Problems with MSG filter

A quick thought: the disk regular expressions start with "%^", whereas your HOST and LOG portions are missing the caret (^).  That might be a first step...

Hope that helps,
Matt.

Unix System Administrator
Computer Science Corporation
General Dynamics Land Systems
XXXXX Mound Rd.
Sterling Heights, MI.  48310
Desk: (XXX) XXX-XXXX
Oracle IM: moldvanm

This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose.


[hobbit] Problems with MSG filter

thorsten.erdmann to:
hobbit
01/07/2010 02:26 AM

Please respond to hobbit


Hi

I have some problems filtering entries from the msg test. I have several hosts, running SuSE which often produce the following messages in /var/log/messages:

Jan  7 08:09:22 s068c320 ntpd[4944]: kernel time sync error 0001

The hosts are named s068c320, s068c321, s068c322, ...

So I made the following entries in the hobbit-clients.cfg on the Hobbitserver, to filter out these messages:

HOST=%s068c32*
        LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

It does not work. The messages come up as an error anyway.
Here is my whole hobbit-clients.cfg


HOST=s068310i
        DISK    %^/platform.*  IGNORE

HOST=s068310b
        DISK    %^/platform.*  IGNORE

HOST=s068a300
        LOG     %.* %(fatal|error)   COLOR=red IGNORE=%(smb_proc_readdir_long|peer)
        LOG     %.* warning          COLOR=yellow
#        DISK    * 10 15

HOST=s068c327
        DISK    /mnt           IGNORE

HOST=%s068c32*
        LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

HOST=s068c320,s068c321,s068c322
        PROC    "lmgrd -c" 1 1
        PROC    "pam_lmd" 1 1

DEFAULT
        # These are the built-in defaults.
        UP      1h
        LOAD    5.0 10.0
        DISK    * 90 95
        DISK    /media/cdrom 101 101
        MEMPHYS 100 101
        MEMSWAP 50 80
        MEMACT  90 97

        LOG     %.* %(fatal|error)   COLOR=red IGNORE=%(read_socket_data|peer)
        LOG     %.* warning          COLOR=yellow

What's wrong there?
BTW: the smb_proc_readdir_log filter also does not work.

Thank you
Thorsten Erdmann

If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation. This is an e-mail from General Dynamics Land Systems. It is for the intended recipient only and may contain confidential and privileged information. No one else may read, print, store, copy, forward or act in reliance on it or its attachments. If you are not the intended recipient, please return this message to the sender and delete the message and any attachments from your computer. Your cooperation is appreciated.