Thanks so much Risto...I will give that a shot and report my results.
James
On Sat, 2017-04-15 at 01:48 +0300, Risto Vaarandi wrote:
> hi James,
>
> you are seeing this error message because many Perl regular
> expression
> language flavors do not allow negative lookbehinds which match
> variable number of bytes. In your expression, you have a list of
> branches where each branch matches a different number of bytes (for
> example, "lt" matches just 2 bytes, while "email_opened" matches 12).
> In other words, the lookbehind does not match the same number of
> bytes
> in all cases. For the same reason, you would get an error for
> (?<!aaa|bb), but not for (?<!aaa|bbb). The regex dialect that is
> implemented by pcregrep is not having this restriction.
>
> For the workaround, you could consider reimplementing the same logic
> via negative lookahead which can match variable number of bytes. For
> example, maybe something like this would help:
> ^(?!\S+(lt|unsubscribe_get|email_opened)\.php)\S+\.php
> Also, you should make sure that lookahead is evaluated at an expected
> position in the input string (the above example uses ^ to anchor it
> to
> the beginning of string), otherwise lookahead could produce
> unexpected
> results.
>
> hope this helps,
> risto
>
>
> 2017-04-15 0:13 GMT+03:00 James Lay <j...@slave-tothe-box.net>:
> >
> > Resending due to large attachment being sent:
> >
> > Topic :) I THOUGHT I had this right...pcregrep and regex101.com
> > has no
> > issues, however I'm seeing the below:
> >
> > Rule in /etc/sec.conf at line 19: Invalid regular expression
> > '(\S+(?
> > 9a-z]{4})':
> > Variable length lookbehind not implemented in regex
> > m/(\S+(?
> > 9a-z]{4})/
> > at /usr/local/bin/sec line 602, <CONFFILE> line 26.
> >
> > So hopefully I'm matching on:
> >
> > \S+(?
> > z]{4}
> >
> > \S+ - any string
> > (?
> > "don't
> > match lt or unsuscribe_get or email_opened in the previous \S+"
> > \.php\?id=[A-Z]{1}[A-Z0-9a-z]{4} match .php?="one capital
> > letter""four
> > upper or lower case letters or numbers"
> >
> > Am I missing something glaring? Thank you.
> >
> > James
> >
> > -----------------------------------------------------------------
> > -------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > Simple-evcorr-users mailing list
> > Simple-evcorr-users@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
