Moufid, the best thing is to employ several rules instead of one -- the last rule in the config file captures all ORA-<num> events, while the preceding ones are filtering out irrelevant stuff. Suppose that the events ORA-0001 and ORA-0002 are not interesting, while the rest of errors are important:
# filter out ORA-0001 type=Suppress ptype=Substr pattern=ORA-0001 # filter out ORA-0002 type=Suppress ptype=Substr pattern=ORA-0002 # this rule captures all "ORA-" error messages, # except ORA-0001 and ORA-0002 type=Single ptype=SubStr pattern=ORA- desc=Oracle alert.log warning action=shellcmd sendMail.bat You could also rewrite the first two rules as follows, with the regular expression capturing both patterns: type=Suppress ptype=RegExp pattern=ORA-(?:0001|0002) ...and the third rule as follows (the error code from the rest of the ORA- error messages is extracted from the message): type=Single ptype=RegExp pattern=ORA-(\d+) desc=Oracle alert.log warning, error code: $1 action=shellcmd sendMail.bat Hope this helps, risto On 06/21/2010 10:49 AM, ZERIBI Moufid wrote: > Hi, > > I’m discovering this tool (as well Perl) which seems to be powerful and > fits my needs. As a non-perl scripting expert I’m facing some issue in > implementing a specific rule. I have a database log file that I’d like > to analyse and send e-mail each time a keyword (ORA-) is found. The > problem is I want to exclude some specific ORA-XXXX errors. How can I > say in my pattern that I want to find all “ORA-“ entries except those > which are ORA-XXXX, ORA-YYYY. > > This is actually what I have. It doesn’t distinguish the uninteresting > ORA-XXXX, ORA-YYYY from the others > > type=Single > > ptype=SubStr > > pattern=ORA- > > desc=Oracle alert.log warning > > action=shellcmd sendMail.bat > > Any help would be appreciate. > > Thanks & Regards > > -- > > Moufid > > ******************************* > > This e-mail contains information for the intended recipient only. It may > contain proprietary material or confidential information. If you are not > the intended recipient you are not authorised to distribute, copy or use > this e-mail or any attachment to it. Murex cannot guarantee that it is > virus free and accepts no responsibility for any loss or damage arising > from its use. If you have received this e-mail in error please notify > immediately the sender and delete the original email received, any > attachments and all copies from your system. > > > > ------------------------------------------------------------------------------ > ThinkGeek and WIRED's GeekDad team up for the Ultimate > GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the > lucky parental unit. See the prize list and enter to win: > http://p.sf.net/sfu/thinkgeek-promo > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ ThinkGeek and WIRED's GeekDad team up for the Ultimate GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the lucky parental unit. See the prize list and enter to win: http://p.sf.net/sfu/thinkgeek-promo _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
