OK here is another PCRE issue with IGNORE pattern

I have this on ~hobbit/server/etc/hobbit-clients.cfg

HOST=host.domain.net LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR" IGNORE=%Power.*Supply.*0.*NOT.*okay

But I still get alert as following

&red Critical entries in <a href="/hobbit-cgi/bb-hostsvc.sh?CLIENT= host.domain.net&SECTION=msgs:/var/adm/messages">/var/adm/messages</a> &red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING: Power Supply 0 NOT okay

I did a pcretest and it did match so why is hobbit still alerting?

(hobbit)@hobbit:~/server/etc$ pcretest PCRE version 4.5 01-December-2003

re> "Power.*Supply.*0.*NOT.*okay" data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning] WARNING: Power Supply 0 NOT okay 0: Power Supply 0 NOT okay

On 6/3/07, Giovanni - Gestor Redix <giovanni at redix.com.br> wrote:

Everything ok with your syntax, i just would try removing the double-quotes...

BTW, If you need to ignore a phrase that uses spaces, use \s to separate, like the following syntax: LOG blablabla %blablabla IGNORE=%one\stwo\swords

Another example: IGNORE=%one\stwo|other\sword|word

Cheers

Asif Iqbal wrote:

Is this a valid syntax?

LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR" IGNORE=%SUNWsrspx|srsxfer

I want no alert for lines, in `/var/adm/messages', that has either or both of these two words

SUNWsrspx srsxfer

Thanks

--

Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

-- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Asif Iqbal wrote:

On 7/13/07, *Asif Iqbal* <vadud3 at gmail.com <mailto:vadud3 at gmail.com>> wrote:

OK here is another PCRE issue with IGNORE pattern

I have this on ~hobbit/server/etc/hobbit-clients.cfg

HOST= host.domain.net <http://host.domain.net>
LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
IGNORE=%Power.*Supply.*0.*NOT.*okay 

Is it suppose to be a bug in hobbit?

But I still get alert as following

&red Critical entries in <a
href="/hobbit-cgi/bb-hostsvc.sh?CLIENT=host.domain.net&SECTION=msgs:/var/adm/messages">/var/adm/messages</a>
&red Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
WARNING: Power Supply 0 NOT okay

I did a pcretest and it did match so why is hobbit still alerting?

(hobbit)@hobbit:~/server/etc$ pcretest
PCRE version 4.5 01-December-2003

  re> "Power.*Supply.*0.*NOT.*okay"
data> Jul 13 15:04:34 host envctrltwo: [ID 771032 kern.warning]
WARNING: Power Supply 0 NOT okay
 0: Power Supply 0 NOT okay






On 6/3/07, *Giovanni - Gestor Redix* < giovanni at redix.com.br
<https://mail.google.com/mail?view=cm&tf=0&to=giovanni at redix.com.br>
 > wrote:

    Everything ok with your syntax, i just would try removing the
    double-quotes...

    BTW, If you need to ignore a phrase that uses spaces, use \s to
    separate, like the following syntax:
    LOG blablabla %blablabla IGNORE=%one\stwo\swords

    Another example: IGNORE=%one\stwo|other\sword|word

    Cheers


    Asif Iqbal wrote:

...

    Is this a valid syntax?

    LOG /var/adm/messages "%(?-i)WARNING|(?-i)NOTICE|(?-i)ERROR"
    IGNORE=%SUNWsrspx|srsxfer

    I want no alert for lines, in `/var/adm/messages',  that has
    either or both of these two words

    SUNWsrspx
    srsxfer

    Thanks

    -- 

    Asif Iqbal
    PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>

-- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu <http://pgp.mit.edu>

%(?-i) tells Hobbit to turn case-sensitive pattern matching on. This should be used once per rule. I would write your rules like this:

  HOST=host.domain.net
  LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
  IGNORE=%(?-i)Power\sSupply\s0\sNOT\sokay

  LOG /var/adm/messages %(?-i)WARNING|NOTICE|ERROR
  IGNORE=%(?-i)SUNWsrspx|srsxfer

Dominique