Re: Multiple patterns for matching within socklog?

On Mon, Jan 02, 2006 at 03:45:32AM +0000, Lloyd Zusman wrote:
> Lloyd Zusman <ljz <at> asfast.com> writes:
> >   For service "mail", accept all messages which match "mail.*" and which
> >   do not contain the string "imap".
> > 
> >   For a new service that I call "imap", accept all messages which match
> >   "mail.*" and which do contain the string "imap".
> > 
> >   In other words, this splits "mail.*" log messages into two groups, one
> >   with the word "imap" in them, and one without.  Then, each group gets
> >   logged into separate files.
> 
> Well, I figured this one out, but now, I have a more complicated problem.
> The way to do the one I mentioned above involves two sets of patterns.
> 
> For the "mail" case:
>   +mail.*
>   -*:*:*:*imap*
> 
> For the "imap" case:
>   +mail.*:*:*:*imap*
> 
> (there's a yyyy:mm:dd stamp before the "imap" string)
> 
> However, the more complicated case goes like this:
> 
>   For a new service that I call "getmail", accept all messages which
>   match "mail.*" and which also contain EITHER "pop" or "imap".
> 
>   For the "mail" service, accept all messages which match "mail.*" and
>   which DO NOT contain "pop" nor "imap".
> 
> How to handle "or/nor" within a complex rule is now throwing me for a
> loop.
> 
> Any ideas?

Hmm, how about?:

 -*
 +mail.*:*:*:*imap*
 +mail.*:*:*:*pop*

and

 -*
 +mail.*
 -mail.*:*:*:*imap*
 -mail.*:*:*:*pop*

Regards, Gerrit.