Hi

I want to filter some messages from a specific server's message log. So I built a special rule in hobbit-clients.cfg to filter that message, but it is ignored. It seems Hobbit preferres the DEFAULT section. If I uncomment the DEFAULT LOG rule my special rule is used and the message is filtered.

So how can I have a default rule including some IGNORE clauses which is used for all my servers and an additional set of rule specific to one or more servers.

Here is my hobbit-client.cfg. The rule I currently playing with is marked with (***), it's the host s068c326. If I comment out the last two lines it works, if not the message "ntpd error" is detected as error.

HOST=s068310i DISK %^/platform.* IGNORE

HOST=s068310b DISK %^/platform.* IGNORE

HOST=s068a300 LOG %.* %(fatal|error) COLOR=red IGNORE=%(smb_proc_readdir_long|peer) LOG %.* warning COLOR=yellow

DISK * 10 15

HOST=s068c327 DISK /mnt IGNORE

#HOST=%s068c32.* HOST=s068c326 #HOST=s068c320,s068c321,s068c322,s068c323,s068c324,s068c325,s068c326,s068c327 LOG %.* %(fatal|error) IGNORE=%ntpd COLOR=red #(***)

HOST=s068c320,s068c321,s068c322 PROC "lmgrd -c" 1 1 PROC "pam_lmd" 1 1

DEFAULT # These are the built-in defaults. UP 1h LOAD 5.0 10.0 DISK * 90 95 DISK /media/cdrom 101 101 MEMPHYS 100 101 MEMSWAP 50 80 MEMACT 90 97

    LOG     %.* %(fatal|error)   COLOR=red 

IGNORE=%(read_socket_data|peer) LOG %.* warning COLOR=yellow IGNORE=40960

Thank you for help

Thorsten Erdmann

If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation.