msgs column match-pattern

5 messages in this thread

list Dominique Frise · Tue, 18 Apr 2006 10:12:40 +0200 ·

Hi

In hobbit-client.cfg we tried following rule:

	LOG %.* WARNING yellow

But messages with "WARNING" never trigger a yellow status.


When we put a regexp like this:

	LOG %.* %WARNING yellow


Messages with "WARNING" AND "warning" (small caps) trigger a yellow status
Is this the expected behaviour?


Dominique

list John Glowacki · Tue, 18 Apr 2006 12:36:51 -0400 ·

▸ quoted from Dominique Frise

Dominique Frise wrote:

Hi

In hobbit-client.cfg we tried following rule:

    LOG %.* WARNING yellow

But messages with "WARNING" never trigger a yellow status.


When we put a regexp like this:

    LOG %.* %WARNING yellow


Messages with "WARNING" AND "warning" (small caps) trigger a yellow status
Is this the expected behaviour?


Dominique

I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.

John

list John Glowacki · Sun, 23 Apr 2006 20:56:25 -0400 ·

▸ quoted from John Glowacki

John Glowacki wrote:

Dominique Frise wrote:

Hi

In hobbit-client.cfg we tried following rule:

    LOG %.* WARNING yellow

But messages with "WARNING" never trigger a yellow status.


When we put a regexp like this:

    LOG %.* %WARNING yellow


Messages with "WARNING" AND "warning" (small caps) trigger a yellow status
Is this the expected behaviour?


Dominique

I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.

John

Dominique,

It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.

Example my testing using that setting.

hobbit.clients.cfg:
         LOG     /var/log/messages %(?-i)WARNING yellow
         LOG     /var/log/messages %(?-i)FAILED red

/var/log/messages file:
test FAIL 1
test FAILED 1
test fail 1
test failed 1
test WARN 1
test WARNING 1
test warn 1
test warning 1

Web page results:
Critical entries in /var/log/messages
yellow test WARNING 1
red test FAILED 1

John

list Henrik Størner · Mon, 24 Apr 2006 07:41:03 +0200 ·

▸ quoted from John Glowacki

On Sun, Apr 23, 2006 at 08:56:25PM -0400, John Glowacki wrote:

It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.

Indeed, yes - that is the way I've coded the string matching.

I didn't know that you could actually embed this into the regex.
Thanks for the tip, which I've added to the hobbit-clients.cfg man-page.


Regards,
Henrik

list Dominique Frise · Mon, 24 Apr 2006 08:06:54 +0200 ·

▸ quoted from John Glowacki

John Glowacki wrote:

John Glowacki wrote:

Dominique Frise wrote:

Hi

In hobbit-client.cfg we tried following rule:

    LOG %.* WARNING yellow

But messages with "WARNING" never trigger a yellow status.


When we put a regexp like this:

    LOG %.* %WARNING yellow


Messages with "WARNING" AND "warning" (small caps) trigger a yellow status
Is this the expected behaviour?


Dominique

I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.

John

Dominique,

It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.

Example my testing using that setting.

hobbit.clients.cfg:
        LOG     /var/log/messages %(?-i)WARNING yellow
        LOG     /var/log/messages %(?-i)FAILED red

/var/log/messages file:
test FAIL 1
test FAILED 1
test fail 1
test failed 1
test WARN 1
test WARNING 1
test warn 1
test warning 1

Web page results:
Critical entries in /var/log/messages
yellow test WARNING 1
red test FAILED 1

John

Thanks a lot John for this tip, I will try this asap.
This means that I have to double check all my DISK/PROC settings because I nead   case sensitive matching there to!


Dominique

msgs column match-pattern 🔗 link

msgs column match-pattern