[Logcheck-devel] Re: [Logcheck-commits] CVS logcheck/rulefiles/linux/ignore.d.workstation

[maximilian attems]

On Mon, 11 Apr 2005, Jamie L. Penman-Smithson wrote:

> On Mon, 2005-04-11 at 22:15 +0200, maximilian attems wrote:
> > minor observations.
> >
> > On Thu, 07 Apr 2005, CVS User jlps-guest wrote:
> > > -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: +Vendor: [^[:space:]]+ +Model: [[:alnum:][:space:]]+ [^[:space:]]+ +Rev: +[.0-9]+$
> > > +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ kernel: +Vendor: [^[:space:]]+ +Model: [[:alnum:][:space:]]+ ([^[:space:]]+)?+Rev: +[.0-9]+$
> >                                  ^
> > you dropped a space from previous rule, should be inside the atom.
> 
> I'm a bit confused here and after staring at this for a few minutes I
> still don't get it. Could you clarify?
well before you would match
'Model: ffffff  bla   Rev:'
now that is no longer matched as the atom inside matches non space chars
directly before Rev
maybe it's better to use there:
 ([^[:space:]]+[[:space:]]+)?

hope that makes it clearer?



--
maks