how to configure a "deny stringmatch filter"

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

how to configure a "deny stringmatch filter"

Alexander Wolff-4
the following filter:
 
<filter type="log4net.Filter.StringMatchFilter">
    <stringToMatch value="database" />
</filter>
 
Look for the substring 'database' in the message text of the event, in the case that text is found the filter is ACCEPTED and the message is logged. OK
 
I want to configure a filter that DENY the substring 'database' (don't log the message)
 
how can I configure that?
 
thanks in advance,
Alexander Wolff
Reply | Threaded
Open this post in threaded view
|

Re: how to configure a "deny stringmatch filter"

Daniel Williams-4
I believe this will work:

<filter type="log4net.Filter.StringMatchFilter">
    <stringToMatch value="database" />
    <acceptOnMatch="false"/>
</filter>
<filter type="denyAllFilter"/>

If not this exactly, then search for acceptOnMatch and see what the
right settings are.

Cheers,
Daniel Williams

On Sat, Jul 19, 2008 at 10:55 PM, Alexander Wolff
<[hidden email]> wrote:

> the following filter:
>
> <filter type="log4net.Filter.StringMatchFilter">
>     <stringToMatch value="database" />
> </filter>
>
> Look for the substring 'database' in the message text of the event, in the
> case that text is found the filter is ACCEPTED and the message is logged. OK
>
> I want to configure a filter that DENY the substring 'database' (don't log
> the message)
>
> how can I configure that?
>
> thanks in advance,
> Alexander Wolff
>
Reply | Threaded
Open this post in threaded view
|

Re: how to configure a "deny stringmatch filter"

Alexander Wolff-4
I tried but...

To be concrete, which I need is not to record in the log file (Im using FileAppender in this case) messages which contain string "ORA-00001"

Then I tried with the following filter:

        <filter type="log4net.Filter.StringMatchFilter">
            <acceptOnMatch value="false" />
            <stringToMatch value="ORA-00001" />
        </filter>

But..errors messages with "ORA-00001" are logged :(

Peculiarly, with the following filter:

        <filter type="log4net.Filter.StringMatchFilter">
            <acceptOnMatch value="true" />
            <stringToMatch value="ORA-00001" />
        </filter>
        <filter type="log4net.Filter.DenyAllFilter" />

Only messages that contain the string "ORA-00001" are logged (OK, it's the behavior that I would hope)

And with the following filter:

        <filter type="log4net.Filter.StringMatchFilter">
            <acceptOnMatch value="false" />
            <stringToMatch value="ORA-00001" />
        </filter>
        <filter type="log4net.Filter.DenyAllFilter" />

No message is recorded in log (OK, it's the behavior that I would hope)

Some Idea?


2008/7/20 Daniel Williams <[hidden email]>:
I believe this will work:

<filter type="log4net.Filter.StringMatchFilter">
   <stringToMatch value="database" />
   <acceptOnMatch="false"/>
</filter>
<filter type="denyAllFilter"/>

If not this exactly, then search for acceptOnMatch and see what the
right settings are.

Cheers,
Daniel Williams

On Sat, Jul 19, 2008 at 10:55 PM, Alexander Wolff
<[hidden email]> wrote:
> the following filter:
>
> <filter type="log4net.Filter.StringMatchFilter">
>     <stringToMatch value="database" />
> </filter>
>
> Look for the substring 'database' in the message text of the event, in the
> case that text is found the filter is ACCEPTED and the message is logged. OK
>
> I want to configure a filter that DENY the substring 'database' (don't log
> the message)
>
> how can I configure that?
>
> thanks in advance,
> Alexander Wolff
>

Reply | Threaded
Open this post in threaded view
|

Re: how to configure a "deny stringmatch filter"

JuanE
I have this same issue as described by Alexander Wolff.

Has anyone been able to filter logs out based on a matching script like
this?

There's also a contradicting entry about this in log4net's documentation:

Documentation entry for StringToMatch property:

/"The string that will be substring matched against the rendered message. If
the message contains this string then the filter will match. If a match is
found then the result depends on the value of AcceptOnMatch."/

Entry for AcceptOnMatch:

"The AcceptOnMatch property is a flag that determines the behavior when a
matching Level is found. If the flag is set to true then the filter will
Accept the logging event, otherwise it will *Neutral *the event."

So how is the event Denied??

Is this behavior even possible? If the event is Neutralized, in order to
deny it, we have to put a denyAll, but that will also deny all other logs.
AcceptOnMatch=true all entry logs that we want to let in, is much more
complicated than just preventing logs with some keys we know shouldn't be
logged .

I may be missing something please anyone who can shine some light on this
subject would be very appreciated! :)




--
Sent from: http://apache-logging.6191.n7.nabble.com/Log4net-Users-f19152.html