[hobbit] msgs - Multiple ignore patterns

Looking at your original regex in pcretest, it should have worked.

PCRE version 4.5 01-December-2003

re> /plugin create statement from userPassword|plugin doing query/ data> plugin create statement from userPassword 0: plugin create statement from userPassword data> pluging create statement from plugin No match data> plugin doing query 0: plugin doing query

Did you wrap your regexp in "" in the file. They don't appear in your snippet below. I'm not sure if that is required or not.

-----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Friday, May 18, 2007 4:06 PM To: hobbit at hswn.dk Subject: Re: [hobbit] msgs - Multiple ignore patterns

Didn't worked... :-(

This syntax work for you ?

Thank you!

Sean Hennessey wrote:

I'd hazard a quess that what your regex is saying is

Plugin create statement from [userPassword or plugin] doing query. Try putting () around the statements.

(Plugin create statement from userPassword)|(plugin doing query). Not sure if you need to escape the ()'s or not.

Sean

-----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Friday, May 18, 2007 1:35 PM To: hobbit at hswn.dk Subject: [hobbit] msgs - Multiple ignore patterns

Hi everyone,

I've applied the all-in-one patch but i still couldn't get multiple 

patterns to work in IGNORE parameter... Here is my configuration:

LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT LOG /var/log/auth.log "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT

Why this regex don't work ? Any idea ?

Thank you all the attention...

Cheers

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk