From vadud3@gmail.com Wed Jun 24 08:15:36 2026
From: vadud3@gmail.com
To: xymon@xymon.com
Subject: [hobbit] LOG Pattern IGNORE syntax
Date: Fri, 13 Jul 2007 11:50:51 -0400
Message-ID: <a60f25fc0707130850o481d1fb1wed8d0f11c829d57@mail.gmail.com>
In-Reply-To: <46631D9A.8040308@redix.com.br>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8829378400642599268=="

--===============8829378400642599268==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

OK here is another PCRE issue with IGNORE pattern

I have this on ~hobbit/server/etc/hobbit-clients.cfg

HOST=host.domain.net
LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
IGNORE=%Power.*Supply.*0.*NOT.*okay

But I still get alert as following

&red Critical entries in <a href="/hobbit-cgi/bb-hostsvc.sh?CLIENT=
host.domain.net&amp;SECTION=msgs:/var/adm/messages">/var/adm/messages</a>
&red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
Power Supply 0 NOT okay

I did a pcretest and it did match so why is hobbit still alerting?

(hobbit)@hobbit:~/server/etc$ pcretest
PCRE version 4.5 01-December-2003

  re> "Power.*Supply.*0.*NOT.*okay"
data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
Power Supply 0 NOT okay
 0: Power Supply 0 NOT okay





On 6/3/07, Giovanni - Gestor Redix <giovanni at redix.com.br> wrote:
>
>  Everything ok with your syntax, i just would try removing the
> double-quotes...
>
> BTW, If you need to ignore a phrase that uses spaces, use \s to separate,
> like the following syntax:
> LOG blablabla %blablabla IGNORE=%one\stwo\swords
>
> Another example: IGNORE=%one\stwo|other\sword|word
>
> Cheers
>
> Asif Iqbal wrote:
>
> Is this a valid syntax?
>
> LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
> IGNORE=%SUNWsrspx|srsxfer
>
> I want no alert for lines, in `/var/adm/messages',  that has either or
> both of these two words
>
> SUNWsrspx
> srsxfer
>
> Thanks
>
> --
>
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>
>
>


-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

--===============8829378400642599268==--


From vadud3@gmail.com Wed Jun 24 08:15:38 2026
From: vadud3@gmail.com
To: xymon@xymon.com
Subject: [hobbit] LOG Pattern IGNORE syntax
Date: Tue, 17 Jul 2007 23:59:33 -0400
Message-ID: <a60f25fc0707172059q276281f1x8bb0a8bf1db27151@mail.gmail.com>
In-Reply-To: <a60f25fc0707130850o481d1fb1wed8d0f11c829d57@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9030798113942572083=="

--===============9030798113942572083==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

On 7/13/07, Asif Iqbal <vadud3 at gmail.com> wrote:
>
> OK here is another PCRE issue with IGNORE pattern
>
> I have this on ~hobbit/server/etc/hobbit-clients.cfg
>
> HOST=3Dhost.domain.net
> LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
> IGNORE=3D%Power.*Supply.*0.*NOT.*okay



Is it suppose to be a bug in hobbit?


But I still get alert as following
>
> &red Critical entries in <a href=3D"/hobbit-cgi/bb-hostsvc.sh?CLIENT=3D
> host.domain.net&amp;SECTION=3Dmsgs:/var/adm/messages">/var/adm/messages</a>
> &red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
> Power Supply 0 NOT okay
>
> I did a pcretest and it did match so why is hobbit still alerting?
>
> (hobbit)@hobbit:~/server/etc$ pcretest
> PCRE version 4.5 01-December-2003
>
>   re> "Power.*Supply.*0.*NOT.*okay"
> data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING:
> Power Supply 0 NOT okay
>  0: Power Supply 0 NOT okay
>
>
>
>
>
> On 6/3/07, Giovanni - Gestor Redix <giovanni at redix.com.br<https://mail.g=
oogle.com/mail?view=3Dcm&tf=3D0&to=3Dgiovanni at redix.com.br>> wrote:
> >
> >  Everything ok with your syntax, i just would try removing the
> > double-quotes...
> >
> > BTW, If you need to ignore a phrase that uses spaces, use \s to
> > separate, like the following syntax:
> > LOG blablabla %blablabla IGNORE=3D%one\stwo\swords
> >
> > Another example: IGNORE=3D%one\stwo|other\sword|word
> >
> > Cheers
> >
> > Asif Iqbal wrote:
> >
> > Is this a valid syntax?
> >
> > LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
> > IGNORE=3D%SUNWsrspx|srsxfer
> >
> > I want no alert for lines, in `/var/adm/messages',  that has either or
> > both of these two words
> >
> > SUNWsrspx
> > srsxfer
> >
> > Thanks
> >
> > --
> >
> > Asif Iqbal
> > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
> >
> >
> >
>
>
> --
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>
>
>


--=20
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

--===============9030798113942572083==--


From Dominique.Frise@unil.ch Wed Jun 24 08:15:38 2026
From: Dominique.Frise@unil.ch
To: xymon@xymon.com
Subject: [hobbit] LOG Pattern IGNORE syntax
Date: Wed, 18 Jul 2007 07:33:44 +0200
Message-ID: <469DA638.7090600@unil.ch>
In-Reply-To: <a60f25fc0707172059q276281f1x8bb0a8bf1db27151@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2294781847580842963=="

