As Ralph said, Xymon parses the "ps" output and you don't get anything before the command.<div><br></div><div>I've done this kind of thing server-side, by making a pseudo-logfile out of command output. For example, to ensure that the "named" user is running exactly one copy of the "named" process:</div>
<div><br></div><div>client-local.cfg:</div><div><font face="courier new, monospace"> [servername]</font></div><div><div><font face="courier new, monospace"> log:`rm -f $XYMONTMP/ps-check && /bin/ps -u named | grep -c " named$" > $XYMONTMP/named-count && echo $XYMONTMP/named-count`:1024</font></div>
</div><div><br></div><div>This makes the client list a count of the specified user's processes in the [msgs:/path/to/ps-check] section of the client data, ready for analysis. It should also be visible in the "messages" test page for the device. Note that the command line removes the tempfile first of all to create a new file, because otherwise (I believe) logwatch will think that the file hasn't changed and won't send updates for it.</div>
<div><br></div><div>So then:</div><div><br></div><div>analysis.cfg:</div><div><font face="courier new, monospace"> LOG /path/to/named-count 0 color=RED<br> LOG /path/to/named-count "%^[2-9]" color=RED</font></div>
<div><br></div><div>This flags a "msgs" alert if more or fewer than 1 processes reported.</div><div><br></div><div>This has the advantage of not having to create a script. But the down-side is that the error appears in the "msgs" status page.</div>
<div><br></div><div>If you want it reported in another status page (other than "msgs") then you probably have to make a script to do the reporting, and it might as well do the detection also (so forget about the client-local.cfg hack above), perhaps running on the Xymon server and getting the process list from the device's client data using the xymon "clientlog <devname> section=top" command. Like so:</div>
<div><br></div><div><div><font face="courier new, monospace">#!/bin/sh</font></div><div><font face="courier new, monospace">TEST=named-check</font></div><div><font face="courier new, monospace">USER=named</font></div><div>
<font face="courier new, monospace">xymongrep $TEST | while read LINE; do</font></div><div><font face="courier new, monospace"> set - ""$LINE; IP="$1"; HN="$2"</font></div><div><font face="courier new, monospace"> [ "$HN" ] || continue</font></div>
<div><font face="courier new, monospace"> HNCOMMAS=`echo "$HN" | sed 's/\./,/g'`</font></div><div><font face="courier new, monospace"> PSLIST=`xymon $XYMSRV "clientlog $HN section=top" | grep " $USER .* named *$"`</font></div>
<div><font face="courier new, monospace"> PSCOUNT=`printf "$PSLIST" | grep -c ^`</font></div><div><font face="courier new, monospace"> case $PSCOUNT in</font></div><div><font face="courier new, monospace"> 0) MSG="no named processes"; COL=red;;</font></div>
<div><font face="courier new, monospace"> 1) MSG="one named process"; COL=green;;</font></div><div><font face="courier new, monospace"> *) MSG="multiple named processes"; COL=red;;</font></div><div>
<font face="courier new, monospace"> esac</font></div><div><font face="courier new, monospace"> echo $XYMON $XYMSRV "status $HNCOMMAS.$TEST $COL `date` $MSG</font></div><div><font face="courier new, monospace">$PSLIST"</font></div>
<div><font face="courier new, monospace">done</font></div><div><font face="courier new, monospace"><br></font></div></div><div>This script will run the test against every server with the "named-check" tag in hosts.cfg, then create a "named-check" status page showing the status.</div>
<div><br></div><div>J</div><div><br></div><div><br><div class="gmail_quote">On Tue, Jun 26, 2012 at 12:25 AM, Ward, Martin <span dir="ltr"><<a href="mailto:Martin.Ward@colt.net" target="_blank">Martin.Ward@colt.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Hi all,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I have been trying to persuade Xymon to search for a process and alert on its non-existence, a simple task using the analysis.cfg file like so:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">HOST=host1<u></u><u></u></p>
<p class="MsoNormal">PROC “amd64/java” 1 1 red<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Whilst this has worked previously the developers have now introduced a dependency that the process should only be run by a specific user (i.e. not root). I thought I could get away with:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">PROC “%javauser.*amd64/java” 1 1 red<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">in the expectation that Xymon is testing against the whole of the output from ps(1) and in this case would only match Java processes run by the javauser user, but sadly this is not the case, I cannot persuade Xymon to match against the
process name AND the user who is running it.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Am I missing something/doing something wrong or is this the way Xymon works?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">|\/|<u></u><u></u></p>
<p class="MsoNormal">--<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://youtu.be/jmmcILTf88I" target="_blank"><span style="color:blue;text-decoration:none"><img border="0" width="624" height="114" src="cid:image001.jpg@01CD52E2.6DD75ED0" alt="Description: Colt @ 20 email sig"></span></a><span><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif"">Martin Ward<u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:12.0pt;font-family:"Arial Bold"">Manager, Technical Services<u></u><u></u></span></b></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif"">Service Operations
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="IT" style="font-size:10.0pt;font-family:"Arial","sans-serif"">DDI:<a href="tel:%2B44%20%280%29%2020%207863%205218" value="+442078635218" target="_blank">+44 (0) 20 7863 5218</a> / Fax: <a href="tel:%2B44%20%280%2920%207863%209999" value="+442078639999" target="_blank">+44 (0)20 7863 9999</a> /
<a href="http://www.colt.net/" target="_blank"><span style>www.colt.net</span></a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Colt Technology Services,
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Unit 12, Powergate Business Park, Volt Avenue, Park Royal, London, NW10 6PW,</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">
UK.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:7.0pt">Help reduce your carbon footprint | Think before you print. Registered in England and Wales, registered number 02452736, VAT number GB 645 4205 50<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
[Colt Disclaimer]
This email is from an entity of the Colt group of companies.
Colt Group S.A., K2 Building, Forte 1, 2a rue Albert Borschette, L-1246 Luxembourg, R.C.S. B115679.
Corporate and contact information for our entities can be found at
<a href="http://colt.net/uk/en/Colt-Group-of-Companies/index.htm" target="_blank">http://colt.net/uk/en/Colt-Group-of-Companies/index.htm</a>.
Internet communications are not secure and Colt does not accept
responsibility for the accurate transmission of this message. Content
of this email or its attachments is not legally or contractually binding
unless expressly previously agreed in writing by Colt
</div>
<br>_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
<br></blockquote></div><br></div>