Re: logcheck.ignore entries
Russell Coker <russell@coker.com.au> wrote:
> Try this one:
> CRON\[.*\]:( )?\(pam_unix\) session (opened)|(closed) for user (root)|(mail)
> [...]
> For having two different words match you need to put each word in
> braces, "(opened|closed)" is the same as "opene(d|c)losed".
No!
"session (opened|closed) for user" matches "session opened for user"
and "session closed for user" which is what is needed here. "session
(opened)|(closed) for user" matches "session opened" and "closed for
user" which does not make much sense in this context.
Paul
Reply to: