[osiris] Filters not working

[Hari Sekhon]

Actually this way happening before I did that.

I added it partially so I found find out where lines were supposed to 
start and end when it mushed them all into one awful looking line.

Does your filters command show the whole thing as 1 long line?

-h

Hari Sekhon



Michael Menge wrote:
> Hi,
>
> i don't mark the beginning and end of a line with ^.* and .*$
>
>    Michael
>
> Quoting Hari Sekhon <hpsekhon at googlemail.com>:
>
>   
>> I am trying to use filters to reduce noise but it doesn't seem to be
>> working. I have for example filters like:
>>
>> ^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow
>> Copy;status:running][service:VSS;dname:Volume Shadow
>> Copy;status:stopped].*$
>> ^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow
>> Copy;status:stopped][service:VSS;dname:Volume Shadow
>> Copy;status:running].*$
>> ^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
>> Copy Provider;status:stopped].*$
>> ^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
>> Copy Provider;status:running].*$
>>
>> To try to stop it reporting changes in service state for Volume Shadow
>> Copy on the Windows servers running the osirisd agent.
>>
>> However, I still get emails like this, several days after implementing
>> this filter:
>>
>> [223][SERVER_X][cmp][mod_kmods][service:VSS][service:VSS;dname:Volume Shadow  
>>  Copy;status:stopped][service:VSS;dname:Volume Shadow   
>> Copy;status:running]
>> [223][SERVER_X][cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft  
>>  Software Shadow Copy   
>> Provider;status:stopped][service:swprv;dname:Microsoft Software   
>> Shadow Copy Provider;status:running]
>>
>>
>> This is the sole content of the email, the only change in state to the
>> server, so the filters are obvious not working.
>>
>> It seems that the filters also get squashed into a single line on the
>> filters file like so
>>
>> # add regular expressions, one per line (disable with '#')...<filters
>> snipped>...^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
>> Shadow Copy;status:running][service:VSS;dname:Volume Shadow
>> Copy;status:stopped].*$^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
>> Shadow Copy;status:stopped][service:VSS;dname:Volume Shadow
>> Copy;status:running].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
>> Copy
>> Provider;status:stopped].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
>> Copy Provider;status:running].*$...<filters snipped>...
>>
>> Although Osiris seems to still recognise them even though technically
>> this makes them part of the same line and hence commented out!
>>
>> osiris-4.2.3-release: filters
>> Exclude anything matching the following regular expressions:
>>
>> ...<filters
>> snipped>...^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
>> Shadow Copy;status:running][service:VSS;dname:Volume Shadow
>> Copy;status:stopped].*$^.*[cmp][mod_kmods][service:VSS][service:VSS;dname:Volume
>> Shadow Copy;status:stopped][service:VSS;dname:Volume Shadow
>> Copy;status:running].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:running][service:swprv;dname:Microsoft Software Shadow
>> Copy
>> Provider;status:stopped].*$^.*[cmp][mod_kmods][service:swprv][service:swprv;dname:Microsoft
>> Software Shadow Copy
>> Provider;status:stopped][service:swprv;dname:Microsoft Software Shadow
>> Copy Provider;status:running].*$^...<filters snipped>...
>> 8 comparison filters.
>>
>>
>>
>> Any ideas on how to make this work properly?
>>
>> -h
>>
>> --
>> Hari Sekhon
>>
>> _______________________________________________
>> osiris mailing list
>> osiris at lists.shmoo.com
>> https://lists.shmoo.com/mailman/listinfo/osiris
>>
>>     
>
>
>
> --------------------------------------------------------------------------------
> M.Menge                                 Tel.: (49) 7071/29-70316
> Universitaet Tuebingen                  Fax.: (49) 7071/29-5912
> Zentrum fuer Datenverarbeitung          mail:  
> michael.menge at zdv.uni-tuebingen.de
> Waechterstrasse 76
> 72074 Tuebingen
>
> _______________________________________________
> osiris mailing list
> osiris at lists.shmoo.com
> https://lists.shmoo.com/mailman/listinfo/osiris
>
>