| Cheshire Cat Computing http://www.steveshipway.org/forum/ |
|
| Problems with filtering http://www.steveshipway.org/forum/viewtopic.php?f=22&t=696 |
Page 1 of 6 |
| Author: | jhansen [ Tue Aug 09, 2005 10:21 pm ] |
| Post subject: | Problems with filtering |
Hi, another thing: I want to exclude special events from notifying. So i added under "Match Rules", "Event IDs" some numbers like: "8003,1111" and have the box "NOT" checked. But it is not excluding the events. I am still getting "System [error] [mrxsmb #8003]: Der Hauptsuchdienst..." logs from nagios... Do i have to configure someting else? Of course i restarted the eventlogger. Regards, Jens |
|
| Author: | stevesh [ Tue Aug 09, 2005 10:46 pm ] |
| Post subject: | |
I'll look into this one. Someone else reported a problem with 'not' combined with a list of event IDs a couple of versions ago. but I was unable to duplicate it and my tests went through correctly. Can you check to make sure it isnt possible that the events are being forwarded by a different filter? If you have several filters, they are checked in turn and the first match is used. Is it possible that the eventID list is correctly not matching, but a subsequent filter rule is? |
|
| Author: | jhansen [ Tue Aug 09, 2005 11:07 pm ] |
| Post subject: | |
Steve, i only have two filters, the first one logs "error" only (the one with the exceptions set) and the second logs "warning" - there are no exceptions needed. because the log entry i want to have filtered out is a "error" type, the second filter should not be applied anyway to this. Regards, Jens |
|
| Author: | Mo_Le_ [ Thu Sep 01, 2005 7:11 am ] |
| Post subject: | Same problem |
| Author: | stevesh [ Thu Sep 01, 2005 1:48 pm ] |
| Post subject: | |
| Author: | Mo_Le_ [ Fri Sep 02, 2005 9:01 am ] |
| Post subject: | |
| Author: | Mo_Le_ [ Thu Sep 15, 2005 7:52 am ] |
| Post subject: | |
Hi Steve, So I was a little curious and looked at the source code provided as version 1.1 on your website. I'm not sure if it's current. It's been a while since I worked with C/C++ but I think I caught a bug (and a fix) Look at filter.c lines 238-245 //ntsl_log_info("Checking [%s] against source [%s]",event->source,fp->source); if( fp->source[0] ) { if( strcmp(fp->source, event->source)) { if(!(fp->notflags & NOT_MATCH)) { continue; } } else { if(fp->notflags & NOT_MATCH) { continue; } } } I think NOT_MATCH should be NOT_SOURCE As a matter of fact when I click on a Match String (regexp) Not checkbox in the filter (that sets NOT_MATCH and specify msftpsvc in the Event Source (string) it perfectly filters out specified events. Makes sense ? Havent't been able to figure the Event ID Not option yet, but you're right, it does work with test Events produced by NagiosEventLog...Not with others... Thanks. |
|
| Author: | Mo_Le_ [ Thu Sep 15, 2005 8:59 am ] |
| Post subject: | |
Hi Steve, it's me again: I think here is the problem with our Not Event ID issue In filter.c line 209 if( (fp->notflags & NOT_EVENT) ^ !inlist ) { continue; } I think should be at least: if( (fp->notflags && NOT_EVENT) ^ !inlist ) { continue; } I'm not exactly sure how this logic works, but I'm sure the one in the code is not right: If Event ID Not checkbox is set then fp->notflags & NOT_EVENT returns 0x100. when you XOR that with !inlist (0 or 1) it's always going to be True... So weather the event ID is in the list or not... That doesn't look right. Makes sense? I hope it does, but I have to admit it's still quite a mistery how it all works... Thanks for looking into it. |
|
| Author: | stevesh [ Fri Sep 16, 2005 2:29 pm ] |
| Post subject: | |
| Author: | stevesh [ Fri Sep 16, 2005 5:04 pm ] |
| Post subject: | |
| Page 1 of 6 | All times are UTC + 12 hours [ DST ] |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|