Betsy
Multiple "ignore" lines are permitted, and they accumulate. The ignore
string must be a regular expression, so the "%" must be left out, unless
you want to match a percent character. Also, if a space is in the string
to match, the expression should not be enclosed in quotes, and the space
should simply be included literally, or replaced with a "\s" or similar.
There is an implied ".*" at start and end, so for example "MARK" matches
anywhere in a log line.
The code that compiles the regexps sets the REG_EXTENDED and REG_ICASE
(ignore case) flags, so bear this in mind when matching.
In your case, I think the following should work:
ignore nslcd
ignore MARK
ignore be2net
Or you could do this:
ignore nslcd|MARK|be2net
If you want to test out your own expressions with a test cycle that's less
than 10 minutes, create a file /tmp/config containing just the "log:" and
"ignore" lines, and then run the following as the xymon user:
rm -f /tmp/status && logfetch /tmp/config /tmp/status
Then re-run it after editing the "/tmp/config" file, to see the changes.
J
On 18 December 2012 04:12, Betsy Schwartz <user-c61747246f66@xymon.invalid> wrote:
Can I say for example
[linux]
log:/var/log/messages:102400
ignore nslcd
ignore MARK
ignore %.*be2net.*
or do those all have to be one regexp?
(and can I say "ignore nslcd" or does it have to be "ignore %.*nslcd.* " ?