Cheshire Cat Computing

Hi,

another thing:

I want to exclude special events from notifying. So i added under "Match Rules", "Event IDs" some numbers like: "8003,1111" and have the box "NOT" checked.

But it is not excluding the events. I am still getting

"System [error] [mrxsmb #8003]: Der Hauptsuchdienst..."

logs from nagios...

Do i have to configure someting else? Of course i restarted the eventlogger.

Regards,
Jens

I'll look into this one. Someone else reported a problem with 'not' combined with a list of event IDs a couple of versions ago. but I was unable to duplicate it and my tests went through correctly.

Can you check to make sure it isnt possible that the events are being forwarded by a different filter? If you have several filters, they are checked in turn and the first match is used. Is it possible that the eventID list is correctly not matching, but a subsequent filter rule is?

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Steve,

i only have two filters, the first one logs "error" only (the one with the exceptions set) and the second logs "warning" - there are no exceptions needed.

because the log entry i want to have filtered out is a "error" type, the second filter should not be applied anyway to this.

Regards,

Jens

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hi Steve,

So I was a little curious and looked at the source code provided as version 1.1 on your website. I'm not sure if it's current.

It's been a while since I worked with C/C++ but I think I caught a bug (and a fix)

Look at filter.c lines 238-245

//ntsl_log_info("Checking [%s] against source [%s]",event->source,fp->source);
if( fp->source[0] ) {
if( strcmp(fp->source, event->source)) {
if(!(fp->notflags & NOT_MATCH)) { continue; }
} else {
if(fp->notflags & NOT_MATCH) { continue; }
}
}

I think NOT_MATCH should be NOT_SOURCE

As a matter of fact when I click on a Match String (regexp) Not checkbox in the filter (that sets NOT_MATCH and specify msftpsvc in the Event Source (string) it perfectly filters out specified events.

Makes sense ?

Havent't been able to figure the Event ID Not option yet, but you're right, it does work with test Events produced by NagiosEventLog...Not with others...


Thanks.

Hi Steve, it's me again:

I think here is the problem with our Not Event ID issue

In filter.c line 209

if( (fp->notflags & NOT_EVENT) ^ !inlist ) { continue; }

I think should be at least:

if( (fp->notflags && NOT_EVENT) ^ !inlist ) { continue; }

I'm not exactly sure how this logic works, but I'm sure the one in the code is not right: If Event ID Not checkbox is set then fp->notflags & NOT_EVENT returns 0x100. when you XOR that with !inlist (0 or 1) it's always going to be True... So weather the event ID is in the list or not... That doesn't look right.

Makes sense?

I hope it does, but I have to admit it's still quite a mistery how it all works...

Thanks for looking into it.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11