Re: pattern matching

On Wed, Jan 19, 2005 at 07:04:09AM -0500, Payal Rathod wrote:
> In /var/service/socklog-unix/log/main/main I do not want to match 
> lines by ftp daemon. So, I have,
> 
> # cat /var/service/socklog-unix/log/main/main/config
> s999999
> n10
> -*pure-ftpd*
> 
> and restarted socklog-unix. But still I find logs like,
> ftp.notice: Jan 19 17:26:19 pure-ftpd: ([email protected]) [NOTICE] 
> /home/test/hello.html uploaded  (4621 bytes, 67.47KB/sec)

Your pattern doesn't match the line because it stops at the p in
ftp.notice.  Make it
 -*.*: * * * pure-ftpd*
and it should work.  But beware of the pitfall with standard syslog
timestamps, add an additional line
 -*.*: *  * * pure-ftpd*
to catch that.

Restarting the socklog-unix service isn't required, send a HUP signal to
the socklog-unix/log service to have svlogd re-read its configuration.

 # runsvctrl hup /var/service/socklog-unix/log

HTH, Gerrit.