[osiris] Filters not working

[Michael Menge]

Hi,

i don't mark the beginning and end of a line with ^.* and .*$

   Michael

Quoting Hari Sekhon <hpsekhon at googlemail.com>:

> I am trying to use filters to reduce noise but it doesn't seem to be
> working. I have for example filters like:
>
> ^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow
> Copy;status:running][service:VSS;dname:Volume Shadow
> Copy;status:stopped].*$
> ^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow
> Copy;status:stopped][service:VSS;dname:Volume Shadow
> Copy;status:running].*$
> ^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
> Copy Provider;status:stopped].*$
> ^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
> Copy Provider;status:running].*$
>
> To try to stop it reporting changes in service state for Volume Shadow
> Copy on the Windows servers running the osirisd agent.
>
> However, I still get emails like this, several days after implementing
> this filter:
>
> [223][SERVER_X][cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow  
>  Copy;status:stopped][service:VSS;dname:Volume Shadow   
> Copy;status:running]
> [223][SERVER_X][cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft  
>  Software Shadow Copy   
> Provider;status:stopped][service:swprv;dname:Microsoft Software   
> Shadow Copy Provider;status:running]
>
>
> This is the sole content of the email, the only change in state to the
> server, so the filters are obvious not working.
>
> It seems that the filters also get squashed into a single line on the
> filters file like so
>
> # add regular expressions, one per line (disable with '#')...<filters
> snipped>...^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
> Shadow Copy;status:running][service:VSS;dname:Volume Shadow
> Copy;status:stopped].*$^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
> Shadow Copy;status:stopped][service:VSS;dname:Volume Shadow
> Copy;status:running].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
> Copy
> Provider;status:stopped].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
> Copy Provider;status:running].*$...<filters snipped>...
>
> Although Osiris seems to still recognise them even though technically
> this makes them part of the same line and hence commented out!
>
> osiris-4.2.3-release: filters
> Exclude anything matching the following regular expressions:
>
> ...<filters
> snipped>...^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
> Shadow Copy;status:running][service:VSS;dname:Volume Shadow
> Copy;status:stopped].*$^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
> Shadow Copy;status:stopped][service:VSS;dname:Volume Shadow
> Copy;status:running].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
> Copy
> Provider;status:stopped].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
> Software Shadow Copy
> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
> Copy Provider;status:running].*$^...<filters snipped>...
> 8 comparison filters.
>
>
>
> Any ideas on how to make this work properly?
>
> -h
>
> --
> Hari Sekhon
>
> _______________________________________________
> osiris mailing list
> osiris at lists.shmoo.com
> https://lists.shmoo.com/mailman/listinfo/osiris
>



--------------------------------------------------------------------------------
M.Menge                                 Tel.: (49) 7071/29-70316
Universitaet Tuebingen                  Fax.: (49) 7071/29-5912
Zentrum fuer Datenverarbeitung          mail:  
michael.menge at zdv.uni-tuebingen.de
Waechterstrasse 76
72074 Tuebingen