Could you post your working config, please?<br><br clear="all">Josh Luthman<br>Office: 937-552-2340<br>Direct: 937-552-2343<br>1100 Wayne St<br>Suite 1337<br>Troy, OH 45373<br><br>"When you have eliminated the impossible, that which remains, however improbable, must be the truth."<br>
--- Sir Arthur Conan Doyle<br>
<br><br><div class="gmail_quote">On Mon, Sep 21, 2009 at 3:00 PM, Camelia Anghel <span dir="ltr"><<a href="mailto:canghel@cjh.org">canghel@cjh.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="blue" lang="EN-US">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Greg,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">That worked!!!</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Thanks a lot!</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Camelia </span></font></p><div class="im">
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 0.5in;"><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;">-----Original Message-----<br>
<b><span style="font-weight: bold;">From:</span></b> Greg Hubbard
[mailto:<a href="mailto:glh.forums@gmail.com" target="_blank">glh.forums@gmail.com</a>] <br>
<b><span style="font-weight: bold;">Sent:</span></b> Friday, September 18, 2009
3:09 PM<br>
<b><span style="font-weight: bold;">To:</span></b> <a href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a><br>
<b><span style="font-weight: bold;">Subject:</span></b> Re: [hobbit] how to
search for exact word patterns</span></font></p>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div><div class="im"><div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Yes -- you only need one % at the beginning of your
string to tell Xymon you are going to use a regular expression. You do
not need the other % unless they are expected to appear in the log.</span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">When using a regular expression, the | character means
"or". So if your example will "fire" if any message
contains and of those words. Also you seem to be using * by itself, which
means "match the preceding 0 or more times". Normally we use
"dot star" ".*" to mean "match anything no matter how
long."</span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Regular expressions are a bit of a mystery, but are
very powerful. Xymon uses Perl-compatible regular expressons (PCRE) so
you might be able to Google some examples.</span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">If you are searching for "Out of memory" in
a log file, you can use "%Out of memory" as your regex string.
I do not remember how you deal with spaces in the string and the Xymon help is
not helpful. One way to do it would be to change your spaces into \s+ so
it would be %Out\s+of\s+memory which removes the embedded spaces (so the
Xymon parser does not think part of your regex is some other token on the
commend) and also means that you will match of the is at least one whitespace
character between each word -- slightly more robust than using a single space.<br>
</span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">I know the above is a jumble, but if you will post the
exact string you want to match we can help you create the matching expression
to help you get the hang of it.</span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div>
<div>
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">GLH<br>
</span></font></p>
</div>
</div><div><div class="im">
<p style="margin-left: 0.5in;"><span><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On 9/18/09, <b><span style="font-weight: bold;">Camelia Anghel</span></b> <<a href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>> wrote:</span></font></span>
</p>
</div><div vlink="blue" link="blue">
<div><div class="im">
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Right now looks like
this:</span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">LOG /var/log/messages
%failure*|%failed*|%error*|%Warning*|%memory* Color=Red</span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">But if I type </span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">LOG /var/log/messages
%failure*|%failed*|%error*|%Warning*|%out of memory* Color=Red</span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">I’m getting all the
messages that have one of these words: out or of or memory somewhere in their
string.</span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 0.5in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Camelia </span></font></p>
</div><div><span>
<p style="margin-left: 1in;"><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;"><div class="im">-----Original Message-----<br>
