On Wed, Jul 12, 2006 at 10:19:35PM -0500, Brodie, Kent wrote:
I'm not sure I understand the docs here... is something like this correct?
[snip]
HOST=lp4.phys.mcw.edu IGNORE
Looks right, this will drop all alerts for this host.
##HOST=%^pr*.hmgc.mcw.edu
IGNORE
I know you commented this out, but I just want to say that you've probably hit one of the common "gotchas" in regular expressions: If you want to match "anything", you must use ".*" - not just "*". So to match any hostname beginning with "pr" and ending in ".hmgc.mcw.edu" you would use HOST=%^pr.*.hmgc.mcw.edu or if you want to be really picky (because the dots in ".hmgc.mcw.edu" will really match any character: HOST=%^pr.*\.hmgc\.mcw\.edu
The "*" in a reg. exp. means "zero or more occurrences of the previous". So "pr*" will match "p" (zero r's), as well as "pr", "prr", "prrr", "prrrrrrrr" etc.
Regards, Henrik