Question

示例：

[Fri Oct 18 17:39:11 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:39:38 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:39:44 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/mariapiacasa.com.br/app/etc/local.xml
[Fri Oct 18 17:42:41 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:47:33 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:47:49 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:47:58 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:50:02 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 17:59:37 2013] [error] [client x.x.x.x] client denied by server configuration: /home/client/client.com.br/app/etc/local.xml
[Fri Oct 18 19:05:34 2013] [error] [client x.x.x.x] File does not exist: /home/client/client.com.br/skin/frontend/default/MAG080138

在此示例中，我不希望被监视行显示消息客户端被服务器配置拒绝：/home/client/client.com.br/app/etc/local.xml 。应该监控其他所有事情。我知道如何使用以下正则表达式找到我不想出现的内容：

.*client denied by server configuration:.*\/app\/etc\/local\.xml$

在上面的例子中应该只监视一行：

[Fri Oct 18 19:05:34 2013] [error] [client x.x.x.x] File does not exist: /home/client/client.com.br/skin/frontend/default/MAG080138

Answer 1

在正则表达式中，您可以使用negative lookahead使用(?!<regexpression>)来匹配某些内容，当且仅当它没有其他内容时才会匹配。

所以为了匹配任何不包含表达式的行：

client denied by server configuration:.*\/app\/etc\/local\.xml

您可以通过以下方式使用否定前瞻：

 ^(?:.(?!client denied by server configuration:.*\/app\/etc\/local\.xml))*$
   ^ non capture group
     ^ any character
      ^not followed by 
         ^ your regex

（见action）

但是，这个正则表达式会更好：

^.* \[client x.x.x.x\] (?!client denied by server configuration:.*\/app\/etc\/local\.xml).*$

（见action）

因为负前瞻只执行一次，而不是在每个字符匹配后执行。

希望这有帮助。

祝你好运！

如何使用check_log（Nagios插件）仅查询与模式不同的行？

1 个答案: