[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [hobbit] Problems with IGNORE in hobbit-client.cfg
- To: hobbit (at) hswn.dk
- Subject: Re: [hobbit] Problems with IGNORE in hobbit-client.cfg
- From: Alan Sparks <asparks (at) doublesparks.net>
- Date: Fri, 04 Sep 2009 10:29:32 -0600
- References: <OF03B7C7A3.89BCE62F-ONC1257627.0031F725-C1257627.00330127 (at) dcx.dcx>
- User-agent: Thunderbird 2.0.0.23 (Windows/20090812)
thorsten.erdmann (at) daimler.com wrote:
>
> Hi
>
> I have some difficulties to ignore some messages using the
> hobbit-client.cfg file.
>
> I want to ignore all messages that contain the word
> "smb_proc_readdir_long".
>
> So I build such rule:
>
> HOST=s068a300
> LOG %.* %(fatal|error) COLOR=red
> IGNORE=smb_proc_readdir_long
> LOG %.* warning COLOR=yellow
>
> I also tried IGNORE=%smb...
>
> If I write a message to /var/log/user like this:
>
> logger -p daemon.notice Testmessage ERROR smb_proc_readdir_long
>
> the message is not ignored by Hobbit:
>
> System logs at Fri Sep 4 11:08:39 CEST 2009
>
> Critical entries in /var/log/messages
> .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR
> smb_proc_readdir_long
> .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR
> smb_proc_readdir_long
>
>
> Another question: if I have many IGNOREs, can I put them on multiple
> lines for readability like this:
>
> HOST=s068a300
> LOG %.* %(fatal|error) COLOR=red
> IGNORE=smb_proc_readdir_long
> IGNORE=blabla
> IGNORE=nonsense
> LOG %.* warning COLOR=yellow
>
>
>
>
> Thorsten Erdmann
>
> If you are not the intended addressee, please inform us immediately
> that you have received this e-mail in error, and delete it. We thank
> you for your cooperation.
>
It's not obvious to me why it is not working. You might try to work
around the issue but using the "ignore" pattern in the client-local.cfg
configuration for the host or class, and not doing it in the
hobbit-clients config.
For the second, I do not believe multiple IGNORE keywords are accepted.
You can use a pattern match for this, like:
IGNORE=%(this thing|that thing)
Or, I think multiple "ignore" patterns (lines) /is/ allowed for a log
entry in client-local.
HTH.
-Alan