[xymon] Re: Ignoring strings in event logs

[Colin Coe]

I've fixed there errors in /etc/xymon/server/hobbit-clients.cfg, in
fact I've commented out all the Windows related lines in the file.
I'm no longer getting core dumps but the hobbitd_client status in the
webUI is still purple.  I've restarted Xymon server 45 minutes ago and
still purple.

I've set the Windows machines to all be in central mode.

Any pointers on resolving the purple status of hobbitd_client would be great.

Thanks

CC

On Tue, Oct 5, 2010 at 2:00 PM, Henrik Størner <henrik at hswn.dk> wrote:
> Hi Colin,
>
> On Tue, 05 Oct 2010 11:33:04 +0800 Colin Coe wrote:
>> On Tue, Oct 5, 2010 at 11:00 AM, Josh Luthman
>> <josh at imaginenetworksllc.com> wrote:
>>> Are you sure your Windows clients are set for centralized
>>> configuration? They may be sending green/red instead of the data for
>>> the server to decide.
>>
>> After setting BBWin to be in central mode on a few test machines,
>> hobbitd_client crashes and does not restart.
>
> as Josh pointed out, the Windows client (BBWin) must be running in
> centralized configuration if you want to be able to do the configuration
> on the Xymon server. So an alternative solution could be to configure
> this on the client side, in BBWin.cfg, if you continue to run the BBWin
> client in local mode.
>
>
> I haven't tried playing with the centralized version of BBWin, so
> I had a look at the client to see how it works. It seems that the
> eventlog-configuration on the server uses "eventlog_LOGNAME" as
> the 'filename' in LOG configurations. So your config with
>
>  LOG eventlog:Security  %failure.* COLOR=yellow
>  LOG eventlog:Application  %warning.* COLOR=yellow
>  LOG eventlog:System %error.* COLOR=yellow
>
> should be
>
>  LOG eventlog_Security %failure COLOR=yellow
>  LOG eventlog_Application %warning COLOR=yellow
>  LOG eventlog_System %error COLOR=yellow
>
> (a '.*' at the end of a pattern is superfluous).
>
>
> However, this entry looks suspicious, and might be the one that causes
> hobbitd_client to crash:
>
>  LOG %.*  %error -.* COLOR=yellow
>
> That "-.*" looks out of place. Is there a space in front of it that
> shouldn't be there ?
>
>
> Try these changes for a start to see if the log entries get matched
> and trigger a yellow status for "msgs". Then you can add the IGNORE
> setting afterwards and see what needs to be done for that to work.
>
>
> Regards,
> Henrik
>
> To unsubscribe from the xymon list, send an e-mail to
> xymon-unsubscribe at xymon.com
>
>
>



-- 
RHCE#805007969328369