|[Date Prev] [Date Next]||[Thread Prev] [Thread Next]||[Date Index] [Thread Index]|
[snips-users] Logstats RE
Hi, This week we have ALOT of UNPARSABLE on logstats. I've tracked it down. Its going through : if ( /^(\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+\[([^]]+)\]:\s+SITE\s+(\S+)\s +(?:(\S+)\s+)?VAR\s+(\S+)\s+(\d+).*LEVEL\s+(\S+)\s+LOGLEVEL\s+(\S+)\s+NOCOP\s+(\ S+)/ ) and with the "(?:(\S+)\s+)" part, we have some records (ESPECIALLY SYSLOG) that have spaces in it. I'm ok with fairly simple RE's, but this "(?:(\S+)\s+)" confuses me. How can I get it to be more greedy between the "(\S+)\s+" and "?VAR\s+" ? (Or is that "?" part of the previous expression)? Thanks, Tuc/TTSG Internet Services, Inc.