Cheshire Cat Computing

I have been testing nagevlog and it would be perfect for my needs if only the filtering for Event ID:s would work.

It looks like positive filtering do work. If I not check the "Not" box and put some event id:s to be monitored, they do pass through and everything else not. The way it should work. But if I check the "Not" box and enter id:s I would like to filter out, It filters everything out.

If I could enter id:s in a way like 1-345,347-500,502,503-90003 with the "Not" box unchecked, then this would be tolerable, but that doesn't seem to work either.

I haven't tested the two other rules (Match string, Event Source), but if I understand correctly you can only put one regexp or string per rules, so this is not suitable for my needs.

If I have misunderstood something, please correct me.. (And tell me to RTFM after telling me where it is...

Tony

I will look into this when Im back in the office on Monday. There may be a bug in the eventid 'not' code, although this has been tested... The eventids can be a comma separated list, but not (yet) ranges. I can see the benefit of this, so it's added to the wishlist.

The regexp for matching is quite flexible, so you should be able to match almost any pattern set in one regexp.

Furture versions will hopefully give more flexibility. In the meantime, you can always create multiple filters to catch different patterns, all of which send the same alert service.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

So... the part I tested at length doesnt work, but the part I wasn't really able to test at all does?

That's life.

Strangely, the program does not make any distinction between 'test' events and real ones. The test events are injected straight into the EventLog and the normal program behaviour picks them up from there like anything else.

The event source is a single string, NOT a list.

The Match string is a single regexp, NOT a list.

Only the eventID is a comma separated list (any whitespace is ignored).

Can you post a dump of the registry bit containing the filter definition that doesn't work? Then I'll try and duplicate the failing here, since (so far) I am unable to make it fail -- I really did run a lot of tests on eventID lists with and without the NOT setting before releasing.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11