On 5/14/07, Steve Holmes <sholmes42 at mac.com> wrote:
I may still not be understanding how the pattern matching is done for the LOG keyword.
I have:
LOG /var/adm/messages %(?-i)auth.error COLOR=yellowIGNORE="%(?-i)sshd|flavor_basic: (null)"
Which I think should mean: look for the string "auth.error" in /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic: (null)" in them.
If I *only* have IGNORE=sshd that seems to work, but I really need to ignore both (at least for my testing), but when I do it as above, I get yellow screens for auth.error lines even if they have the string "sshd" in them.
Am I missing something?
BTW, in BB I have a very long list of strings to ignore. Is there an easier way to do that in hobbit other than to put each string into an IGNORE clause?
Thanks, Steve Holmes
Try adding back slashes. IGNORE="%(?-i)sshd|flavor_basic: \(null\)"
$ pcretest PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: (null)/ data> flavor_basic: (null) No match $ pcretest PCRE version 6.7 04-Jul-2006
re> /(?-i)sshd|flavor_basic: \(null\)/ data> flavor_basic: (null) 0: flavor_basic: (null) data> sshd 0: sshd