regular expressions in analysis.cfg
I'm having a problem with spaces in regular expressions when trying to IGNORE log entries. So for the line:
warning - 2013/03/04 12:52:21 - BigBrotherXymonClient (17) - The agent externals generated this event message : No externals have been specified
works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*17 works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*[0-9]7 works: LOG eventlog_application %^warning COLOR=red IGNORE=Client\ \(17 works: LOG eventlog_application %^warning COLOR=red IGNORE=No\ externals\ have\ been\ specified
doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE=%"Client \([0-9]7" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client \(17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client (17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="No externals have been specified"
Is this correct? If so, why no spaces??? It is very confusing as spaces are used elsewhere, eg I can have spaces in a DISK name in analysis.cfg: DISK "/yada yada" 90 95, and spaces can be used in various places in hosts.cfg.
thanks, Phil
Phil,
You need to put "" around entire IGNORE item - e.g.:
... "IGNORE=%Client \([0-9]7"
This applies for any use of regex in analysis.cfg which uses spaces.
David.
I'm having a problem with spaces in regular expressions when trying to IGNORE log entries. So for the line:
warning - 2013/03/04 12:52:21 - BigBrotherXymonClient (17) - The agent externals generated this event message : No externals have been specified works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*17 works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*[0-9]7 works: LOG eventlog_application %^warning COLOR=red IGNORE=Client\ \(17 works: LOG eventlog_application %^warning COLOR=red IGNORE=No\ externals\ have\ been\ specified
doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE=%"Client \([0-9]7" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client \(17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client (17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="No externals have been specified"
Is this correct? If so, why no spaces??? It is very confusing as spaces are used elsewhere, eg I can have spaces in a DISK name in analysis.cfg: DISK "/yada yada" 90 95, and spaces can be used in various places in hosts.cfg.
thanks, Phil
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
-- David Baldwin - Senior Systems Administrator (Datacentres + Networks) Information and Communication Technology Services Australian Sports Commission http://ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 david.baldwin at ausport.gov.au Leverrier Street Bruce ACT 2617
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au
This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
This works for me:
LOG /var/log/named/named.log "%(critical|general: error:)" COLOR=red "IGNORE=%(zone serial unchanged)"
I think my use of parentheses is superfluous in this example.
On 4 March 2013 17:44, Phil Crooker <Phil.Crooker at orix.com.au> wrote:
I'm having a problem with spaces in regular expressions when trying to IGNORE log entries. So for the line:
warning - 2013/03/04 12:52:21 - BigBrotherXymonClient (17) - The agent externals generated this event message : No externals have been specified
works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*17 works: LOG eventlog_application %^warning COLOR=red IGNORE=%Client.*[0-9]7 works: LOG eventlog_application %^warning COLOR=red IGNORE=Client\ \(17 works: LOG eventlog_application %^warning COLOR=red IGNORE=No\ externals\ have\ been\ specified
doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE=%"Client \([0-9]7" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client \(17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="Client (17" doesn't work: LOG eventlog_application %^warning COLOR=red IGNORE="No externals have been specified"
Is this correct? If so, why no spaces??? It is very confusing as spaces are used elsewhere, eg I can have spaces in a DISK name in analysis.cfg: DISK "/yada yada" 90 95, and spaces can be used in various places in hosts.cfg.
thanks, Phil
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
participants (3)
-
david.baldwin@ausport.gov.au
-
jlaidman@rebel-it.com.au
-
Phil.Crooker@orix.com.au