On Fri, Aug 11, 2006 at 01:37:28PM -0400, Gary B. wrote:
Hmm. Any ideas why the following wouldn't work?
log:/var/log/messages:10240 ignore upsd* Client|Connection 127.0.0.1 ignore session opened|closed for user mailman|root
Two errors:
The first line has a wrong regex - it's a classic mistake to use "*" by itself to mean "anything", but that's not what it does. Your expression should be ignore upsd.* Client|Connection 127.0.0.1
Second, you can only have one "ignore" line. I admit that it would probably be useful to have multiple ignore lines, but that is not possible right now.
The "full log" output is still showing those lines. Could it be the same reason I wasn't seeing any data at all on the other servers; that is, the log file just hasn't been updated, and it's still showing those from previous lines?
No, Hobbit processes all of the logfile data through the ignore- and trigger patterns each time it sends a message to the server.
If so, is there a way I could tell Hobbit to clear the existing data?
Yes: Delete the ~hobbit/client/tmp/logfetch.HOSTNAME.status file.
Regards, Henrik