Don't use SPACES, change by \s:
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error IGNORE="%setuid\sexecution\snot\sallowed" COLOR=yellow
Cheers
John Glowacki wrote:
James Wade wrote:
I can't get the ignore working. Is this syntax wrong:
HOST=sau102
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error IGNORE="%setuid
execution not allowed" COLOR=yellow
Thie above is in the hobbit-clients.cfg file.
Both of these lines work for me.
HOST=host1
LOG /var/adm/messages %(?-i)WARNING COLOR=yellow "IGNORE=%WARNING:
/var/adm/utmp exists"
HOST=host2
LOG /var/adm/messages %(?-i)WARNING "IGNORE=%VOLTAGE:" COLOR=yellow
Try moving your quote.
LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error "IGNORE=%setuid
execution not allowed" COLOR=yellow
John