Re: svlogd pattern documentation

[Joshua N Pritikin <jpritikin@pobox.com>]

[-- Attachment #1: Type: text/plain, Size: 1402 bytes --]

OK, here is my suggestion for rewriting the man page:

svlogd matches a log message against a string pattern. The pattern 
rules are similar to grep except that svlogd patterns are much simpler
than grep regexp.

= A character not a star  (``*'') and not a plus (``+'')  matches
itself.

= A  plus matches  the  next character in pattern in the log message one
or more times.  For example, the pattern +abc matches aaabc. Note that
with grep, the same pattern would be written as a+bc.  svlogd is
different.

= A  star  before  the  end  of the pattern matches  any string  in  the
log  message  that does not include the next character in pattern.  A
star at the  end of pattern matches any string. (In perl terminology,
the svlogd star works like a non-greedy wildcard match .*?.)

An svlogd pattern is not really a regular expression because there is
no backtracking.  To see what this means, consider a line like this:

[Fri Dec 09 06:24:23 2005] [error] [client 84.73.105.43] File does not exist: /home/ohl/ohl-v2/htdocs/xmlrpc.php

The following pattern doesn't match:

-*File does not exist*

Why?  Because svlogd doesn't backtrack.  The star matches up to the
first F in Fri then the match fails because i != r.  Once the match
fails, it fails.  To match the line, you can use something like the
following pattern instead:

-[*] [*] [*] File does not exist: *

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]