John Glowacki wrote:
Dominique Frise wrote:
Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellow
But messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellow
Messages with "WARNING" AND "warning" (small caps) trigger a yellow status
Is this the expected behaviour?
Dominique
I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.
John
Dominique,
It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.
Example my testing using that setting.
hobbit.clients.cfg:
LOG /var/log/messages %(?-i)WARNING yellow
LOG /var/log/messages %(?-i)FAILED red
/var/log/messages file:
test FAIL 1
test FAILED 1
test fail 1
test failed 1
test WARN 1
test WARNING 1
test warn 1
test warning 1
Web page results:
Critical entries in /var/log/messages
yellow test WARNING 1
red test FAILED 1
John