Support for regular expressions
This section describes what metacharacters the PATROL Agent uses for regular expressions and where regular expressions are supported by the agent.
Regular expressions
PATROL Agent supports the limited use of file name metacharacters (UNIX) or wildcards (Windows) while creating regular expressions. Regular expressions enable you to take advantage of naming conventions and other predictable output. With these expressions, you can perform pattern matching based on text strings or numbers.
The size of the regular expression parenthesis has been increased to 29 because PATROL KM for Log Management relies on the MLS library for handling regular expressions.
Components that support regular expressions
PATROL supports regular expressions for the following components:
- PSL functions
- grep( )
- dump_hist( )
- Inclusion/exclusion lists for instances
- dump_hist utility (command line arguments)
- Agent configuration variables
- accessControlList
- disabledKMs
- disabledKMsArch
PATROL supports a subset of regular expressions defined by the REGEXP standard (REGEX API). Do not confuse PATROL supported subsets with the regular expressions used by UNIX commands such as grep.
The benefits of using regular expressions includes a reduction in the number of entries required for an exhaustive list of items with uniform naming conventions.
File name metacharacters and wildcards
File name metacharacters, or wildcards as they are referred to in Windows, describe all the variations of a given pattern.These characters do not match themselves. Instead, they describe the repetition and occurrence of other characters or groups of characters.
Wildcards supported by PATROL regular expressions
| Symbol | Description | Example | Possible results |
|---|---|---|---|
| Atom | |||
. | Match any single character | user. | user1, users |
| Quantifiers | |||
* | Match the preceding element (group of characters or number) zero or more times | b* | " " (empty string), b, bbbb |
| host.* | host, hostname, host_45 | ||
? | Match the preceding element zero or one time | 5? | " " (empty string), 5 |
| user.? | user, users, user5 | ||
+ | Match the preceding element one or more times | z+ | z, zzz, zzzzzz |
| admin.+ | administrator, admin1 | ||
| Character classes | |||
[ ] | Match enclosed characters. Commas (,) separate individual characters. Hyphens (-) indicate alphabetic and numeric ranges. | [parm90:a,b][parm90:2-5] | a2,a3, b4 |
| .*[parm90:3,5,7] | host_3, host_5, admin7 | ||
| Anchor | |||
$ | Match at end of line | terminate\.$ | (all lines that end with "terminate.") |
^ | Match at start of line | ^[parm90:eE]rror | (all lines that begin with "Error" or "error") |
\< | Match beginning of word | \<l | load, level, limit |
\> | Match end of word | x\> | fax, hex, box |
| Escape and group | |||
| \ | Escape a wildcard character so that the expression uses its literal value in comparisons | license\..* | license.nt_server, license.bsmith, licence. |
( ) | Group regular expressions and determine the order of precedence | (ERRMSG.?)*^ w.? generated | ERRMSG 44789 ERRMSG 78943 ERRMSG 89991 were generated |
Using character classes
The square brackets construct specifies a set of characters (a character class) of which one matches. Character classes consist of text characters, integers, and whitespace characters.
Examples
The following examples display a number of ways to employ character classes to create a variety of patterns:
Pattern | Description |
|---|---|
1[0-9] | Matches any 2-digit number beginning with a 1 such as 11, 15, 18 |
[1-3][0-9] | Matches any 2-digit number beginning with 1, 2 or 3 such as 10, 39, 24 |
[2,4,6][a,b,z] a | Matches any 2-digit alphanumeric character beginning with 2, 4, or 6 and ending in a, b, or z, such as 2z, 4a, 6b, 6z |
[a-zA-Z] | Matches any uppercase or lowercase letter, such as a Y k L |
[eE] mail | Matches capitalized and lowercase occurrences of the word "email" |
a Do not enter the comma (,) when specifying the character class.
Using quantifiers (*, ?, +)
The quantifiers specify how many instances of the previous element can match. The expression .* instructs the system to match any single character (represented by the period .) any number of times (represented by the asterisk *). Using patterns before and after quantifiers makes the search more precise. This concept is similar to searching for words based on prefixes and suffixes in English.
Examples
The following examples display a number of ways to employ quantifiers to create a variety of patterns:
Pattern | Description |
|---|---|
e* | Matches any string of zero or more "e"s such as an empty string, e, eee |
1+ | Matches any string of one or more "1"s such as 1, 111, 1111111 |
admin.* | Matches any string that begins with "admin" and contains zero or more characters such as administrator, admin_1, admin-bsmith, admin. |
NT.+ | Matches any string that begins with "NT" and contains at least one or more characters such as administrator, NT_CPU, NTkm_version, NT_, but not NT. |
admin.? | Matches any string that begins with "admin" and contains zero or one more character such as admin, admin1, admin2, adminZ |
e.*Houston | Matches any string that begins with an e and ends with Houston such as email_administrator-Houston, ebiz-Houston, ecommerce security advisor in Houston |
.?Smith | Matches any string that begins with zero or one occurrences of any character and ends with "Smith" such as BSmith, 1Smith, _Smith, Smith |
Using anchors
The anchors specify a position within a string. They are used in conjunction with quantifiers and character classes to find patterns in a specific location.
Examples
The following examples display a number of ways to employ anchors to create a variety of patterns. The anchor examples use character classes and quantifiers to make them more meaningful.
Pattern | Description |
|---|---|
^[abcABC] | Matches any line that begins with "a", "b", or "c" such as a Abort?; Bad disk please insert a valid disk; clusters verified = 231 |
$\. | Matches any line that ends with a period (.) |
\<[sS] | Matches any word that begins with an upper or lower case letter "s" such as system, Security, storage |
_server\> | Matches any word that ends in "_server" such as oracle8_server, sql-test_server, nt_server |
Comments
Log in or register to comment.