<div dir="ltr">Have you looked at client-local.cfg on the xymon server? Or the man page for client-local.cfg? It's a bit finicky but may be able to do what you're asking without modifying any code.<div><br></div><div>=G=</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 10, 2018 at 5:32 PM, Larry Bonham <span dir="ltr"><<a href="mailto:larry@fni-stl.com" target="_blank">larry@fni-stl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-6991458447425937036WordSection1">
<p class="MsoNormal"><span style="color:#1f497d">Third request. I just can’t believe that I’m the only one having this problem. It is a fairly frequent occurrence for me. Mainly with higher volume log files.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">I simply want to drop any partial lines before they are compared with LOG alert definitions.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Based on the comments in logfetch.c (v4.3.28), the section between 509 and 562 would appear to handle this. But for whatever reason it is not consistently working for me. Maybe I’m overloading the MAXCHECK
value and it is just truncating the output? Or I’m misunderstanding what the section is actually doing?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Once again, any help would be appreciated.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Larry B.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Larry Bonham
<br>
<b>Sent:</b> Monday, March 5, 2018 10:05 AM<br>
<b>To:</b> <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>
<b>Subject:</b> RE: Force logfetch to only process complete lines?<u></u><u></u></span></p>
</div>
</div><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="color:#1f497d">Second request. No one else having this particular problem? Any help would be appreciated. Modifying logfetch.c is pretty much beyond my limited C skills.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Thanks.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d">Larry B.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Xymon [<a href="mailto:xymon-bounces@xymon.com" target="_blank">mailto:xymon-bounces@xymon.<wbr>com</a>]
<b>On Behalf Of </b>Larry Bonham<br>
<b>Sent:</b> Monday, February 26, 2018 5:28 PM<br>
<b>To:</b> <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>
<b>Subject:</b> [Xymon] Force logfetch to only process complete lines?<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">RHEL 6.9 and RHEL 7.4 <u></u><u></u></p>
<p class="MsoNormal">Xymon v4.3.28 <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">This may be documented somewhere and I’m just not able to find it. But is there a way to force logfetch to only scan complete lines and discard any partials it might retrieve based on the MAXCHECK setting?
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I’ve been getting quite a few alerts on highly active systems where the offending line would normally be excluded due to the first part of a search that is missing.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">A simple example, I want to ignore the alert triggers for /var/log/messages where the system name is test-system and :\sheader\ssubject: is also in the line. Since test-system comes right after the date/time stamp, that causes the ignore
check to not work if test-system is not retrieved by logfetch. <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">analysis.cfg <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"># Red alert on CRITICAL or ERROR or SERIOUS (with exceptions)
<u></u><u></u></p>
<p class="MsoNormal">LOG %.* %(?-i)CRITICAL|ERROR|SERIOUS COLOR=red IGNORE=%(?-i)test-system.*:\<wbr>sheader\ssubject:
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">I’ve tried adjusting the MAXCHECK setting but it didn’t make a difference one way or the other.
<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">client-local.cfg <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">log:/var/log/messages:10240 <wbr> # 10KB default <u></u>
<u></u></p>
<p class="MsoNormal">log:/var/log/messages:1024000 <wbr> # 1MB <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Thanks. <u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">==============================<wbr>===========================<br>
<br>
Larry D. Bonham<br>
<br>
Financial Network Inc.<br>
10401-F Baur<br>
Olivette, MO 63132<br>
<br>
(314) 400-9412 voice<br>
(314) 997-5647 fax</span><span style="font-size:12.0pt;font-family:"Times New Roman","serif"">
<br>
</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">==============================<wbr>===========================
</span><u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><u></u> <u></u></span></p>
</div></div></div><div><div class="h5">
<br>
<hr>
<font face="Arial" color="Black" size="3"><br>
CONFIDENTIALITY NOTICE:<br>
This electronic mail message is intended exclusively for<br>
recipient to which it is addressed. The contents of this message<br>
and any attachments may contain confidential and privileged<br>
information. Any unauthorized review, use, print, storage, copy,<br>
disclosure or distribution is strictly prohibited. If you have<br>
received this message in error, please advise the sender<br>
immediately by replying to the message's sender and delete all<br>
copies of this message and its attachments without disclosing<br>
the contents to anyone, or using the contents for any purpose.<br>
</font>
</div></div></div>
<br>______________________________<wbr>_________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/<wbr>mailman/listinfo/xymon</a><br>
<br></blockquote></div><br></div>