I have been having similar problem. RE which pcretest says will work
don't. I've tried with and without quotes, etc.
I believe that the RE processing within hobbit is buggy. I haven't
had time to track down where that is handled in the code, but would
like to look at it if I can find it (hint, if you know where to look
let me know). I'm assuming that hobbit is munging the RE before
handing it off to PCRE. If not why would pcretest pass the RE and
then it not work within hobbit.
Steve Holmes
On 5/18/07, *Sean Hennessey* <user-5612d405097f@xymon.invalid
<mailto:user-5612d405097f@xymon.invalid>> wrote:
Looking at your original regex in pcretest, it should have worked.
PCRE version 4.5 01-December-2003
re> /plugin create statement from userPassword|plugin doing query/
data> plugin create statement from userPassword
0: plugin create statement from userPassword
data> pluging create statement from plugin
No match
data> plugin doing query
0: plugin doing query
Did you wrap your regexp in "" in the file. They don't appear in your
snippet below. I'm not sure if that is required or not.
-----Original Message-----
From: Giovanni - Gestor Redix [mailto:user-e1d5cb184a81@xymon.invalid
<mailto:user-e1d5cb184a81@xymon.invalid>]
Sent: Friday, May 18, 2007 4:06 PM
To: user-ae9b8668bcde@xymon.invalid <mailto:user-ae9b8668bcde@xymon.invalid>
Subject: Re: [hobbit] msgs - Multiple ignore patterns
Didn't worked... :-(
This syntax work for you ?
Thank you!
Sean Hennessey wrote:I'd hazard a quess that what your regex is saying is
Plugin create statement from [userPassword or plugin] doing
query. Try
putting () around the statements.
(Plugin create statement from userPassword)|(plugin doing
query). Not sure
if you need to escape the ()'s or not.
Sean
-----Original Message-----
From: Giovanni - Gestor Redix [mailto:user-e1d5cb184a81@xymon.invalid
<mailto:user-e1d5cb184a81@xymon.invalid> ]
Sent: Friday, May 18, 2007 1:35 PM
To: user-ae9b8668bcde@xymon.invalid <mailto:user-ae9b8668bcde@xymon.invalid>
Subject: [hobbit] msgs - Multiple ignore patterns
Hi everyone,
I've applied the all-in-one patch but i still couldn't get
multiple
patterns to work in IGNORE parameter... Here is my configuration:
LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted"
COLOR=red IGNORE=%plugin create statement from
userPassword|plugin doing
query SELECT
LOG /var/log/auth.log
"%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso"
COLOR=red
IGNORE=%plugin create statement from userPassword|plugin doing
query
SELECT
Why this regex don't work ? Any idea ?
Thank you all the attention...
Cheers
--
Lots of people think they're charitable if they give away their old
clothes
and things they don't want. It isn't charity to give away things you
want
to get rid of and it isn't a sacrifice to do things you don't mind doing.
-Myrtle Reed, author (1874-1911)