a tiny logfile problem

[KolbjÃrn Barmen <kolbjorn.barmen (at) uninett.no>]

Due to the nature of the LOG entries in client-local.cfg I keep getting
red dots evey now and then.

[linux]
log:/var/log/messages:10240
ignore MARK

The number 10240 is the MAXDATA in bytes that will be cheked.
The problem is that this results in uncomplete lines, and hence my IGNORE
patterns does not always apply.

For instance, on certain machines I log named queries, however I want
Hobbit to ignore query errors, so I have a this in hobbit-client.cfg
"IGNORE=%(named.*query|floppy|interrupt)" which mostly works.

However, every now and then the msgs page for this host shows a "Full log"
starting with

"med[1327]: client xxx.xxx.xxx.xxx#1057: query: www.errorsafe.com IN A"

where "med" is the end of "named" - this ofcourse sneaks past my IGNORE.

Would it be possible for the clients to not report on uncomplete lines?

I'm tempted to name this a bug, I'm just sorry I didnt catch this before
4.2.0 release, it's just that they pass along quite briefly.

Btw.. funny host and domain names with "error" and "warn" and "critical".. :)

-- 
KolbjÃrn Barmen
UNINETT Driftsenter