Shell Programming and Scripting

Hi,

I am writing a simple log parsing system and have a question on pattern matching.

It is simply grep -v -f patterns.re /var/log/all.log

Now, I have the following in my logs

Code:

Apr 16 07:33:17 ad-font-dc1 EvntSLog: [INF] AD-FONT-DC1/NTDS ISAM (700) - "NTDS (384) NTDSA: Online defragmentation is beginning a full pass on database 'C:\WINDOWS\NTDS\ntds.dit'."

and I'm trying to match it with the following entry in patterns.re

Code:

^... .. ..:..:.. [-A-Za-z0-9_.]* [a-zA-Z]*: \[[A-Z]*\] [-A-Za-z0-9_]*/NTDS ISAM ([0-9]*) - "NTDS ([0-9]*) NTDSA: Online defragmentation is beginning a full pass on database 'C:\WINDOWS\NTDS\ntds.dit'."

And I'm not having any luck. Can a second set of eyes take a look at see what is not quite right. I suspect it has to do with the Win32 path in the logfile.

Thanks

I think the problem is [-A-Za-z0-9_.]*, you have a dot within the square brackets, and that would match any characters, spaces included, so that pattern would match the whole string.

What do you want to achieve? you may describe your problem and people here might offer a better solution(Your Regex is too verbose).

The regex is audit required to be that verbose - can't chance a false match that excludes something unintentionally. The only regex that is failing to match is this one - it is also the only one with a DOS filesystem path so based on that I'm fairly certain that's where my issue lies.

The second backslash, before the right-bracket, is not necessary since the right-bracket is not a special character unless it's matching an opening left-bracket to form a bracket expression. And even when building a bracket expression, since a backslash is not special within a bracket expression, it cannot be used to quote a right bracket. Further, the \] yields an undefined sequence which can be treated differently depending on the regular expression engine implementation.

Each backslash in that pathname, since it's intended to be taken literally, needs to be itself backslash escaped. Also, if you want to match that filename exactly, you should quote the dot before the file extension so it matches a literal dot instead of any character.

Code:

C:\\WINDOWS\\NTDS\\ntds\.dit

Regards,
Alister

---------- Post updated at 12:55 AM ---------- Previous update was at 12:51 AM ----------

That's incorrect. A dot within a bracket expression is not special. The same goes for *, [, and \. They all lose their special meaning within a bracket expression.

Regards,
Alister

Oh, my bad.
You are right. A dot within a bracket expression only matches a dot literally.
Thank you!

Thanks for the help, the quotes got it going - I had previously escaped the "\" but not the dot in the filename.