Regular expression matching , match "error string" but not "other error"

jmcmillan · 07-07-2008, 05:41 AM

Hello,
I've looked in the "similar threads" but couldn't find an answer.

Is there a regular expression I could use in a perl script that would match
"ERROR" but not "CRITICAL ERROR"?

In /var/log/messages we want to match things with "ERROR"
However HP's hpasmlited crashes occasionally and generates "CRITICAL ERROR". As far as I'm concerned they're not critical.

At present the regular expression is
"panic|halt|kern.error|ERROR"

I'd like to retain that functionality, only excluding "CRITICAL ERROR"

Please let me know if this isn't clear.

Regards - J McMillan

matthewg42 · 07-07-2008, 06:28 AM

Code:

$ cat messages
some line with ERROR
they'll pay to know what they really think
a line with a CRITICAL ERROR oh noes!
another line with ERROR in it
pull the wool over your own eyes

$ perl -ne 'print if (/ERROR/ && !/CRITICAL ERROR/);' messages
some line with ERROR
another line with ERROR in it

$

graemef · 07-07-2008, 06:51 AM

Does the line start with the words ERROR or CRITICAL ERROR or is this embedded within the line?

if yes then look at the start of line meta-character ^

otherwise you could try a negative assertion

(?<!CRITICAL )ERROR

Which says (I believe) match ERROR which is not preceded by CRITICAL<space>

jmcmillan · 07-07-2008, 09:50 AM

Thanks Matthew & Graeme.

I found that the "/ERROR/ && !/CRITICAL ERROR/" method gave me exactly what I required.

Thanks very much for both replies.
I verified it using a simple script

Code:

$ cat log
panic
halt
kern.error
ERROR
CRITICAL ERROR:  Resetting HP Advanced System Management Stack

$ cat perltest.pl
#!/usr/bin/perl -w

use strict;
open (IN, "log");
while (<IN>)
{
   if ((/kern.error|halt|ERROR|panic/) && (!/CRITICAL ERROR/))
   {
      print $_
   }
}
close IN;

$ ./perltest.pl
panic
halt
kern.error
ERROR