Betsy
Multiple "ignore" lines are permitted, and they accumulate. The ignore string must be a regular expression, so the "%" must be left out, unless you want to match a percent character. Also, if a space is in the string to match, the expression should not be enclosed in quotes, and the space should simply be included literally, or replaced with a "\s" or similar. There is an implied ".*" at start and end, so for example "MARK" matches anywhere in a log line.
The code that compiles the regexps sets the REG_EXTENDED and REG_ICASE (ignore case) flags, so bear this in mind when matching.
In your case, I think the following should work:
ignore nslcd ignore MARK ignore be2net
Or you could do this:
ignore nslcd|MARK|be2net
If you want to test out your own expressions with a test cycle that's less than 10 minutes, create a file /tmp/config containing just the "log:" and "ignore" lines, and then run the following as the xymon user:
rm -f /tmp/status && logfetch /tmp/config /tmp/status
Then re-run it after editing the "/tmp/config" file, to see the changes.
J
On 18 December 2012 04:12, Betsy Schwartz <betsy.schwartz at gmail.com> wrote:
Can I say for example
[linux] log:/var/log/messages:102400 ignore nslcd ignore MARK ignore %.*be2net.*
or do those all have to be one regexp?
(and can I say "ignore nslcd" or does it have to be "ignore %.*nslcd.* " ?
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon