Re: Help needed on svlogd pattern match

[Rajkumar s <rajkumars910@gmail.com>]

Dear sir,
       Thanks a lot it worked for me after substituted '++' instead of  '+'

Thanks and Regards,
S>Rajkumar

On 12/19/05, Gerrit Pape <pape@smarden.org> wrote:
> On Mon, Dec 19, 2005 at 10:29:50AM +0530, Rajkumar s wrote:
> >          For a quiet sometime we had been using svlogd for log
> > processing, I need some help regarding matching some pattern in the
> > log files and that needs to be logged in seperately in another log
> > file.
> >
> > eg:
> >
> > timestamp rcpt:-:not valid sender
> > timestamp rcpt:+:valid email-id
> > timestamp rcpt:-:not valid recipient
> >
> > I need only the + lines ie., "timestamp rcpt:+:valid email-id" to be
> > logged in seperately
> >
> > The Config file is shown below
> > s100000
> > n5
> > -*
> > +rcpt:+*
> >
> > But this doesn't work , Kindly help me out to log messages seperately.
>
> A plus in the pattern has a special meaning with svlogd, see the man
> page.  You cannot match a single plus character, only one or more.  This
> pattern should work:
>
>  $ mkdir foo
>  $ echo 'ercpt:++:*' >foo/config
>  $ svlogd -tt foo <<EOT
>  rcpt:-:not valid recipient
>  rcpt:+:valid email-id
>  EOT
>  2005-12-19_09:27:29.02106 rcpt:+:valid email-id
>  $ cat foo/current
>  2005-12-19_09:27:29.02102 rcpt:-:not valid recipient
>  2005-12-19_09:27:29.02106 rcpt:+:valid email-id
>  $
>
> Regards, Gerrit.
>