--===============2294781847580842963==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Asif Iqbal wrote:
> On 7/13/07, *Asif Iqbal* <vadud3 at gmail.com <mailto:vadud3 at gmail.com>>=
 wrote:
>=20
>     OK here is another PCRE issue with IGNORE pattern
>=20
>     I have this on ~hobbit/server/etc/hobbit-clients.cfg
>=20
>     HOST=3D host.domain.net <http://host.domain.net>
>     LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
>     IGNORE=3D%Power.*Supply.*0.*NOT.*okay=20
>=20
>=20
>=20
> Is it suppose to be a bug in hobbit?
>=20
>=20
>     But I still get alert as following
>=20
>     &red Critical entries in <a
>     href=3D"/hobbit-cgi/bb-hostsvc.sh?CLIENT=3Dhost.domain.net&amp;SECTION=
=3Dmsgs:/var/adm/messages">/var/adm/messages</a>
>     &red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
>     WARNING: Power Supply 0 NOT okay
>=20
>     I did a pcretest and it did match so why is hobbit still alerting?
>=20
>     (hobbit)@hobbit:~/server/etc$ pcretest
>     PCRE version 4.5 01-December-2003
>=20
>       re> "Power.*Supply.*0.*NOT.*okay"
>     data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
>     WARNING: Power Supply 0 NOT okay
>      0: Power Supply 0 NOT okay
>=20
>=20
>=20
>=20
>=20
>=20
>     On 6/3/07, *Giovanni - Gestor Redix* < giovanni at redix.com.br
>     <https://mail.google.com/mail?view=3Dcm&tf=3D0&to=3Dgiovanni at redix.c=
om.br>
>      > wrote:
>=20
>         Everything ok with your syntax, i just would try removing the
>         double-quotes...
>=20
>         BTW, If you need to ignore a phrase that uses spaces, use \s to
>         separate, like the following syntax:
>         LOG blablabla %blablabla IGNORE=3D%one\stwo\swords
>=20
>         Another example: IGNORE=3D%one\stwo|other\sword|word
>=20
>         Cheers
>=20
>=20
>         Asif Iqbal wrote:
>>         Is this a valid syntax?
>>
>>         LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
>>         IGNORE=3D%SUNWsrspx|srsxfer
>>
>>         I want no alert for lines, in `/var/adm/messages',  that has
>>         either or both of these two words
>>
>>         SUNWsrspx
>>         srsxfer
>>
>>         Thanks
>>
>>         --=20
>>
>>         Asif Iqbal
>>         PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
>>
>>
>=20
>=20
>=20
>     --=20
>     Asif Iqbal
>     PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
>=20
>=20
>=20
>=20
>=20
> --=20
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
>=20
>=20

%(?-i) tells Hobbit to turn case-sensitive pattern matching on.
This should be used once per rule.
I would write your rules like this:

      HOST=3Dhost.domain.net
      LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
      IGNORE=3D%(?-i)Power\sSupply\s0\sNOT\sokay

      LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
      IGNORE=3D%(?-i)SUNWsrspx|srsxfer


Dominique


--===============2294781847580842963==--


From vadud3@gmail.com Wed Jun 24 08:15:44 2026
From: vadud3@gmail.com
To: xymon@xymon.com
Subject: LOG Pattern IGNORE syntax
Date: Fri, 01 Jun 2007 17:33:56 -0400
Message-ID: <a60f25fc0706011433l2834884n624cb5d192315cb3@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7749376597312687388=="

--===============7749376597312687388==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Is this a valid syntax?

LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
IGNORE=%SUNWsrspx|srsxfer

I want no alert for lines, in `/var/adm/messages',  that has either or both
of these two words

SUNWsrspx
srsxfer

Thanks

-- 

Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

--===============7749376597312687388==--


From giovanni@redix.com.br Wed Jun 24 08:15:44 2026
From: giovanni@redix.com.br
To: xymon@xymon.com
Subject: [hobbit] LOG Pattern IGNORE syntax
Date: Sun, 03 Jun 2007 16:59:22 -0300
Message-ID: <46631D9A.8040308@redix.com.br>
In-Reply-To: <a60f25fc0706011433l2834884n624cb5d192315cb3@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2240252868586539033=="

--===============2240252868586539033==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Everything ok with your syntax, i just would try removing the 
double-quotes...

BTW, If you need to ignore a phrase that uses spaces, use \s to 
separate, like the following syntax:
LOG blablabla %blablabla IGNORE=%one\stwo\swords

Another example: IGNORE=%one\stwo|other\sword|word

Cheers

Asif Iqbal wrote:
> Is this a valid syntax?
>
> LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR" 
> IGNORE=%SUNWsrspx|srsxfer
>
> I want no alert for lines, in `/var/adm/messages',  that has either or 
> both of these two words
>
> SUNWsrspx
> srsxfer
>
> Thanks
>
> -- 
>
> Asif Iqbal
> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>
>
>

--===============2240252868586539033==--