<div dir="ltr">There's always a way (it's open source after all) but nothing simple comes to mind.<div><br></div><div>If it were me, I would create my own log monitoring subsystem and have it report into Xymon after working out $MACHINE from the logfile (or some configuration). You might be able to do this sort of thing using swatch, sawmill or splunk.</div><div><br></div><div>Another option might be to create a job that runs your own instance of logtetch after setting MACHINE the way you want it. Something like this:</div><div><br></div><div>#!/bin/sh</div><div>[ "$XYMON" ] || { echo "Plese run using xymoncmd"; exit 1; }</div><div>MACHINEDOTS="Server09"<br></div><div><span style="font-size:12.8000001907349px">LOGFILE="/opt/syslogs/$MACHINE/</span><span style="font-size:12.8000001907349px">apache2.error.log"</span><br></div><div><span style="font-size:12.8000001907349px">LOGFETCHCFG=/tmp/logfetch.$MACHINE.cfg</span></div><div><span style="font-size:12.8000001907349px">LOGFETCHSTATUS=/tmp/logfetch.$MACHINE.status</span></div><div>{<br></div><div> echo "client/apachelog" $MACHINEDOTS.$OSTYPE"</div><div> echo "[msgs:$LOGFILE]"</div><div> $XYMONHOME/bin/logfetch $LOGFETCHCFG $LOGFETCHSTATUS > $TEMPFILE</div><div>} | $XYMON $XYMSRV @<br></div><div><br></div><div>Note that the logfetch config file (/tmp/logfetch.$MACHINE.cfg) is something you'd need to fill out yourself, probably with the relevant entry from your client-local.cfg file.</div><div><br></div><div>Alternatively, you could create this file dynamically from queries to the server. You can get the "log:" entries for Server09 by issuing the following command (from any Xymon client, not just Server09):</div><div><br></div><div>$XYMON $XYMSRV "client/bogus Server09.bogos"</div><div><br></div><div>But first you'd have to have the "log:" entry in client-local.cfg moved from [syslogserver] to a new [Server09] section if it doesn't already exist.</div><div><br></div><div>From this, you could (optionally) grep out the "apache2.error.log" entries, drop them directly into $LOGFETCHCFG for the server, and then the logfetch command can go to work.</div><div><br></div><div>If the Server09 server already has its own entry in client-local.cfg, then you don't want Server09 trying to do the log processing that syslogserver is already doing. So you could create a special entry for [syslogserver-Server09] and adjust the script accordingly.</div><div><br></div><div>I hope that all makes sense.</div><div><br></div><div>J</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 30 December 2014 at 05:32, usa ims via Xymon <span dir="ltr"><<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
<br><br>---------- Forwarded message ----------<br>From: usa ims <<a href="mailto:usaims@yahoo.com">usaims@yahoo.com</a>><br>To: <a href="mailto:xymon@xymon.com">xymon@xymon.com</a><br>Cc: <br>Date: Mon, 29 Dec 2014 10:29:42 -0800<br>Subject: monitoring multiple log files on a single syslog server<br>Greetings,<br>
<br>
I'm monitoring multiple log files on a single syslog server.<br>
<br>
I have a syslog server that stores the apache error logs in a server named ‘syslogserver’ looking for the word ‘CurlTransfer’.<br>
When xymon finds the word ‘CurlTransfer’ it sends an alert but it alerts that it is coming from ‘syslogserver’ and the guys are complaining that ‘nongreen.html’ is reporting the servername rather than the actual name of the server where the error originated from.<br>
<br>
Is there a way if xymon finds the word ‘CurlTransfer’ in ‘/opt/syslogs/Server09/apache2.error.log’, to get it to report in the ‘msgs’ column that it came from ‘Server09’?<br>
<br>
<br>
Here is my current config for this.<br>
<br>
[syslogserver]<br>
log:/opt/syslogs/Server09/apache2.error.log:4096<br>
log:/opt/syslogs/Server10/apache2.error.log:4096<br>
log:/opt/syslogs/Server11/apache2.error.log:4096<br>
log:/opt/syslogs/Server12/apache2.error.log:4096<br>
log:/opt/syslogs/Server13/apache2.error.log:4096<br>
<br>
I have configured my analysis.cfg with:<br>
<br>
HOST= syslogserver<br>
LOG /opt/syslogs/Server09/apache2.error.log CurlTransfer COLOR=red<br>
LOG /opt/syslogs/Server10/apache2.error.log CurlTransfer COLOR=red<br>
LOG /opt/syslogs/Server11/apache2.error.log CurlTransfer COLOR=red<br>
LOG /opt/syslogs/Server12/apache2.error.log CurlTransfer COLOR=red<br>
LOG /opt/syslogs/Server13/apache2.error.log CurlTransfer COLOR=red<br>
<br>
<br>
Thanks in advance.<br>
<br>
usaims<br>
<br></blockquote></div><br></div>