On Mon, Mar 25, 2013 at 5:36 PM, Yaroslav Halchenko <
notifications@github.com> wrote:

> In config/filter.d/mysqld.conf:
>
> > +# common.local
> > +before = common.conf
> > +
> > +
> > +[Definition]
> > +
> > +#_daemon = mysqld
> > +
> > +# Option:  failregex
> > +# Notes.:  regex to match the password failures messages in the logfile. The
> > +#          host must be matched by a group named "host". The tag "<HOST>" can
> > +#          be used for standard IP/hostname matching and is only an alias for
> > +#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
> > +# Values:  TEXT
> > +# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES)
> > +failregex = Access denied for user '\w+'@'<HOST>'
>
> please anchor at the end for having " (using password: \S*)$"
>

  As it is specified in documentation to MySQL v5.5.30, in it 3 types of
  messages can meet:

   *  Error: `1044' SQLSTATE: `42000' (`ER_DBACCESS_DENIED_ERROR')

     Message: Access denied for user '%s'@'%s' to database '%s'

   *  Error: `1045' SQLSTATE: `28000' (`ER_ACCESS_DENIED_ERROR')

     Message: Access denied for user '%s'@'%s' (using password: %s)

   *  Error: `1698' SQLSTATE: `28000'
     (`ER_ACCESS_DENIED_NO_PASSWORD_ERROR')

     Message: Access denied for user '%s'@'%s'

I selected the shortest expression satisfying with all. It is necessary
to add three different regular expressions for each case?

-- 
wbw, artur penttinen