<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div></div>
<div>Ok - another angle. I feel I am SO close.</div><div><br></div><div>so I have a cleint with message logs with filename format</div><div><br></div><div>/var/log/messages-YYYYMMDD.log<br>It contains a trigger word DIDDS</div><div><br></div><div>client-local.cfg on the xymon SERVER contains<br><br><span><div>[linux]</div><div>log:/var/log/messages:10240</div><div><b><font color="#cd232c">log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240</font></b></div><div>log:/var/log/maillog:10240<br></div><div>log:/var/log/secure:10240</div><div>ignore MARK</div><div><br></div><div><br></div><div>The client's msgs GUI page shows<br><br><span><div>No entries in /var/log/messages</div><div>No entries in /var/log/messages-20180816.log<br></div><div>No entries in /var/log/maillog<br></div><div>No entries in /var/log/secure<br></div><div><br></div><div><br></div><div>Full log /var/log/messages</div><div>Full log /var/log/messages-20180816.log<br></div><div>Full log /var/log/maillog<br></div><div>Full log /var/log/secure<br></div><div><br></div></span><span><div><span><div><br></div></span></div><div>ie it can find/knows about that respective messages file.<br><br>However...<br><br>in analysis.cfg, for the respective client this line<br><span><div> LOG %/var/log/messages*.log "DIDDS" COLOR=yellow<br><br>doesn't flag anything - even if the string DIDDS is in that messages-20180816.log file ..</div><div><br></div><div>hence the line in the GUI</div><div><br></div></span><span><span style="color: rgb(0, 0, 0); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 10px;">No entries in /var/log/messages-20180816.log<br></span></span><br><br>SO CLOSE.<br><br>what am I missing here?<br><br><br><br>Because if I merely use<br><span><div>LOG %/var/log/messages "DIDDS" COLOR=yellow</div><div><br></div></span>with DIDDS within /var/log/messages it goes yellow almost immediately.</div><div><br></div><div>???</div><div><br></div><div>didds</div><div><br></div></span><br></div><div><br></div><div><br></div></span><br></div></div></div></body></html>