On 7/14/2014 10:21 AM, Wietse Venema wrote: > > Note that the "/" appears only when there is an anomaly. Here, the > number of "good" auth commands (0) differs from the total number > of auth commands (10). > > In a logfile analyzer, anomalies would match 'disconnect.*=\d+/\d+' > (perl or pcre syntax). I think that we have a winner. > > Wietse >
Bingo! (that's good) -- Noel Jones
