John Glowacki wrote:
James Wade wrote:
I can't get the ignore working. Is this syntax wrong:
HOST=sau102
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error IGNORE="%setuid
execution not allowed" COLOR=yellow
Thie above is in the hobbit-clients.cfg file.
Both of these lines work for me.
HOST=host1
LOG /var/adm/messages %(?-i)WARNING COLOR=yellow "IGNORE=%WARNING:
/var/adm/utmp exists"
HOST=host2
LOG /var/adm/messages %(?-i)WARNING "IGNORE=%VOLTAGE:" COLOR=yellow
Try moving your quote.
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error "IGNORE=%setuid
execution not allowed" COLOR=yellow
John
I forgot I also had to exclude the hosts from the CLASS. So check if you
have another rule that would alert.
CLASS=sunos EXHOST=host1,host2
LOG /var/adm/messages %(?-i)FAILED COLOR=yellow
LOG %.* %(?-i)NOTICE COLOR=yellow
LOG /var/adm/messages %NFS.*not.responding.still.trying COLOR=yellow
LOG /var/adm/messages %(?-i)REASON COLOR=red
LOG /var/adm/messages %(?-i)WARNING COLOR=yellow