30 Oct
2007
30 Oct
'07
11:45 a.m.
On Tue, Oct 30, 2007 at 05:17:10PM +0800, Geng Hu wrote:
In hobbit-clients.cfg LOG configuration, I want to catch critical event lines, which have the keyword "EventID" and either keyword of failed, failure or error. Looks this line doesn't work, any idea please?
LOG /var/log/messages %EventID.*(failed|failure|error)
It would help if you could show us some of the actual lines from the logfile that you would expect this to catch.
Henrik