Thanks, Craig. I'm going to try this trick. But even single words aren't working reliably for me. Steve Holmes
On 5/24/07, Dominique Frise <Dominique.Frise at unil.ch> wrote:
Craig Cook wrote:
While we are asking questions about the pcre handling...
Has anyone managed to use a rule with spaces?
ie.
LOG /var/log/syslog "%disk full" COLOR=red
I have tried using quotes, escaping quotes, escaping spaces, etc. Nothing has worked. Reduced to individual words to get something working.
Craig Cook
Systems Monitoring Consulting and Support Services http://www.cookitservices.com
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Spaces should work but we use \s to represent spaces.
Example:
LOG /var/adm/messages.da %(?-i)Fail|fail|On\sbattery|AC\sline\sfault|Replace\sbattery|Battery\snot COLOR=yellow
The (?-i) tells pcre to turn case-sensitive pattern matching on.
Dominique UNIL - University of Lausanne
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
-- Lots of people think they're charitable if they give away their old clothes and things they don't want. It isn't charity to give away things you want to get rid of and it isn't a sacrifice to do things you don't mind doing. -Myrtle Reed, author (1874-1911)