John Glowacki wrote:
John Glowacki wrote:
Dominique Frise wrote:
Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellowBut messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellowMessages with "WARNING" AND "warning" (small caps) trigger a yellow status Is this the expected behaviour?
Dominique
I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.
John
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Dominique,
It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.
Example my testing using that setting.
hobbit.clients.cfg: LOG /var/log/messages %(?-i)WARNING yellow LOG /var/log/messages %(?-i)FAILED red
/var/log/messages file: test FAIL 1 test FAILED 1 test fail 1 test failed 1 test WARN 1 test WARNING 1 test warn 1 test warning 1
Web page results: Critical entries in /var/log/messages yellow test WARNING 1 red test FAILED 1
John
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Thanks a lot John for this tip, I will try this asap. This means that I have to double check all my DISK/PROC settings because I nead case sensitive matching there to!
Dominique