logging discriminator regexp issue

[andriio]

Hello
could anybody advice what could be cause of the regexp in logging discriminator to mismatch message body?
regexp was tested with online-tester against mentioned logs w/o any issues, but switch still logs mentioned messages. 
config:
logging discriminator DNACADMI msg-body drops .*[Uu]ser:{0,1} '{0,1}netadmin'{0,1}.*
logging buffered discriminator DNACADMI 2048000
logs:
Feb 6 09:20:58.576: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: netadmin] [Source: X.Y.Z.W] [localport: 22] at 09:20:58 UTC Tue Feb 6 2024
Feb 6 09:20:58.140: %DMI-5-AUTH_PASSED: Switch 1 R0/0: dmiauthd: User 'netadmin' authenticated successfully from 10.233.251.8:53214 for netconf over ssh. External groups: PRIV15
Feb 6 09:21:13.077: %SYS-6-LOGOUT: User netadmin has exited tty session 2(X.Y.Z.W)

[Georg Pauwen]

Hello,

I tested with the very simplified regex below, and it filters out all three messages:

logging discriminator DNACADMI msg-body drops User|netadmin
logging buffered discriminator DNACADMI
logging console discriminator DNACADMI
logging monitor discriminator DNACADMI

[andriio]

thanks Georg
with "cisco-regexp" style it works. this time i set regexp to User.* 'netadmin|user.* netadmin
do u mean industry-standard regexp may not work for IOS CLI?

[Georg Pauwen · Accepted solution]

Hello,

I don't think logging discriminators support regular expressions. Matching is based on fixed strings, prefixes, or exact phrases within log messages. They are not designed to perform pattern matching or complex text parsing using regular expressions...to my best knowledge.