Many thanks for the response. Works beautifully! I have now a lot to learn..
Best Regards Bhayward -----Original Message----- From: Tim Peiffer [mailto:[EMAIL PROTECTED] Sent: Friday, November 28, 2008 2:51 PM To: Hayward, Ben Cc: Subject: Re: [Simple-evcorr-users] How to return log line containing search string Hayward, Ben wrote: > Hello List, > I have great things to say about SEC. However I have come to an > impasse in my configuration. How can I pass the line in the log that > contains my search string in order to send this in the body of email > alert? > > $0 is the entire line. I use it in my catch-all rules # # Unknown message types.. a broad group should be ignored. Others should # bubble to the top # type=Single desc=Unknown message types ptype=regexp pattern=(%[\S_-]+-\d-[\S_-]+:) action= create $1 345600 ; logonly %s - $0 Regards, Tim Peiffer Network Support Engineer Office of Information Technology University of Minnesota/NorthernLights GigaPOP > Thank you all in advance > > Best regards > > bhayward > > > ---------------------------------------------------------------------- > -- > > ---------------------------------------------------------------------- > --- This SF.Net email is sponsored by the Moblin Your Move Developer's > challenge Build the coolest Linux based applications with Moblin SDK & > win great prizes Grand prize is a trip for two to an Open Source event > anywhere in the world > http://moblin-contest.org/redirect.php?banner_id=100&url=/ > ---------------------------------------------------------------------- > -- > > _______________________________________________ > Simple-evcorr-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