<b><span style="font-weight: bold;">From:</span></b> Greg Hubbard [mailto:<a href="mailto:glh.forums@gmail.com" target="_blank">glh.forums@gmail.com</a>]
<br>
<b><span style="font-weight: bold;">Sent:</span></b> Friday, September 18, 2009
1:25 PM<br>
<b><span style="font-weight: bold;">To:</span></b> <a href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a><br>
</div><div class="im"><b><span style="font-weight: bold;">Subject:</span></b> Re: [hobbit] how to
search for exact word patterns</div></span></font></p><div class="im">
<p style="margin-left: 1in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<p style="margin-right: 0in; margin-bottom: 12pt; margin-left: 1in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Try making it a regex (with % prefix) instead of "simple"
expression.</span></font></p>
</div><div><div class="im">
<p style="margin-left: 1in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On 9/18/09, <b><span style="font-weight: bold;">Camelia
Anghel</span></b> <<a href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>>
wrote: </span></font></p>
</div><div vlink="blue" link="blue">
<div><div class="im">
<p style="margin-left: 1in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Did that but it look for
all messages that have one of the 3 words</span></font></p>
<p style="margin-left: 1in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Thanks anyway</span></font></p>
<p style="margin-left: 1in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Camelia </span></font></p>
</div><div>
<p style="margin-left: 1in;"><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p style="margin-left: 1.5in;"><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;"><div class="im">-----Original Message-----<br>
<b><span style="font-weight: bold;">From:</span></b> Josh Luthman [mailto:<a href="mailto:josh@imaginenetworksllc.com" target="_blank">josh@imaginenetworksllc.com</a>]
<br>
<b><span style="font-weight: bold;">Sent:</span></b> Friday, September 18, 2009
11:22 AM<br>
<b><span style="font-weight: bold;">To:</span></b> <a href="mailto:hobbit@hswn.dk" target="_blank">hobbit@hswn.dk</a><br>
</div><div class="im"><b><span style="font-weight: bold;">Subject:</span></b> Re: [hobbit] how to
search for exact word patterns</div></span></font></p>
<p style="margin-left: 1.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<p style="margin-right: 0in; margin-bottom: 12pt; margin-left: 1.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><div class="im">I think it's:<br>
<br>
HOST=<a href="http://my.host.com/" target="_blank">my.host.com</a><br></div><div class="im">
LOG /var/log/messages "out of memory" COLOR=red<br>
<br>
Not tested.<br>
<br clear="all">
Josh Luthman<br>
Office: 937-552-2340<br>
Direct: 937-552-2343<br>
1100 Wayne St<br>
Suite 1337<br>
Troy, OH 45373<br>
<br>
"When you have eliminated the impossible, that which remains, however
improbable, must be the truth."<br>
--- Sir Arthur Conan Doyle</div></span></font></p><div class="im">
<div>
<p style="margin-left: 1.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On Fri, Sep 18, 2009 at 9:26 AM, Camelia Anghel <<a href="mailto:canghel@cjh.org" target="_blank">canghel@cjh.org</a>>
wrote:</span></font></p>
<p style="margin-right: 0in; margin-bottom: 12pt; margin-left: 1.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><br>
Hello all,<br>
I am trying to set up an alert to search for exact word patterns in<br>
/var/log/messages. For example: "Out of Memory"<br>
<br>
Any help would be appreciated.<br>
<br>
Thanks,<br>
Camelia<br>
<br>
To unsubscribe from the hobbit list, send an e-mail to<br>
<a href="mailto:hobbit-unsubscribe@hswn.dk" target="_blank">hobbit-unsubscribe@hswn.dk</a></span></font></p>
</div>
<p style="margin-left: 1.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</div></div>
</div>
</div>
</div>
<p style="margin-left: 1in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><br>
<br clear="all">
<br>
-- <br><div class="im">
Disclaimer: 1) all opinions are my own, 2) I may be completely
wrong, 3) my advice is worth at least as much as what you are paying for it, or
your money cheerfully refunded. </div></span></font></p>
</span></div>
</div>
</div>
</div><div class="im">
<p style="margin-left: 0.5in;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><br>
<br clear="all">
<br>
-- <br>
Disclaimer: 1) all opinions are my own, 2) I may be completely
wrong, 3) my advice is worth at least as much as what you are paying for it, or
your money cheerfully refunded. </span></font></p>
</div></div>
</div>
</blockquote></div><br>