Betsy
On 12 September 2014 13:00, Betsy Schwartz <betsy.schwartz at gmail.com> wrote:
I've been playing around with variations like log:/appdata/logserver/local7.log:102400 IGNORE (apcontroller|cli.WARNING|cli.NOTICE) or log:/appdata/logserver/local7.log:102400 IGNORE apcontroller|cli.WARNING|cli.NOTICE or log:/appdata/logserver/local7.log:102400 IGNORE= (apcontroller|cli.WARNING|cli.NOTICE) or
None of those is going to work because you're using PCREs but you haven't told Xymon that they're PCREs with the percent.
log:/appdata/logserver/local7.log:102400 IGNORE=%(?-i)apcontroller|cli.WARNING|cli.NOTICE
This should work. I tested it with pcregrep against your log message and it matched, meaning it should have ignored it.
and even log:/appdata/logserver/local7.log:102400 IGNORE apcontroller
I would expect this to work too, but the man page for client-local.cfg says that the pattern "is a regular expression" and so it might not match this without the "%". Have you tried just "IGNORE %apcontroller"?
Please, what is the syntax I need for this? Or is this a problem because it's a complicated line containing so many special sorts of characters?
This shouldn't matter. It might, but it shouldn't.
J