On Fri, Apr 13, 2012 at 4:36 AM, Don Kuhlman <Don.Kuhlman at schawk.com> wrote:
It was: PORT STATE=LISTENING LOCAL=1433 MIN=1 Test=SQLServer
I changed it to:PORT STATE=LISTENING LOCAL=%.:$ MIN=1 TEXT=SQLServer Listener and it seems to be working now for the 1433 port. Maybe I had the "LOCAL=1433" syntax wrong for the analysis.
Correct. The man page defines the "LOCAL" parameter as "local address specification in the format used on the output from netstat." So you're trying to match a string in "address:port" format, rather than just a port number.
You could instead have used "0.0.0.0:1433", but the regular expression form (starting with "%") has the advantage of matching both IPv4 and IPv6 sockets. Your status is probably saying "found 2, req. 1 or more" - once for IPv4 and once for IPv6.
J