Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellowBut messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellowMessages with "WARNING" AND "warning" (small caps) trigger a yellow status Is this the expected behaviour?
Dominique
Dominique Frise wrote:
Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellowBut messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellowMessages with "WARNING" AND "warning" (small caps) trigger a yellow status Is this the expected behaviour?
Dominique
I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.
John
John Glowacki wrote:
Dominique Frise wrote:
Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellowBut messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellowMessages with "WARNING" AND "warning" (small caps) trigger a yellow status Is this the expected behaviour?
Dominique
I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.
John
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Dominique,
It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.
Example my testing using that setting.
hobbit.clients.cfg: LOG /var/log/messages %(?-i)WARNING yellow LOG /var/log/messages %(?-i)FAILED red
/var/log/messages file: test FAIL 1 test FAILED 1 test fail 1 test failed 1 test WARN 1 test WARNING 1 test warn 1 test warning 1
Web page results: Critical entries in /var/log/messages yellow test WARNING 1 red test FAILED 1
John
On Sun, Apr 23, 2006 at 08:56:25PM -0400, John Glowacki wrote:
It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.
Indeed, yes - that is the way I've coded the string matching.
I didn't know that you could actually embed this into the regex. Thanks for the tip, which I've added to the hobbit-clients.cfg man-page.
Regards, Henrik
John Glowacki wrote:
John Glowacki wrote:
Dominique Frise wrote:
Hi
In hobbit-client.cfg we tried following rule:
LOG %.* WARNING yellowBut messages with "WARNING" never trigger a yellow status.
When we put a regexp like this:
LOG %.* %WARNING yellowMessages with "WARNING" AND "warning" (small caps) trigger a yellow status Is this the expected behaviour?
Dominique
I would hope that is not the expected behavior. But I can confirm that I am having the same. It matched on upper and lower cases.
John
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Dominique,
It seems that pcre is defaulted to caseless matching. Set (?-i) to turn off PCRE_CASELESS. See pcre man pages http://www.pcre.org/pcre.txt.
Example my testing using that setting.
hobbit.clients.cfg: LOG /var/log/messages %(?-i)WARNING yellow LOG /var/log/messages %(?-i)FAILED red
/var/log/messages file: test FAIL 1 test FAILED 1 test fail 1 test failed 1 test WARN 1 test WARNING 1 test warn 1 test warning 1
Web page results: Critical entries in /var/log/messages yellow test WARNING 1 red test FAILED 1
John
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk
Thanks a lot John for this tip, I will try this asap. This means that I have to double check all my DISK/PROC settings because I nead case sensitive matching there to!
Dominique
participants (3)
-
Dominique.Frise＠unil.ch
-
henrik＠hswn.dk
-
johng＠idttechnology.com