msgs - Multiple ignore patterns

Looking at your original regex in pcretest, it should have worked.

PCRE version 4.5 01-December-2003

  re> /plugin create statement from userPassword|plugin doing query/
data> plugin create statement from userPassword
 0: plugin create statement from userPassword
data> pluging create statement from plugin
No match
data> plugin doing query
 0: plugin doing query

Did you wrap your regexp in "" in the file. They don't appear in your
snippet below. I'm not sure if that is required or not.

-----Original Message-----
From: Giovanni - Gestor Redix [mailto:user-e1d5cb184a81@xymon.invalid] Sent: Friday, May 18, 2007 4:06 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] msgs - Multiple ignore patterns

Didn't worked... :-(

This syntax work for you ?

Thank you!


Sean Hennessey wrote:

I'd hazard a quess that what your regex is saying is

Plugin create statement from [userPassword or plugin] doing query. Try
putting () around the statements.

(Plugin create statement from userPassword)|(plugin doing query). Not sure
if you need to escape the ()'s or not.

Sean

-----Original Message-----
From: Giovanni - Gestor Redix [mailto:user-e1d5cb184a81@xymon.invalid] Sent: Friday, May 18, 2007 1:35 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] msgs - Multiple ignore patterns

Hi everyone,

    I've applied the all-in-one patch but i still couldn't get multiple patterns to work in IGNORE parameter... Here is my configuration:

LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT
LOG /var/log/auth.log "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query

SELECT

    Why this regex don't work ? Any idea ?

    Thank you all the attention...

    Cheers