Thanks for the hint. I'm still having a little trouble getting it to do what
I want, but at least no I know about pcretest, which I didn't before.
Thanks,
Steve.
On 5/14/07, John G <user-7da77b391823@xymon.invalid> wrote:
On 5/14/07, Steve Holmes <user-ec1bf77b1b44@xymon.invalid> wrote:
I may still not be understanding how the pattern matching is done for
the
LOG keyword.
I have:
LOG /var/adm/messages %(?-i)auth.error COLOR=yellow
IGNORE="%(?-i)sshd|flavor_basic: (null)"
Which I think should mean: look for the string "auth.error" in
/var/adm/messages and then ignore lines with "sshd" OR "flavor_basic:
(null)" in them.
If I *only* have IGNORE=sshd that seems to work, but I really need to
ignore
both (at least for my testing), but when I do it as above, I get yellow
screens for auth.error lines even if they have the string "sshd" in
them.
Am I missing something?
BTW, in BB I have a very long list of strings to ignore. Is there an
easier
way to do that in hobbit other than to put each string into an IGNORE
clause?
Thanks,
Steve Holmes
Try adding back slashes.
IGNORE="%(?-i)sshd|flavor_basic: \(null\)"
$ pcretest
PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: (null)/
data> flavor_basic: (null)
No match
$ pcretest
PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: \(null\)/
data> flavor_basic: (null)
0: flavor_basic: (null)
data> sshd
0: sshd
--
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)
We in America do not have government by the majority. We have government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)