Re: [logs] Some tests with logsurfer1.5b

From: Wolfgang Ley - Sun Germany - Hamburg (Wolfgang.Leyat_private)
Date: Wed Jun 25 2003 - 10:27:43 PDT

  • Next message: Jean-Baptiste Marchand: "[logs] [Windows] Privileges field in 560 events"

    Hi Thomas,
    
    >Hallo,
    >I do some tests with logsurfer1.5b and I can not explain the result from
    >Test 2. Have anyboby a good answer?
    
    [...]
    
    >Test 2:
    >'kinloop ([0-9]) ([a-z]+)' - - - 0 continue
    > open "kinloop $3" - 10 5 0
    > report "/bin/cat -" "kinloop $3"
    
    All three examples actually work as designed. In your test 2 you open
    a context which matches "kinloop" followed immediatly by the name,
    e.g. you try to collect lines like "kinloop paule" but NOT
    "kinloop [0-9] paule". Logsurfer always adds the current line (which
    openes a new context) to the context itself. That's why the first
    line (e.g. "kinloop 1 paule") is in the context but no other line
    (since the others don't match).
    
    To get your expected output you need to use this configuration:
    
    'kinloop ([0-9]) ([a-z]+)' - - - 0 continue
     open "kinloop [0-9] $3" - 10 5 0
     report "/bin/cat -" "kinloop [0-9] $3"
    
    Hope this helps.
    
    Bye,
      Wolfgang.
    -- 
    *******************************************************************
    Wolfgang Ley                           Enterprise Services
    Solaris Competence Center              Wolfgang.Leyat_private
    Sun Microsystems GmbH                  Tel: +49 40 251523-0
    Eiffestrasse 80                        Fax: +49 40 251523-77
    D-20537 Hamburg                        http://www.sun.de/
    -------------------------------------------------------------------
    
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Wed Jun 25 2003 - 14:00:39 PDT