Thanks for the hint. I'm still having a little trouble getting it to do what I want, but at least no I know about pcretest, which I didn't before.
Thanks, Steve.
On 5/14/07, John G <jg2727 at gmail.com> wrote:
On 5/14/07, Steve Holmes <sholmes42 at mac.com> wrote:
I may still not be understanding how the pattern matching is done for the LOG keyword.
I have:
LOG /var/adm/messages %(?-i)auth.error COLOR=yellowIGNORE="%(?-i)sshd|flavor_basic: (null)"
Which I think should mean: look for the string "auth.error" in /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic: (null)" in them.
If I *only* have IGNORE=sshd that seems to work, but I really need to ignore both (at least for my testing), but when I do it as above, I get yellow screens for auth.error lines even if they have the string "sshd" in them.
Am I missing something?
BTW, in BB I have a very long list of strings to ignore. Is there an easier way to do that in hobbit other than to put each string into an IGNORE clause?
Thanks, Steve Holmes
Try adding back slashes. IGNORE="%(?-i)sshd|flavor_basic: \(null\)"
$ pcretest PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: (null)/ data> flavor_basic: (null) No match $ pcretest PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: \(null\)/ data> flavor_basic: (null) 0: flavor_basic: (null) data> sshd 0: sshd
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
-- I believe I found the missing link between animal and civilized man. It is us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)
We in America do not have government by the majority. We have government by the majority who participate. -Thomas Jefferson, third US president, architect and author (1743-1826)