Charles, thanks for your help. Just changing the filename regexp to a constant didn't work, but doing that *and* changing the matching string *to* a regexp did work. I have also found that the IGNORE string has to be a regexp to work. I'm pretty sure the manual pages will need to be updated.
<br><br>Thanks,<br>Steve.<br><br><br><div><span class="gmail_quote">On 5/9/07, <b class="gmail_sendername">Charles Jones</b> <<a href="mailto:jonescr@cisco.com">jonescr@cisco.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
Hmm actually you are right about the regex, it *should* work. I'd try
making it work without the regex first, if that works, then I would try
putting quotes around the logfilename regex, ie <br>
LOG "%.*" WARNING COLOR=yellow<br>
<br>
You aren't supposed to need the quotes, but I've had to use it for PROC
regex entries in hobbit-clients.cfg before.<br><span class="sg">
<br>
-Charles</span><div><span class="e" id="q_1127295608cc36ab_2"><br>
<br>
Steve Holmes wrote:
<blockquote type="cite">Charles, <br>
I had read the man page, honest. I read the following:<br>
<br>
"logfilename" is the name of the logfile. Only logentries from this
filename will be matched against this rule. Note that "logfilename" can
be a regular expression (if prefixed with a '%' character).<br>
<br>
to mean that %.* would match all logfilenames. Guest not, huh?<br>
<br>
Thanks, I'll try that. <br>
<br>
Steve.<br>
<br>
<br>
<br>
<div><span class="gmail_quote">On 5/9/07, <b class="gmail_sendername">Charles
Jones</b> <<a href="mailto:jonescr@cisco.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">jonescr@cisco.com</a>>
wrote:</span>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">Your syntax is wrong. For
logfile monitoring you must have the
following in hobbit-clients.cfg:<br>
<b>LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]</b><br>
<br>
So, using one of your examples below, it should be:<br>
<br>
LOG /var/adm/messages WARNING COLOR=yellow<br>
<br>
If you need a reference just check the man pages, either on your Hobbit
instance, or at:<br>
<a href="http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html
</a><br>
<a href="http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html
</a><br>
<span><br>
-Charles</span>
<div><span><br>
<br>
Steve Holmes wrote:
<blockquote type="cite">Hi all,<br>
<br>
I may not be understanding how the LOG match-pattern works. <br>
<br>
In my hobbit-clients.cfg file I have under the DEFAULT section the
following:<br>
<br>
LOG %.* NOTICE<br>
LOG %.* ERROR<br>
LOG %.* WARNING COLOR=yellow <br>
LOG %.* notice COLOR=yellow<br>
LOG %.* error COLOR=yellow<br>
LOG %.* daemon.error COLOR=yellow<br>
LOG %.* warning COLOR=yellow<br>
LOG %.* warn COLOR=yellow<br>
<br>
At the moment on my hobbit server I have a green status for the host
mentor and the following messages in /var/adm/messages: <br>
<br>
[msgs:/var/adm/messages]<br>
<...SKIPPED...><br>
<a href="http://purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">purdue.edu</a>
scsi: [ID 107833 kern.warning] WARNING:
/pci@9,600000/SUNW,qlc@2/fp@0,0/ssd@w21000004cffa6698,0 (ssd1):<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
Error for Command: read(10) Error Level: Retryable<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.notice] Requested Block: 33383911
Error Block: 33383911<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.notice] Vendor: SEAGATE
Serial Number: 0317A1JGAZ <br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.notice] Sense Key: Media Error<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu
</a> scsi: [ID 107833 kern.notice] ASC: 0x11 (unrecovered
read
error), ASCQ: 0x0, FRU: 0xf<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.warning] WARNING: /pci@9,600000/SUNW,
qlc@2/fp@0,0/ssd@w21000004cffa6698,0 (ssd1):<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
Error for Command: write(10) Error Level: Retryable<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mentor.ics.purdue.edu</a> scsi: [ID 107833 kern.notice] Requested
Block: 33982299 Error Block: 33982299<br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.notice] Vendor: SEAGATE
Serial Number: 0317A1JGAZ <br>
May 9 11:07:36 <a href="http://mentor.ics.purdue.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">mentor.ics.purdue.edu</a>
scsi:
[ID 107833 kern.notice] Sense Key: Unit Attention <br>
<br>
The above is copied from the hobbit display reached by clicking on the
[/var/adm/messages] link on the msgs page for this host. <br clear="all">
<br>
In the client-local.cfg I have:<br>
<br>
[sunos]<br>
log:/var/adm/messages:10240 <br>
<br>
<br>
So why is the page green? There are at least 3 strings that should
match to turn it yellow, right? And incidentally, the BB server I'm
running on another host *does* show yellow. I'm trying to validate my
hobbit configuration by making sure it matches the running BB server.
And it doesn't for msgs, ever. <br>
<br>
Thanks,<br>
Steve.<br>
<br>
</blockquote>
<br>
</span></div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
I believe I found the missing link between animal and civilized man. It
is<br>
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)<br>
<br>
We in America do not have government by the majority. We have
government by
<br>
the majority who participate. -Thomas Jefferson, third US president,<br>
architect and author (1743-1826)
</blockquote>
<br>
</span></div></div>
</blockquote></div><br><br clear="all"><br>-- <br>I believe I found the missing link between animal and civilized man. It is<br>us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)<br><br>We in America do not have government by the majority. We have government by
<br>the majority who participate. -Thomas Jefferson, third US president,<br>architect and author (1743-1826)