[hobbit] Alerting & IGNORE

I think you have to use metachars instead of spaces if you are using a regex, so try this: LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error IGNORE="%setuid.execution.not.allowed" COLOR=yellow

or even "%setuid.*allowed".

You may also have to put quotes around the previous regex.

-Charles

James Wade wrote:

I can't get the ignore working. Is this syntax wrong:

HOST=sau102

    LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error 

IGNORE="%setuid execution not allowed" COLOR=yellow

Thie above is in the hobbit-clients.cfg file.