From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/944 Path: news.gmane.org!not-for-mail From: Joshua N Pritikin Newsgroups: gmane.comp.sysutils.supervision.general Subject: Re: svlogd pattern documentation Date: Fri, 9 Dec 2005 23:14:01 +0530 Message-ID: <20051209174401.GN10371@always.joy.eth.net> References: <20051209091830.GM10371@always.joy.eth.net> <20051209143713.17200.qmail@20b2cf8d38a761.315fe32.mid.smarden.org> NNTP-Posting-Host: main.gmane.org Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="qYrsQHciA3Wqs7Iv" X-Trace: sea.gmane.org 1134150227 31183 80.91.229.2 (9 Dec 2005 17:43:47 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Fri, 9 Dec 2005 17:43:47 +0000 (UTC) Original-X-From: supervision-return-1180-gcsg-supervision=m.gmane.org@list.skarnet.org Fri Dec 09 18:43:45 2005 Return-path: Original-Received: from antah.skarnet.org ([212.85.147.14]) by ciao.gmane.org with smtp (Exim 4.43) id 1EkmDC-0000ag-HI for gcsg-supervision@gmane.org; Fri, 09 Dec 2005 18:39:14 +0100 Original-Received: (qmail 1331 invoked by uid 76); 9 Dec 2005 17:39:35 -0000 Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Archive: Original-Received: (qmail 1325 invoked from network); 9 Dec 2005 17:39:35 -0000 Original-To: supervision@list.skarnet.org Content-Disposition: inline In-Reply-To: <20051209143713.17200.qmail@20b2cf8d38a761.315fe32.mid.smarden.org> X-PGP-Key: 06E3 3D22 D307 AAE6 ACB4 6B44 A9CA A794 A4A6 0BBD X-Request-PGP: http://openheartlogic.org/personal/pubkey.asc User-Agent: Mutt/1.5.4i Xref: news.gmane.org gmane.comp.sysutils.supervision.general:944 Archived-At: --qYrsQHciA3Wqs7Iv Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable OK, here is my suggestion for rewriting the man page: svlogd matches a log message against a string pattern. The pattern=20 rules are similar to grep except that svlogd patterns are much simpler than grep regexp. =3D A character not a star (``*'') and not a plus (``+'') matches itself. =3D A plus matches the next character in pattern in the log message one or more times. For example, the pattern +abc matches aaabc. Note that with grep, the same pattern would be written as a+bc. svlogd is different. =3D A star before the end of the pattern matches any string in the log message that does not include the next character in pattern. A star at the end of pattern matches any string. (In perl terminology, the svlogd star works like a non-greedy wildcard match .*?.) An svlogd pattern is not really a regular expression because there is no backtracking. To see what this means, consider a line like this: [Fri Dec 09 06:24:23 2005] [error] [client 84.73.105.43] File does not exis= t: /home/ohl/ohl-v2/htdocs/xmlrpc.php The following pattern doesn't match: -*File does not exist* Why? Because svlogd doesn't backtrack. The star matches up to the first F in Fri then the match fails because i !=3D r. Once the match fails, it fails. To match the line, you can use something like the following pattern instead: -[*] [*] [*] File does not exist: * --qYrsQHciA3Wqs7Iv Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) iD8DBQFDmcJhqcqnlKSmC70RAp0AAJ9FeOTuEtyS5VTYrE6KyamFEgYBtQCfQwBD vZJfveQvhPrMcBqIBflFFdA= =t0JO -----END PGP SIGNATURE----- --qYrsQHciA3Wqs7Iv--