Re: multilog filtering issues

richard lucassen <[email protected]> Fri, 5 Dec 2008 23:17:39 +0100
Newsgroups gmane.comp.djb.syslog
Organization XAQ Systems
Message-ID <[email protected]>
On Thu, 4 Dec 2008 18:37:19 -0500 (EST)
"Benjamin R. Haskell" <[email protected]> wrote:

[reply to Daryl, Vincent and Benjamin] 

Thanks for your replies. I have read your replies over and over again
and I'm still wondering what's going on here :)

[..]

> I think the bit that's getting you is "A star before the end of
> pattern  matches any string that does not include the next character
> in pattern."

Yep, that's it. And I miss completly the essence of this filtering
method. I'm convinced that Dan has good reasons for programming multilog
like this, but for me there is no _human_ logic in it.

echo -e " f abcde" | multilog e '-*' '+*abcde' /tmp/testlog/

echo -e " a abcde" | multilog e '-*' '+*abcde' /tmp/testlog/

I understand that the '*a' means that the *whole line* 'f abcde'
matches, because there is _no_ 'a' somewhere else in the line. Bit weird
IMHO ;-)

But as I have already said: what is the use of it? This looks more like
odd behaviour of a bug. The way this filter works might be logical to a
computer, but not for me as a human being.

So, if I use it as a simple filter (as explained in the docs) and if I
take all your explanations in consideration (like using the * with a
space or a puntuation), I fear there is still a big chance that the
filter will not always behave as expected. This is of course due to my
unability to oversee all consequences of writing a correct filter
statement.

Anyway, I'll have to live with it.

Thanks for your explanations and your time.

R.

P.S.: this is a typical example of "A computer does what you ask, not
what you want" :-)

-- 
___________________________________________________________________
It is better to remain silent and be thought a fool, than to speak
aloud and remove all doubt.

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht                                        |
| Public key and email address:                                    |
| http://www.lucassen.org/mail-pubkey.html                         |
+------------------------------------------------------------------+