I have this monit syntax,
check file access_log_1 with path /app/DNIF_logs/access_log_1
ignore content = ".*favicon.*"
if content = "^([:digit:]{1,3}\.){3}[:digit:]{1,3}[:space:]((((([:digit:]{1,3}\.){3}[:digit:]{1,3})|\-)[:space:]([:digit:]{6,7}|\-)[:space:][-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&=]*)[:space:])|)-[:space:]-[:space:]\[[:digit:]{2}\/([A-Z]|[a-z]){3}\/[:digit:]{4}\:[:digit:]{2}\:[:digit:]{2}\:[:digit:]{2}[:space:]\+[:digit:]{4}\][:space:]\"(.*)\"[:space:](500|502|503)([:digit:]|[:space:])*\"https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/\/=]*)\"(.*)" then alert
While running this monit I'm getting this error
/monitrc:40: syntax error '.*'
I tried removing the first .* and got
monitrc:41: syntax error '"[:space:](500|502|503)([:digit:]|[:space:])*\"'
so got to know error is at the first occurance of (.*) As per the answer here, we've to use posix regex syntax. Is there a different posix syntax for .* or what should I do?
In POSIX ERE,
[[:digit:]] is the same as [0-9]\b is not recognized, but you can usually use \< as a starting and \> as a trailing word boundariesYou may fix the regex like
if content = '^([0-9]{1,3}\.){3}[0-9]{1,3}[[:space:]]((((([0-9]{1,3}\.){3}[0-9]{1,3})|-)[[:space:]]([0-9]{6,7}|-)[[:space:]][-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\>([-a-zA-Z0-9()@:%_+.~#?&=]*)[[:space:]])|)-[[:space:]]-[[:space:]]\[[0-9]{2}/[[:alpha:]]{3}/[0-9]{4}:[0-9]{2}:[0-9]{2}:[0-9]{2}[[:space:]]\+[0-9]{4}][[:space:]]"(.*)"[[:space:]](500|502|503)[0-9[:space:]]*"https?://(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\>([-a-zA-Z0-9()@:%_+.~#?&/=]*)"(.*)' then alert
Note:
([A-Z]|[a-z])* is better written as just [[:alpha:]]* (any zero or more letters([0-9]|[[:space:]])* has a shorter variant, [0-9[:space:]]*.