Re: logcheck oddity

[Bart-Jan Vrielink <bartjan@vrielink.net>]

On Mon, 2004-08-09 at 20:23, Andreas Schmidt wrote:
> On 2004.08.09 15:53, Juha Pahkala wrote:
> 
> > Aug  9 16:40:01 server /USR/SBIN/CRON[1103]: (root) CMD
> > (/root/bin/util/check_irexec)
> > Aug  9 16:40:01 server /USR/SBIN/CRON[1104]: (root) CMD
> > (/root/bin/util/check_mythbackend)
> > 
> > ie. every five minutes a check that the relevant processes are alive.
> > and
> > the line in the default installation:
> > 
> > ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ /USR/SBIN/CRON\[[0-9]+\]:
> > \([[:alnum:]-]+\) CMD \(.*\)$
> 
> Sure that is the same regex that worked for the second line? Seems you  
> got the [[:alnum:]] wrong both times. The class of alphanumeric  
> characters is named [:alnum:]. If you want to have a range of just  
> alphanumerical characters, you've got to use [[:alnum:]]+. So this  
> should work:
> 
> ^\w{3} [ :0-9]{11} [[:alnum:]]+ /USR/SBIN/CRON\[[0-9]+\]: \([[:alnum:]] 
> +\) CMD \(.*\)$

[._[:alnum:]-]+ means 1 or more alphanumeric characters, periods, dashes
or underscores. It's used in the default logcheck (and my own) checks to
match hostnames for example.
Just plain [[:alnum:]]+ won't match periods, dashes or underscores that
are not uncommon in hostnames.

-- 
Tot ziens,

Bart-Jan