thorsten.erdmann at daimler.com wrote:
Hi
I have some difficulties to ignore some messages using the hobbit-client.cfg file.
I want to ignore all messages that contain the word "smb_proc_readdir_long".
So I build such rule:
HOST=s068a300 LOG %.* %(fatal|error) COLOR=red
IGNORE=smb_proc_readdir_long LOG %.* warning COLOR=yellowI also tried IGNORE=%smb...
If I write a message to /var/log/user like this:
logger -p daemon.notice Testmessage ERROR smb_proc_readdir_long
the message is not ignored by Hobbit:
System logs at Fri Sep 4 11:08:39 CEST 2009
Critical entries in /var/log/messages .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR smb_proc_readdir_long .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR smb_proc_readdir_long
Another question: if I have many IGNOREs, can I put them on multiple lines for readability like this:
HOST=s068a300 LOG %.* %(fatal|error) COLOR=red
IGNORE=smb_proc_readdir_long IGNORE=blabla IGNORE=nonsense LOG %.* warning COLOR=yellowThorsten Erdmann
If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation.
It's not obvious to me why it is not working. You might try to work around the issue but using the "ignore" pattern in the client-local.cfg configuration for the host or class, and not doing it in the hobbit-clients config.
For the second, I do not believe multiple IGNORE keywords are accepted. You can use a pattern match for this, like: IGNORE=%(this thing|that thing) Or, I think multiple "ignore" patterns (lines) /is/ allowed for a log entry in client-local.
HTH. -Alan