Re: Help needed on svlogd pattern match

[Gerrit Pape <pape@smarden.org>]

On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
>          For a quiet sometime we had been using svlogd for log
> processing, I need some help regarding matching some pattern in the
> log files and that needs to be logged in seperately in another log
> file.
> 
> eg:
> 
> timestamp rcpt:-:not valid sender
> timestamp rcpt:+:valid email-id
> timestamp rcpt:-:not valid recipient
> 
> I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> logged in seperately
> 
> The Config file is shown below
> s100000
> n5
> -*
> +rcpt:+*
> 
> But this doesn't work , Kindly help me out to log messages seperately.

A plus in the pattern has a special meaning with svlogd, see the man
page.  You cannot match a single plus character, only one or more.  This
pattern should work:

 $ mkdir foo
 $ echo 'ercpt:++:*' >foo/config
 $ svlogd -tt foo <<EOT
 rcpt:-:not valid recipient
 rcpt:+:valid email-id
 EOT
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ cat foo/current
 2005-12-19_09:27:29.02102 rcpt:-:not valid recipient
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ 

Regards, Gerrit.