<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">RHEL 6.9 and RHEL 7.4<o:p></o:p></p>
<p class="MsoNormal">Xymon v4.3.28<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This may be documented somewhere and I’m just not able to find it. But is there a way to force logfetch to only scan complete lines and discard any partials it might retrieve based on the MAXCHECK setting?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been getting quite a few alerts on highly active systems where the offending line would normally be excluded due to the first part of a search that is missing.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A simple example, I want to ignore the alert triggers for /var/log/messages where the system name is test-system and :\sheader\ssubject: is also in the line. Since test-system comes right after the date/time stamp, that causes the ignore
check to not work if test-system is not retrieved by logfetch.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">analysis.cfg<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"># Red alert on CRITICAL or ERROR or SERIOUS (with exceptions)<o:p></o:p></p>
<p class="MsoNormal">LOG %.* %(?-i)CRITICAL|ERROR|SERIOUS COLOR=red IGNORE=%(?-i)test-system.*:\sheader\ssubject:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve tried adjusting the MAXCHECK setting but it didn’t make a difference one way or the other.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">client-local.cfg<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">log:/var/log/messages:10240 # 10KB default<o:p></o:p></p>
<p class="MsoNormal">log:/var/log/messages:1024000 # 1MB<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">=========================================================<br>
<br>
Larry D. Bonham<br>
<br>
Financial Network Inc.<br>
10401-F Baur<br>
Olivette, MO 63132<br>
<br>
(314) 400-9412 voice<br>
(314) 997-5647 fax</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">=========================================================<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="3"><br>
CONFIDENTIALITY NOTICE:<br>
This electronic mail message is intended exclusively for<br>
recipient to which it is addressed. The contents of this message<br>
and any attachments may contain confidential and privileged<br>
information. Any unauthorized review, use, print, storage, copy,<br>
disclosure or distribution is strictly prohibited. If you have<br>
received this message in error, please advise the sender<br>
immediately by replying to the message's sender and delete all<br>
copies of this message and its attachments without disclosing<br>
the contents to anyone, or using the contents for any purpose.<br>
</font>
</body>
</html>