[snips-users] Logstats RE

[Tuc <tuc at ttsg com>]

Hi,

	This week we have ALOT of UNPARSABLE on logstats.  I've tracked it
down. Its going through :

    if ( /^(\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+\[([^]]+)\]:\s+SITE\s+(\S+)\s
+(?:(\S+)\s+)?VAR\s+(\S+)\s+(\d+).*LEVEL\s+(\S+)\s+LOGLEVEL\s+(\S+)\s+NOCOP\s+(\
S+)/ )


and with the "(?:(\S+)\s+)" part, we have some records (ESPECIALLY SYSLOG)
that have spaces in it. I'm ok with fairly simple RE's, but this "(?:(\S+)\s+)"
confuses me. How can I get it to be more greedy between the
"(\S+)\s+" and "?VAR\s+" ? (Or is that "?" part of the previous expression)?

		Thanks, Tuc/TTSG Internet Services, Inc.