On Mon, Aug 28, 2006 at 11:08:20AM -0400, Jerry Yu wrote:
Question, which takes precedence, if a line matches both IGNORE and the
alert string/reg. One line of particular interests to me is the SELinux's
pts relabeling warning in /var/log/messages, which is harmless but annoying.
I am on 4.2-RC1-20060712 and have seen such a log line causing this log test
to go red.
In 'hobbit-clients.cfg', I have
log /var/log/messages %WARNING|NOTICE|ERROR IGNORE=relabeling
The offending log lines goes line:
Jul 30 18:22:25 SRV01 su[31747]: Warning! Could not relabel /dev/pts/0 with
user_u:object_r:devpts_t, not relabeling.Operation not permitted
IGNORE takes precedence over the matching rule. So this line would not
trigger an error status.
Regards,
Henrik