28 Aug
2006
28 Aug
'06
4:42 p.m.
On Mon, Aug 28, 2006 at 11:08:20AM -0400, Jerry Yu wrote:
Question, which takes precedence, if a line matches both IGNORE and the alert string/reg. One line of particular interests to me is the SELinux's pts relabeling warning in /var/log/messages, which is harmless but annoying. I am on 4.2-RC1-20060712 and have seen such a log line causing this log test to go red.
In 'hobbit-clients.cfg', I have log /var/log/messages %WARNING|NOTICE|ERROR IGNORE=relabeling
The offending log lines goes line: Jul 30 18:22:25 SRV01 su[31747]: Warning! Could not relabel /dev/pts/0 with user_u:object_r:devpts_t, not relabeling.Operation not permitted
IGNORE takes precedence over the matching rule. So this line would not trigger an error status.
Regards, Henrik