Hi,

We have following rule in hobbit-clients.cfg:

LOG /var/log/messages MATCH=%(?-i)Redundancy\slost|degraded|error|Error COLOR=red IGNORE=%(?-i)webmail.exe.*segfault\sat|register_security|asking\sfor\scache\sdata|Outstream\sdata\sxfer\serror|cdrom|pam_ldap:\serror\strying\sto\sbind\sas HOST=zeb1,zeb2

According to this, the line "Jan 29 21:05:52 zeb2 kernel: webmail.exe[30786]: segfault at 000000009980e286 rip 000000009980e286 rsp 00000000ffff8800 error 14" in /var/log/messages of host zeb2 should NOT raise a red alert (IGNORE) but it does :-(

The pcre test shows correct matching:

[bb at iris etc]$ pcretest PCRE version 4.5 01-December-2003

re> /(?-i)webmail.exe.*segfault\sat|register_security|asking\sfor\scache\sdata|Outstream\sdata\sxfer\serror|cdrom|pam_ldap:\serror\strying\sto\sbind\sas/ data> Jan 29 21:05:52 zeb2 kernel: webmail.exe[30786]: segfault at 000000009980e286 rip 000000009980e286 rsp 00000000ffff8800 error 14 0: webmail.exe[30786]: segfault at data>

Does anybody see anything wrong?

Dominique UNIL - University of Lausanne