From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/961
Path: news.gmane.org!not-for-mail
From: Gerrit Pape <pape@smarden.org>
Newsgroups: gmane.comp.sysutils.supervision.general
Subject: Re: Help needed on svlogd pattern match
Date: Mon, 19 Dec 2005 10:27:58 +0100
Message-ID: <20051219092758.29772.qmail@d6b977da400810.315fe32.mid.smarden.org>
References: <e69cdf2f0512182059p21265f15t8f0cf40eca879cca@mail.gmail.com>
NNTP-Posting-Host: main.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: sea.gmane.org 1134984551 7701 80.91.229.2 (19 Dec 2005 09:29:11 GMT)
X-Complaints-To: usenet@sea.gmane.org
NNTP-Posting-Date: Mon, 19 Dec 2005 09:29:11 +0000 (UTC)
Original-X-From: supervision-return-1197-gcsg-supervision=m.gmane.org@list.skarnet.org Mon Dec 19 10:29:04 2005
Return-path: <supervision-return-1197-gcsg-supervision=m.gmane.org@list.skarnet.org>
Original-Received: from antah.skarnet.org ([212.85.147.14])
	by ciao.gmane.org with smtp (Exim 4.43)
	id 1EoHIw-00030W-Tn
	for gcsg-supervision@gmane.org; Mon, 19 Dec 2005 10:27:39 +0100
Original-Received: (qmail 9464 invoked by uid 76); 19 Dec 2005 09:28:00 -0000
Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm
List-Post: <mailto:supervision@list.skarnet.org>
List-Help: <mailto:supervision-help@list.skarnet.org>
List-Unsubscribe: <mailto:supervision-unsubscribe@list.skarnet.org>
List-Subscribe: <mailto:supervision-subscribe@list.skarnet.org>
List-Archive: <http://www.skarnet.org/lists/>
Original-Received: (qmail 9459 invoked from network); 19 Dec 2005 09:28:00 -0000
Original-To: supervision@list.skarnet.org
Mail-Followup-To: supervision@list.skarnet.org
Content-Disposition: inline
In-Reply-To: <e69cdf2f0512182059p21265f15t8f0cf40eca879cca@mail.gmail.com>
Xref: news.gmane.org gmane.comp.sysutils.supervision.general:961
Archived-At: <http://permalink.gmane.org/gmane.comp.sysutils.supervision.general/961>

On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
>          For a quiet sometime we had been using svlogd for log
> processing, I need some help regarding matching some pattern in the
> log files and that needs to be logged in seperately in another log
> file.
> 
> eg:
> 
> timestamp rcpt:-:not valid sender
> timestamp rcpt:+:valid email-id
> timestamp rcpt:-:not valid recipient
> 
> I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> logged in seperately
> 
> The Config file is shown below
> s100000
> n5
> -*
> +rcpt:+*
> 
> But this doesn't work , Kindly help me out to log messages seperately.

A plus in the pattern has a special meaning with svlogd, see the man
page.  You cannot match a single plus character, only one or more.  This
pattern should work:

 $ mkdir foo
 $ echo 'ercpt:++:*' >foo/config
 $ svlogd -tt foo <<EOT
 rcpt:-:not valid recipient
 rcpt:+:valid email-id
 EOT
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ cat foo/current
 2005-12-19_09:27:29.02102 rcpt:-:not valid recipient
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ 

Regards, Gerrit.