<font size=2 face="sans-serif">Juergen,</font>
<br>
<br><font size=2 face="sans-serif">The file is read from top to down. The
process stops to read the file when it finds the first feature that matches.</font>
<br>
<br><font size=2 face="sans-serif">In your exemple, if a disk data comes
with the hostname Win32Server on the disk C, first thresholds are used
(C 85 90).</font>
<br><font size=2 face="sans-serif">Any server of class win32 on data disk
on the C drive will use the third thresholds (80 90)</font>
<br><font size=2 face="sans-serif">In any other cases for disk data, the
default thresholds will be used (90 95)</font>
<br>
<br><font size=2 face="sans-serif">Cordialement, Regards,Mit freundlichen
Grüßen,<br>
<br>
Gautier BEGIN<br>
<br>
</font>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Juergen Fischer/DEU/CSC@CSC</font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">xymon@xymon.com</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">08/13/2014 09:44 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[Xymon] precedence
of rules in analysis.cfg</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">"Xymon"
<xymon-bounces@xymon.com></font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 face="Courier New">Please can someone help me regarding
the precedence of rules in analysis.cfg?</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
analysis.cfg example to illustrate my questions:</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
#-----------------------------------------------------------</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
HOST=Win32Server</font><font size=3> </font><font size=2 face="Courier New"><br>
DISK C 85 90</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
DEFAULT</font><font size=3> </font><font size=2 face="Courier New"><br>
DISK * 90 95</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
CLASS=win32</font><font size=3> </font><font size=2 face="Courier New"><br>
DISK C 80 90</font><font size=3>
</font><font size=2 face="Courier New"><br>
LOG %.*
%error COLOR=yellow</font><font size=3>
</font><font size=2 face="Courier New"><br>
LOG eventlog:Application
%warning COLOR=yellow
IGNORE="%warning .* Symantec AntiVirus
.* Could not scan .* files inside .* due to extraction errors encountered
by the Decomposer Engines\.Application has encountered an error"</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
#-----------------------------------------------------------</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
Assumption: Host 'Win32Server' is a CLASS=win32 server running in central
mode</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
DISK questions:</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
1. Does Win32Server's C disk go yellow at 85, 90 or 95% ?</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
2. Is this because of the ORDER of the applying rules (first HOST, then
DEFAULT, then CLASS)</font><font size=3> </font><font size=2 face="Courier New"><br>
or is it because HOST is more specific then CLASS and CLASS is
more specific then DEFAULT?</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
3. Does Xymon at all try to find further possibly matching DISK rules after
the first matching</font><font size=3> </font><font size=2 face="Courier New"><br>
rule - underneath HOST in this example - has been encountered?</font><font size=3>
<br>
</font><font size=2 face="Courier New"><br>
LOG questions:</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
1. If an eventlog message happens to match the 1st of the above listed
LOG rules</font><font size=3> </font><font size=2 face="Courier New"><br>
(because it contains 'error'), will the second rule be evaluated
at all?</font><font size=3> </font><font size=2 face="Courier New"><br>
<br>
2. And if the 2nd rule should get evaluated, which of the 2 rules would
take precedence?<br>
(Assuming both rules logically match, but have conflicting effects
because of the IGNORE</font><font size=3> </font><font size=2 face="Courier New"><br>
- i.e. a line that matches the IGNORE and hence has also the word
'error' in it.</font><font size=3> </font><font size=2 face="Courier New"><br>
Will it be ignored, because the 2nd rule applies? Or will it show
yellow, because</font><font size=3> </font><font size=2 face="Courier New"><br>
the 1st rule applies? And why is this so?</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
3. The answers to the 2 prior questions will probably already have answered
this one:</font><font size=3> </font><font size=2 face="Courier New"><br>
Should specific LOG rules appear before or after the more general
ones to give to give</font><font size=3> </font><font size=2 face="Courier New"><br>
the first match precedence?</font><font size=3> <br>
</font><font size=2 face="Courier New"><br>
Many thanks<br>
Jürgen</font><tt><font size=2>_______________________________________________<br>
Xymon mailing list<br>
Xymon@xymon.com<br>
</font></tt><a href=http://lists.xymon.com/mailman/listinfo/xymon><tt><font size=2>http://lists.xymon.com/mailman/listinfo/xymon</font></tt></a><tt><font size=2><br>
</font></tt>
<br>