Help needed on svlogd pattern match

Help needed on svlogd pattern match

[Rajkumar s]

Dear sir,
         For a quiet sometime we had been using svlogd for log
processing, I need some help regarding matching some pattern in the
log files and that needs to be logged in seperately in another log
file.

eg:

timestamp rcpt:-:not valid sender
timestamp rcpt:+:valid email-id
timestamp rcpt:-:not valid recipient

I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
logged in seperately

The Config file is shown below
s100000
n5
-*
+rcpt:+*

But this doesn't work , Kindly help me out to log messages seperately.

Regards,
S>Rajkumar

Re: Help needed on svlogd pattern match

[Rafal Bisingier]

[-- Attachment #1: Type: text/plain, Size: 718 bytes --]

Hi,

On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
> Dear sir,
>          For a quiet sometime we had been using svlogd for log
> processing, I need some help regarding matching some pattern in the
> log files and that needs to be logged in seperately in another log
> file.
> 
> eg:
> 
> timestamp rcpt:-:not valid sender
> timestamp rcpt:+:valid email-id
> timestamp rcpt:-:not valid recipient
> 
> I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> logged in seperately
> 
> The Config file is shown below
> s100000
> n5
> -*
> +rcpt:+*
> 
> But this doesn't work , Kindly help me out to log messages seperately.

Try:
+*rcpt:+*

-- 
Rafal Bisingier

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Help needed on svlogd pattern match

[Gerrit Pape]

On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
>          For a quiet sometime we had been using svlogd for log
> processing, I need some help regarding matching some pattern in the
> log files and that needs to be logged in seperately in another log
> file.
> 
> eg:
> 
> timestamp rcpt:-:not valid sender
> timestamp rcpt:+:valid email-id
> timestamp rcpt:-:not valid recipient
> 
> I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> logged in seperately
> 
> The Config file is shown below
> s100000
> n5
> -*
> +rcpt:+*
> 
> But this doesn't work , Kindly help me out to log messages seperately.

A plus in the pattern has a special meaning with svlogd, see the man
page.  You cannot match a single plus character, only one or more.  This
pattern should work:

 $ mkdir foo
 $ echo 'ercpt:++:*' >foo/config
 $ svlogd -tt foo <<EOT
 rcpt:-:not valid recipient
 rcpt:+:valid email-id
 EOT
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ cat foo/current
 2005-12-19_09:27:29.02102 rcpt:-:not valid recipient
 2005-12-19_09:27:29.02106 rcpt:+:valid email-id
 $ 

Regards, Gerrit.

Re: Help needed on svlogd pattern match

[Rajkumar s]

Dear sir,
       Thanks a lot it worked for me after substituted '++' instead of  '+'

Thanks and Regards,
S>Rajkumar

On 12/19/05, Gerrit Pape <pape@smarden.org> wrote:
> On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
> >          For a quiet sometime we had been using svlogd for log
> > processing, I need some help regarding matching some pattern in the
> > log files and that needs to be logged in seperately in another log
> > file.
> >
> > eg:
> >
> > timestamp rcpt:-:not valid sender
> > timestamp rcpt:+:valid email-id
> > timestamp rcpt:-:not valid recipient
> >
> > I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> > logged in seperately
> >
> > The Config file is shown below
> > s100000
> > n5
> > -*
> > +rcpt:+*
> >
> > But this doesn't work , Kindly help me out to log messages seperately.
>
> A plus in the pattern has a special meaning with svlogd, see the man
> page.  You cannot match a single plus character, only one or more.  This
> pattern should work:
>
>  $ mkdir foo
>  $ echo 'ercpt:++:*' >foo/config
>  $ svlogd -tt foo <<EOT
>  rcpt:-:not valid recipient
>  rcpt:+:valid email-id
>  EOT
>  2005-12-19_09:27:29.02106 rcpt:+:valid email-id
>  $ cat foo/current
>  2005-12-19_09:27:29.02102 rcpt:-:not valid recipient
>  2005-12-19_09:27:29.02106 rcpt:+:valid email-id
>  $
>
> Regards, Gerrit.
>

Re: Help needed on svlogd pattern match

[pauld]

Hi there,
sorry to bug a whole mailing list like this, but you should know that 
the subscriber Paul Dorman (pauld@cwa.co.nz) is no longer here. I don't 
have any password to unsubscribe him from your mailing list.

Please remove him if possible.

Thanks

Rajkumar s wrote:
> Dear sir,
>          For a quiet sometime we had been using svlogd for log
> processing, I need some help regarding matching some pattern in the
> log files and that needs to be logged in seperately in another log
> file.
> 
> eg:
> 
> timestamp rcpt:-:not valid sender
> timestamp rcpt:+:valid email-id
> timestamp rcpt:-:not valid recipient
> 
> I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> logged in seperately
> 
> The Config file is shown below
> s100000
> n5
> -*
> +rcpt:+*
> 
> But this doesn't work , Kindly help me out to log messages seperately.
> 
> Regards,
> S>Rajkumar