pattern_11
pattern_12
pattern_1n
[SECTION_2]
pattern_21
pattern_22
pattern_2n
[SECTION_n]
pattern_n1
pattern_n2
pattern_nn
The sections and patterns are processed in the sequence listed. If a pattern matches for a logfile entry, the remaining patterns are not processed any more. Therefore it enhances performance if patterns that will match more often are listed at the beginning of a section, if possible.
Hint: a section with the identical name can appear multiple times in a pattern file.
The patterns are POSIX 1003.2 regular expressions as processed by egrep(1).
All logfile entries that are not matched are ignored and are counted as IGNORED.
The special section [EXCLUDE] can be used to exclude logfile entries from analysis. Excluded logfile entries are not reported in the 'Logfiles' section of the LOGCHECK report, but are counted and reported in the 'Overview' section.
Because the sections are processed by logcheckd(1m) and lgcheckd(1m) in the order as defined in the pattern file, the [EXCLUDE] section will often be the first section in the pattern file to have the wanted effect.
The [EXCLUDE] section also enables you to reuse rule files already defined for the logcheck(1) command written by Craig H. Rowland, <crowland@psionic.com>.
The advantage of using the [EXCLUDE] section is, that the current logfile can be used as information baseline and all entries that are not significant to be reported can be excluded; all remaining entries can be classified, the pattern .* can be used to catch all remaining entries. Doing this unknown entries, which might be of interest, are not missed.
See also EXAMPLES section to see how to use the [EXCLUDE] section.
See explanation of this pattern file in logcheckd(1m) and lgcheckd(1m) example 1) in section EXAMPLES.
# # logcheckd/pattern/su - logfile analysis pattern file for: su # # [00] 25.04.2008 CWa Initial Version # [EXCLUDE] .* + .* root-.*$ [HIGH] .* - .*-root$ [MEDIUM] .* + .*-root$ .* - [LOW] [VERIFY] .*
This is free software; see edrc/doc/COPYING for copying conditions. There is ABSOLUTELY NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.