Hi
Hopefully someone can help me understand what is going wrong.
I'm trying to monitor a log file for changes using logwatch.
The logfile is one i'm creating using dos rasdial to connect to a vpn and do certain tests, so log format is:
14-12-2009 13:05:00,19
Connecting to BDO PPTP...
Verifying username and password...
Registering your computer on the network...
Successfully connected to BDO PPTP.
Command completed successfully.
Pinging 10.1.25.1 with 32 bytes of data:
Request timed out.
Reply from 10.1.25.1: bytes=32 time=90ms TTL=128
Reply from 10.1.25.1: bytes=32 time=34ms TTL=128
Reply from 10.1.25.1: bytes=32 time=34ms TTL=128
Ping statistics for 10.1.25.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 34ms, Maximum = 90ms, Average = 52ms
Pinging 10.1.1.1 with 32 bytes of data:
Request timed out.
Reply from 10.1.1.1: bytes=32 time=34ms TTL=63
Reply from 10.1.1.1: bytes=32 time=34ms TTL=63
Reply from 10.1.1.1: bytes=32 time=34ms TTL=63
Ping statistics for 10.1.1.1:
Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),
Approximate round trip times in milli-seconds:
Minimum = 34ms, Maximum = 34ms, Average = 34ms
Command completed successfully.
then i'm using logwatch and try to look for changes, but so far all i can catch is the ping failure, maybe my regex code is wrong?
<parser processAll="0">
<file>c:\netxms\bdo_pptp_vpn_log.txt</file>
<macros>
<macro name="timestamp">[0-9]{2}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}</macro>
</macros>
<rules>
<rule break="1">
<match>^(?=.*?\connection\b)(?=.*?\cannot\b)(?=.*?\completed\b).*$</match>
<event>100009</event>
</rule>
<rule break="1">
<match>^(?=.*?\computer\b)(?=.*?\not\b)(?=.*?\respond\b).*$</match>
<event>100010</event>
</rule>
<rule break="1">
<match>Request timed out.</match>
<event>100008</event>
</rule>
</rules>
</parser>
