svlogd config Epattern

svlogd config Epattern

[Vladimir Smelhaus]

Hi,

I am trying to configure notifications from svlogd but I am not able
how to persuade it to mail me only messages that I want.

When I want to have e-mailed all, say error, messages it is easy. But
when  I want all error messages except one or two it does not work as I
expect.

e*.err: *
E*.err: First text
E*.err: Second text

Please, can someone tell me what is the proper notation? Or is this
possible? I think that eE should work similarly as +- for logging.

Regards, Vlada

Re: svlogd config Epattern

[Gerrit Pape]

On Sat, Oct 16, 2004 at 11:59:25PM +0200, Vladimir Smelhaus wrote:
> I am trying to configure notifications from svlogd but I am not able
> how to persuade it to mail me only messages that I want.
> 
> When I want to have e-mailed all, say error, messages it is easy. But
> when  I want all error messages except one or two it does not work as I
> expect.
> 
> e*.err: *
> E*.err: First text
> E*.err: Second text
> 
> Please, can someone tell me what is the proper notation? Or is this
> possible? I think that eE should work similarly as +- for logging.

I agree that it should work just like +-, each line deselected
initially.  But currently eE lines are interpreted separately; if a
pattern matches, the line is printed to stderr immediately, see
svlogd(8).  Unfortunately this should not change in version 1.0.x.

Thanks, Gerrit.

Re: svlogd config Epattern

[Vladimir Smelhaus]

Gerrit Pape wrote:

>>e*.err: *
>>E*.err: First text
>>E*.err: Second text
>>
>>possible? I think that eE should work similarly as +- for logging.
> 
> I agree that it should work just like +-, each line deselected
> initially.  But currently eE lines are interpreted separately; if a
> pattern matches, the line is printed to stderr immediately, see
> svlogd(8).  Unfortunately this should not change in version 1.0.x.

It is possible to fix it up by something like this:

cat /etc/socklog/notify/run
  #!/bin/sh -e
  PIPE=/var/log/socklog/.notify
  if [ ! -p "$PIPE" ]; then mkfifo -m0620 "$PIPE"; chown log:adm "$PIPE"; fi
  exec <> "$PIPE"
  exec setuidgid log uncat -s49999 -t90 \
    sh -c 'grep -vf /etc/socklog/notify/unwanted-patterns | mail -e -s 
socklog-notify root'

Regards, Vlada