Re: [logs] Some tests with logsurfer1.5b

From: thomas polnik (thomas.polnikat_private)
Date: Thu Jun 26 2003 - 09:33:15 PDT

  • Next message: Bruno Osuch: "[logs] FW: Windows Auditing question"

    Hallo Wolfgang,
    > >I do some tests with logsurfer1.5b and I can not explain the result from
    > >Test 2. Have anyboby a good answer?
    > 
    > [...]
    > 
    > >Test 2:
    > >'kinloop ([0-9]) ([a-z]+)' - - - 0 continue
    > > open "kinloop $3" - 10 5 0
    > > report "/bin/cat -" "kinloop $3"
    > 
    > All three examples actually work as designed. In your test 2 you open
    > a context which matches "kinloop" followed immediatly by the name,
    > e.g. you try to collect lines like "kinloop paule" but NOT
    > "kinloop [0-9] paule". Logsurfer always adds the current line (which
    > openes a new context) to the context itself. That's why the first
    > line (e.g. "kinloop 1 paule") is in the context but no other line
    > (since the others don't match).
    > 
    > To get your expected output you need to use this configuration:
    > 
    > 'kinloop ([0-9]) ([a-z]+)' - - - 0 continue
    >  open "kinloop [0-9] $3" - 10 5 0
    >  report "/bin/cat -" "kinloop [0-9] $3"
    
    It was my mistake. I didn't understand the meaning of "context" correct,
    but now I understand it. ;-)
    There are not so many howtos for logsurfer and the documentation for
    logsurfer is very small.
      
    > Hope this helps.
    Yes, thank you for your help.
    
    regards,
    thomas polnik
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Thu Jun 26 2003 - 08:52:34 PDT