<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Second request. No one else having this particular problem? Any help would be appreciated. Modifying logfetch.c is pretty much beyond my limited C skills.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Larry B.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [mailto:xymon-bounces@xymon.com]
<b>On Behalf Of </b>Larry Bonham<br>
<b>Sent:</b> Monday, February 26, 2018 5:28 PM<br>
<b>To:</b> xymon@xymon.com<br>
<b>Subject:</b> [Xymon] Force logfetch to only process complete lines?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">RHEL 6.9 and RHEL 7.4 <o:p></o:p></p>
<p class="MsoNormal">Xymon v4.3.28 <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">This may be documented somewhere and I’m just not able to find it. But is there a way to force logfetch to only scan complete lines and discard any partials it might retrieve based on the MAXCHECK setting?
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I’ve been getting quite a few alerts on highly active systems where the offending line would normally be excluded due to the first part of a search that is missing.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">A simple example, I want to ignore the alert triggers for /var/log/messages where the system name is test-system and :\sheader\ssubject: is also in the line. Since test-system comes right after the date/time stamp, that causes the ignore
check to not work if test-system is not retrieved by logfetch. <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">analysis.cfg <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"># Red alert on CRITICAL or ERROR or SERIOUS (with exceptions)
<o:p></o:p></p>
<p class="MsoNormal">LOG %.* %(?-i)CRITICAL|ERROR|SERIOUS COLOR=red IGNORE=%(?-i)test-system.*:\sheader\ssubject:
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I’ve tried adjusting the MAXCHECK setting but it didn’t make a difference one way or the other.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">client-local.cfg <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">log:/var/log/messages:10240 # 10KB default <o:p>
</o:p></p>
<p class="MsoNormal">log:/var/log/messages:1024000 # 1MB <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Thanks. <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">=========================================================<br>
<br>
Larry D. Bonham<br>
<br>
Financial Network Inc.<br>
10401-F Baur<br>
Olivette, MO 63132<br>
<br>
(314) 400-9412 voice<br>
(314) 997-5647 fax</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">=========================================================
</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<hr size="2" width="100%" align="center">
</span></div>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Arial","sans-serif";color:black"><br>
CONFIDENTIALITY NOTICE:<br>
This electronic mail message is intended exclusively for<br>
recipient to which it is addressed. The contents of this message<br>
and any attachments may contain confidential and privileged<br>
information. Any unauthorized review, use, print, storage, copy,<br>
disclosure or distribution is strictly prohibited. If you have<br>
received this message in error, please advise the sender<br>
immediately by replying to the message's sender and delete all<br>
copies of this message and its attachments without disclosing<br>
the contents to anyone, or using the contents for any purpose.</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p></o:p></span></p>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="3"><br>
CONFIDENTIALITY NOTICE:<br>
This electronic mail message is intended exclusively for<br>
recipient to which it is addressed. The contents of this message<br>
and any attachments may contain confidential and privileged<br>
information. Any unauthorized review, use, print, storage, copy,<br>
disclosure or distribution is strictly prohibited. If you have<br>
received this message in error, please advise the sender<br>
immediately by replying to the message's sender and delete all<br>
copies of this message and its attachments without disclosing<br>
the contents to anyone, or using the contents for any purpose.<br>
</font>
</body>
</html>