Re: [hobbit] Problems with IGNORE in hobbit-client.cfg

[Dominique Frise <dominique.frise (at) unil.ch>]

Give this a try:

HOST=s068a300
   LOG     %.* %(fatal|error) IGNORE=%(?-i)smb_proc_readdir_long

From hobbit-client.cfg(5):
...
     Note that Xymon defaults  to  case-
     insensitive  pattern matching; if that is not what you want,
     put "(?-i)" between the "%" and the  regular  expression  to
     turn  this off. E.g. "%(?-i)HTTPD" will match the word HTTPD
     only when it is upper-case.
...


> Another question: if I have many IGNOREs, can I put them on multiple
> lines for readability like this:

I don't think this is supported.
Rules are separated with | (pipe)

E.g.:  IGNORE=%(?-i)forceload|hypervisor\sLDC


BTW: hobbitd_client can be used for testing your rules:

[bb (at) iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: testhost
Hosttype []: linux
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/log/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Testmessage ERROR smb_proc_readdir_long
log line:
Log status is green

Hostname (.=end, ?=dump, !=reload) [testhost]:


Dominique

thorsten.erdmann (at) daimler.com wrote:
> Hi
>
> I have some difficulties to ignore some messages using the 
> hobbit-client.cfg file.
>
> I want to ignore all messages that contain the word "smb_proc_readdir_long".
>
> So I build such rule:
>
> HOST=s068a300
>         LOG     %.* %(fatal|error)   COLOR=red   
> IGNORE=smb_proc_readdir_long
>         LOG     %.* warning          COLOR=yellow
>
> I also tried IGNORE=%smb...
>
> If I write a message to /var/log/user like this:
>
> logger -p daemon.notice Testmessage ERROR smb_proc_readdir_long
>
> the message is not ignored by Hobbit:
>
> System logs at Fri Sep 4 11:08:39 CEST 2009
>
>  Critical entries in /var/log/messages
>  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 
> smb_proc_readdir_long
>  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 
> smb_proc_readdir_long
>
>
> Another question: if I have many IGNOREs, can I put them on multiple 
> lines for readability like this:
>
> HOST=s068a300
>         LOG     %.* %(fatal|error)   COLOR=red  
>          IGNORE=smb_proc_readdir_long
>          IGNORE=blabla
>          IGNORE=nonsense
>         LOG     %.* warning          COLOR=yellow
>  
>
>
>  
> Thorsten Erdmann
>
> If you are not the intended addressee, please inform us immediately that 
> you have received this e-mail in error, and delete it. We thank you for 
> your cooperation.