IGNORE=%plugin\screate\sstateeement\sfrom\suserPassword|plugin\sdoing\squery\sSELECT

Steve Holmes wrote:

Thanks, Craig. I'm going to try this trick. But even single words 
aren't working reliably for me.
Steve Holmes


On 5/24/07, *Dominique Frise* <user-78ab6673b600@xymon.invalid 
<mailto:user-78ab6673b600@xymon.invalid>> wrote:

    Craig Cook wrote:

While we are asking questions about the pcre handling...

Has anyone managed to use a rule with spaces?

ie.

LOG /var/log/syslog "%disk full" COLOR=red

I have tried using quotes, escaping quotes, escaping spaces,
    etc.  Nothing has worked.  Reduced to individual words to get
    something working.


Craig Cook
--
Systems Monitoring Consulting and Support Services
http://www.cookitservices.com

    Spaces should work but we use \s to represent spaces.

    Example:

    LOG /var/adm/messages.da
    %(?-i)Fail|fail|On\sbattery|AC\sline\sfault|Replace\sbattery|Battery\snot
    COLOR=yellow

    The (?-i) tells pcre to turn case-sensitive pattern matching on.


    Dominique
    UNIL - University of Lausanne


-- 
Lots of people think they're charitable if they give away their old 
clothes
and things they don't want. It isn't charity to give away things you want
to get rid of and it isn't a sacrifice to do things you don't mind doing.
-Myrtle Reed, author (1874-1911)