Examples of Pattern Matching in Rule Conditions

The following examples show some of the many ways in which the pattern-matching language can be used.

• Error

  Recognizes any event containing the keyword Error at any place in the event. (It is case sensitive by default.)

• panic

  Matches all events containing panic, Panic, PANIC anywhere in the text of the event, when case sensitive mode is switched off.

• logon|logoff

  Uses the OR operator to recognize any event containing the keyword logon or logoff.

• ^getty:<*.msg> errno<*><#.errnum>$

  Recognizes any event such as: getty: cannot open ttyxx errno : 6 or getty: can't open ttyop3; errno 16

  In the example getty: cannot open ttyxx errno : 6, the string "cannot open ttyxx" is assigned to the variable msg. The digit 6 is assigned to the variable errnum. Note that the dollar sign ($) is used as an anchoring symbol to specify that the digit 6 will only be matched if it is at the end of the line.

• ^errno[ |=]<#.errnum> <*.errtext>

  Matches events such as: errno 6 - no such device or address or errno=12 not enough core.

  Note the space before the OR operator. The expression in square brackets matches either this blank space, or the "equals" sign. The space between <#.errnum> and <*.errtext> is used as a delimiter. Although not strictly required for assignments to the variables shown here, this space serves to increase performance.

• ^hugo:<*>:<*.uid>:

  Matches any /etc/passwd entry for user hugo and returns the user ID to variable uid. Notice that ":" in the middle of the pattern is used to delimit the string passed to uid from the preceding string. The colon ":" at the end of the pattern is used to delimit the string passed to uid from the succeeding group ID in the input pattern. Here, the colon is necessary not only as a speed enhancement, but also as a means of logical separation between strings.

• ^Warning:<*.text>on node<@.node>$

  Matches any event such as: Warning: too many users on node hpbbx and assigns too many users to text, and hpbbx to node.

• ^<*.line1><1/><*.line2><1/><*.line3><1/><*.line4>$

  Matches four lines of text, for example:

  Security ID:     S-1-5-21-3358208617-1210941181-189752109-500
  Account Name:    Administrator
  Account Domain:  EXAMPLE
  Logon ID:        0x228a2
  

  There is one line break between each line. The pattern assigns each line of text to a variable.

• <<#> -le 45>

  This pattern matches all strings containing a number which is less than or equal to 45. For example, the event: ATTENTION: Error 40 has occurred would be matched.

  Note that the number 45 in the pattern is a true numeric value and not a string. Numbers higher than 45, for instance, "4545" will not be matched even if they contain the combination, "45".

• <15 -lt <2#> -le 87>

  This pattern matches any event in which the first two digits of a number are within the range 16-87. For instance, the event: Error Message 3299 would be matched. The string: Error Message 9932 would not be matched.

• ^ERROR_<[<#.err>] -le 57>

  This pattern matches any text starting with the string "ERROR_" immediately followed by a number less than, or equal to, 57.

  For example, the event: ERROR_34: processing stopped would be matched and the string 34 would be assigned to the variable, err.

• <120 -gt [<#>1] -gt 20>

  Matches all numbers between 21 and 119 which have 1 as their last digit. For instance, events containing the following numbers would be matched: 21, 31, 41... 101... 111 and so on.

• Temperature <*> <@.plant>: <<#> -gt 100> F$

  This pattern matches strings such as: "Actual Temperature in Building A: 128 F". The letter "A" would be assigned to the variable, plant.

• Error <<#> -eq 1004>

  This pattern matches any event containing the string "Error" followed by a space and the sequence of digits, "1004".

  For example, Warning: Error 1004 has occurred would be matched by this pattern. However, Error 10041 would not be matched by this pattern.

• WARNING <<#> -ne 107>

  This pattern matches any event containing the string "WARNING" followed by a space and any sequence of one or more digits, except "107". For example, the event: Application Enterprise (94/12/45 14:03): WARNING 3877 would be matched.