[Aide] Help about a difficult matching rule [Solved]

[Costas Zreikas]

After all those replies and ideas I finaly found the right regexp. So I
summarize;

For someone to exclude from aide.db files like;

 /lib/klibc/events/debug.00788.module.add.1250

but to keep an eye on their directory, it might use something like the
following syntax in aide.conf;

=/lib/klibc/events/$ R-s-m-c-i
!//lib/klibc/events/debug.\d{5}.\w+.add.\d{1,5}$/
/lib R

Resources suggested and found;

http://regexlib.com/RETester.aspx a usefull online tool to check regex's
http://www.amk.ca/python/howto/regex/ Regular Expression HOWTO
http://www.embnet.org/download/guideRegExp2.pdf A Quick Guide To PERL
Regular Expressions
http://search.cpan.org/dist/perl/pod/perlrequick.pod perlrequick - Perl
regular expressions quick start
http://www.scifistation.com/shop/perlre.html Regular Expressions
http://www.web-wise-wizard.com/server-side/perl-regular-expressions-regex-re
gexp.html Perl Regular Expressions
http://www.comp.leeds.ac.uk/Perl/matching.html String matching
http://www.cs.tut.fi/~jkorpela/perl/regexp.html Regular expressions in Perl
http://www.troubleshooters.com/codecorn/littperl/perlreg.htm PERL Regular
Expressions

People who replied and helped me out
Randy Brown
Bob Proulx
Paul Dodd

Thanx

Costas

----- Original Message -----
From: "Costas Zreikas" <computer_dept at feximports.gr>
To: <aide at cs.tut.fi>
Sent: Thursday, May 25, 2006 9:12 AM
Subject: [Aide] Help about a difficult matching rule


> Hello List,
>
> Please can anyone help me on how to form a rule so to exclude files like;
>
> /lib/klibc/events/debug.00788.module.add.1250
>
>
> In my aide.conf I have the lines;
>
> =/lib/klibc/events/$ R-m-c
> !/lib/klibc/events/debug.\d{5}.\w.add.\w{1,5}
> /lib R
>
> I'm using SUSE 10.0 and I've found the regular expressions syntax from
"man
> perlrequick"
>
> Thanx
>
> _______________________________________________
> Aide mailing list
> Aide at cs.tut.fi
> https://mailman.cs.tut.fi/mailman/listinfo/aide