Didn't worked... :-(

This syntax work for you ?

Thank you!

Sean Hennessey wrote:

I'd hazard a quess that what your regex is saying is

Plugin create statement from [userPassword or plugin] doing query. Try putting () around the statements.

(Plugin create statement from userPassword)|(plugin doing query). Not sure if you need to escape the ()'s or not.

Sean

-----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Friday, May 18, 2007 1:35 PM To: hobbit at hswn.dk Subject: [hobbit] msgs - Multiple ignore patterns

Hi everyone,

I've applied the all-in-one patch but i still couldn't get multiple 

patterns to work in IGNORE parameter... Here is my configuration:

LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT LOG /var/log/auth.log "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT

Why this regex don't work ? Any idea ?

Thank you all the attention...

Cheers

I have been having similar problem. RE which pcretest says will work don't. I've tried with and without quotes, etc. I believe that the RE processing within hobbit is buggy. I haven't had time to track down where that is handled in the code, but would like to look at it if I can find it (hint, if you know where to look let me know). I'm assuming that hobbit is munging the RE before handing it off to PCRE. If not why would pcretest pass the RE and then it not work within hobbit.

Steve Holmes

On 5/18/07, Sean Hennessey <sean.hennessey1 at verizonbusiness.com> wrote:

Looking at your original regex in pcretest, it should have worked.

PCRE version 4.5 01-December-2003

re> /plugin create statement from userPassword|plugin doing query/ data> plugin create statement from userPassword 0: plugin create statement from userPassword data> pluging create statement from plugin No match data> plugin doing query 0: plugin doing query

Did you wrap your regexp in "" in the file. They don't appear in your snippet below. I'm not sure if that is required or not.

-----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Friday, May 18, 2007 4:06 PM To: hobbit at hswn.dk Subject: Re: [hobbit] msgs - Multiple ignore patterns

Didn't worked... :-(

This syntax work for you ?

Thank you!

Sean Hennessey wrote:

...

I'd hazard a quess that what your regex is saying is

Plugin create statement from [userPassword or plugin] doing query. Try putting () around the statements.

(Plugin create statement from userPassword)|(plugin doing query). Not sure if you need to escape the ()'s or not.

Sean

-----Original Message----- From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br] Sent: Friday, May 18, 2007 1:35 PM To: hobbit at hswn.dk Subject: [hobbit] msgs - Multiple ignore patterns

Hi everyone,

I've applied the all-in-one patch but i still couldn't get multiple

patterns to work in IGNORE parameter... Here is my configuration:

LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT LOG /var/log/auth.log "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso" COLOR=red IGNORE=%plugin create statement from userPassword|plugin doing query SELECT

Why this regex don't work ? Any idea ?

Thank you all the attention...

Cheers

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

-- Lots of people think they're charitable if they give away their old clothes and things they don't want. It isn't charity to give away things you want to get rid of and it isn't a sacrifice to do things you don't mind doing. -Myrtle Reed, author (1874-1911)

Hi Charles!

How do you work with this limitation ? Any workaround ?

Cheers

Charles Jones wrote:

I had similar RE issues with hobbit-alerts.cfg. I reported it several times but never got any response.

-Charles

Steve Holmes wrote:

...

I have been having similar problem. RE which pcretest says will work don't. I've tried with and without quotes, etc. I believe that the RE processing within hobbit is buggy. I haven't had time to track down where that is handled in the code, but would like to look at it if I can find it (hint, if you know where to look let me know). I'm assuming that hobbit is munging the RE before handing it off to PCRE. If not why would pcretest pass the RE and then it not work within hobbit.

Steve Holmes

On 5/18/07, *Sean Hennessey* <sean.hennessey1 at verizonbusiness.com <mailto:sean.hennessey1 at verizonbusiness.com>> wrote:

Looking at your original regex in pcretest, it should have worked.

PCRE version 4.5 01-December-2003

  re> /plugin create statement from userPassword|plugin doing query/
data> plugin create statement from userPassword
0: plugin create statement from userPassword
data> pluging create statement from plugin
No match
data> plugin doing query
0: plugin doing query

Did you wrap your regexp in "" in the file. They don't appear in your
snippet below. I'm not sure if that is required or not.

-----Original Message-----
From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
<mailto:giovanni at redix.com.br>]
Sent: Friday, May 18, 2007 4:06 PM
To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
Subject: Re: [hobbit] msgs - Multiple ignore patterns

Didn't worked... :-(

This syntax work for you ?

Thank you!


Sean Hennessey wrote:
> I'd hazard a quess that what your regex is saying is
>
> Plugin create statement from [userPassword or plugin] doing
query. Try
> putting () around the statements.
>
> (Plugin create statement from userPassword)|(plugin doing
query). Not sure
> if you need to escape the ()'s or not.
>
> Sean
>
> -----Original Message-----
> From: Giovanni - Gestor Redix [mailto:giovanni at redix.com.br
<mailto:giovanni at redix.com.br> ]
> Sent: Friday, May 18, 2007 1:35 PM
> To: hobbit at hswn.dk <mailto:hobbit at hswn.dk>
> Subject: [hobbit] msgs - Multiple ignore patterns
>
> Hi everyone,
>
>     I've applied the all-in-one patch but i still couldn't get
multiple
> patterns to work in IGNORE parameter... Here is my configuration:
>
> LOG /var/log/syslog "%password|error|fail|changed|tcpd|Accepted"
> COLOR=red IGNORE=%plugin create statement from
userPassword|plugin doing
> query SELECT
> LOG /var/log/auth.log
> "%password|error|fail|changed|tcpd|Accepted|jovial|tenebroso"
COLOR=red
> IGNORE=%plugin create statement from userPassword|plugin doing
query
SELECT
>
>     Why this regex don't work ? Any idea ?
>
>     Thank you all the attention...
>
>     Cheers
>
>

To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>





To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk <mailto:hobbit-unsubscribe at hswn.dk>

-- Lots of people think they're charitable if they give away their old clothes and things they don't want. It isn't charity to give away things you want to get rid of and it isn't a sacrifice to do things you don't mind doing. -Myrtle Reed, author (1874-1911)