On 5/14/07, Steve Holmes <user-ec1bf77b1b44@xymon.invalid> wrote:
I may still not be understanding how the pattern matching is done for the
LOG keyword.
I have:
LOG /var/adm/messages %(?-i)auth.error COLOR=yellow
IGNORE="%(?-i)sshd|flavor_basic: (null)"
Which I think should mean: look for the string "auth.error" in
/var/adm/messages and then ignore lines with "sshd" OR "flavor_basic:
(null)" in them.
If I *only* have IGNORE=sshd that seems to work, but I really need to ignore
both (at least for my testing), but when I do it as above, I get yellow
screens for auth.error lines even if they have the string "sshd" in them.
Am I missing something?
BTW, in BB I have a very long list of strings to ignore. Is there an easier
way to do that in hobbit other than to put each string into an IGNORE
clause?
Thanks,
Steve Holmes
Try adding back slashes.
IGNORE="%(?-i)sshd|flavor_basic: \(null\)"
$ pcretest
PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: (null)/
data> flavor_basic: (null)
No match
$ pcretest
PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: \(null\)/
data> flavor_basic: (null)
0: flavor_basic: (null)
data> sshd
0: sshd