It was thus said that the Great [email protected] once stated:
> On Fri, 23 Sep 2011, Jonathan Sabo wrote:
>
> without changing the format, you can do a regex match for " 4[0-9][0-9] "
> and probably get pretty good results (you may get some false positives,
> but by including the spaces before and after the value it hopefully won't
> be too bad)
A better regex would be
\" 4[0-9][0-9] [0-9]+ \"
Just doing a " 4[0-9][0-9] " could possibly a valid response that was in
the 400-409 byte range. What I gave above at least does a better matching
of that part of the line (if you are using one of the default formats from
Apache).
-spc
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com
