<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks Galen. I really appreciate the response.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I have looked at client-local.cfg and experimented with different settings. Do you know if there is a practical limit to the size setting? I know 10240 is
the default but I would like it as large as possible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Most of my problems are related to LOG settings in analysis.cfg. I could try moving all that to client-local.cfg. I am correct in saying that client-local.cfg
does require duplication of global settings if you have settings for a specific host (e.g. settings based on class RHEL7 will need to be duplicated for specific hosts)? We have over 250 so I’d like as many lumped together as possible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’ll review all this and reply tomorrow. Thanks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Larry<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Galen Johnson [mailto:solitaryr@gmail.com]
<br>
<b>Sent:</b> Thursday, May 10, 2018 8:12 PM<br>
<b>To:</b> Larry Bonham<br>
<b>Cc:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] Force logfetch to only process complete lines?<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">To be a bit more explicit...this section from the manpage:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><i><span style="font-family:"Courier New";color:black;background:white">LOGFILE</span></i></b><i><span style="font-family:"Courier New";color:black;background:white">
<b>CONFIGURATION</b> <b>ENTRIES</b> </span></i><i><span style="font-family:"Courier New""><br>
A logfile configuration entry looks like this: <br>
<br>
log:/var/log/messages:10240 <br>
ignore MARK <br>
trigger Oops <br>
<br>
The <b><span style="color:black;background:white">log:FILENAME:SIZE</span></b><span style="color:black;background:white"> line defines the filename of the log, and the maximum amount of data (in bytes) to send to the Xymon server. FILENAME is usually
an explicit full-path </span>filename on the client. If it is enclosed in backticks, it is a command which the Xymon client runs and each line of output from this command is then used as a filename. This allows scripting which files to monitor, e.g.
if you have logfiles that are named with some sort of timestamp. If FILENAME is enclosed in angle brackets it is treated as a glob and passed through the local glob(3) function first.
<br>
<br>
The <b><span style="color:black;background:white">ignore</span></b><span style="color:black;background:white">
<b>PATTERN</b> line (optional) defines lines in the logfile which are ignored entirely, i.e. they are stripped from the logfile data before sending it to the Xymon
</span>server. It is used to remove completely unwanted "noise" entries from the logdata processed by Xymon. "PATTERN" is a regular expression.
<br>
<br>
The <b><span style="color:black;background:white">trigger</span></b><span style="color:black;background:white">
<b>PATTERN</b> line (optional) is used only when there is more data in the log than the maximum size set in the "log:FILENAME:SIZE" line. The "trigger" pattern is then
</span>used to find particularly interesting lines in the logfile - these will always be sent to the Xymon server. After picking out the "trigger" lines, any remaining space up to the maximum size is filled in with the most recent entries from the logfile.
"PATTERN" is a regular expression.</span></i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">IIRC, you can even have multiple <i>ignore</i> entries. You should have messages in your xymon logs if the file is too big when it's fetched...also, I think you will also run up against the Xymon max data size in the server configs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">=G=<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="3"><br>
CONFIDENTIALITY NOTICE:<br>
This electronic mail message is intended exclusively for<br>
recipient to which it is addressed. The contents of this message<br>
and any attachments may contain confidential and privileged<br>
information. Any unauthorized review, use, print, storage, copy,<br>
disclosure or distribution is strictly prohibited. If you have<br>
received this message in error, please advise the sender<br>
immediately by replying to the message's sender and delete all<br>
copies of this message and its attachments without disclosing<br>
the contents to anyone, or using the contents for any purpose.<br>
</font>
</body>
</html>