syntax for log monitoring with spaces? 🔗 link

In hobbit-clients.cfg I have this defined

HOST=sun.example.com
   LOG /var/adm/messages %error|panic|ERROR|half-duplex|failing|transport failed|responding|core|NOTICE|offlin COLOR=red IGNORE=%upload|External request
 already in progress|pam_dial_auth
   LOG /var/adm/messages %(WARNING|xntpd) COLOR=yellow

(The first LOG line is a single line in hobbit-clients.cfg)

But, I get alarms like this:

System logs at Fri Dec 19 08:42:16 EST 2008

red Critical entries in /var/adm/messages
red Dec 19 08:09:41 sun bpjava-msvc[5400]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module.
red Dec 19 08:31:09 sun bpjava-msvc[3963]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module.


Is my logic wrong?

(Hobbit Monitor 4.3.0-0.20080403)

Thanks

Craig

In <user-c5293afdde49@xymon.invalid> Craig Cook <user-bd346ac7bd4a@xymon.invalid> writes:

  LOG /var/adm/messages %error|panic|ERROR|half-duplex|failing|transport failed|responding|core|NOTICE|offlin COLOR=red IGNORE=%upload|External request already in progress|pam_dial_auth

Whitespace in the patterns is likely to trip up the parser. Wrap the 
pattern in quotes, or use [[:space:]] instead of space. (Or just '.',
which matches anything).

E.g.
	LOG /var/adm/messages \
		"%error|panic|ERROR|half-duplex|failing|transport failed|responding|core|NOTICE|offlin" \
		"IGNORE=%upload|External request already in progress|pam_dial_auth" \
		COLOR=red


Regards,
Henrik

Using [[:space:]] seems to be working.

Thanks

Craig