I've found the quotes to be problematic. Try escaping each space, or truncating the string:
LOG=/var/adm/messages IGNORE=terminal-device\ not\ specifiedby\ login
or
LOG=/var/adm/messages IGNORE=terminal-device.*login
These are a pain....
On 1/06/2013 at 2:04 AM, in message <CAA9hN5MoP-+=BOS7wnjrD06bk7cK7W5fFmbHzG3d_etk_hD4iQ at mail.gmail.com>, Nick Pettefar <Nick at Pettefar.com> wrote:
In the server/etc/analysis.cfg file I have the following:
HOST=ourserver1 LOG=/var/adm/messages IGNORE="%terminal-device not specifiedby login%"
LOG=/var/adm/messages IGNORE="terminal-device not specifiedby login"
I want to ignore messages containing the string "terminal-device not specifiedby login"
May 31 17:22:53 ourserver1 bpjava-msvc[7112]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module. Unfortunately it doesn't work.
From: system user for Xymon Subject: Xymon [214797] ourserver1-ge1:msgs CRITICAL (RED)
red Wed May 29 12:52:59 IST 2013 - System logs NOT ok
&red Critical entries in <a href="/xymon-cgi/svcstatus.sh? CLIENT=ourserver1&SECTION=msgs:/var/adm/messages">/var/adm/messages</a> &red May 29 12:51:56 ourserver1 bpjava-msvc[12541]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module. &red May 29 12:51:56 ourserver1 bpjava-msvc[12541]: [ID 427199 user.error] pam_dial_auth: terminal-device not specifiedby login, returning Error in underlying service module.
<pre> </pre> <pre> </pre> <pre> </pre>
What am I doing wrong?
Regards,
Nick Pettefar
On 4 June 2013 09:35, Phil Crooker <Phil.Crooker at orix.com.au> wrote:
I've found the quotes to be problematic. Try escaping each space, or truncating the string:
I've not used escaping of spaces in this way. But I have used quotes that include the IGNORE= part like so:
LOG=/var/adm/messages "IGNORE=terminal-device not specifiedby login"
LOG=/var/adm/messages IGNORE=terminal-device.*login
This won't work because you are using a regular expression match format ".*" but not specifying that it's a regular expression with a leading percent. This might be what you mean:
LOG=/var/adm/messages IGNORE=%terminal-device.*login
Or, you can replace spaces with the regex whitespace, like so:
LOG=/var/adm/messages IGNORE=%terminal-device\snot\sspecifiedby\slogin
IMHO, the neatest is to enclose the whole "IGNORE=matchstring" in quotes.
J
participants (2)
-
jlaidman＠rebel-it.com.au
-
Phil.Crooker＠orix.com.au