<div dir="ltr"><div>Ah, I worked it out. In client-local.cfg, the patterns after "ignore" and "trigger" are defined as "regular expression". This is unlike (say) analysis.cfg where patterns HOST and LOG keywords are defined as "string or regular expression" and the "%" signifies a regular expression. Also, in client-local.cfg, strings with spaces must be enclosed in quotes, wherease in client-local.cfg, everything after the keyword (eg ignore, trigger) is treated as the regular expression. So in client-local.cfg you must not include a % or quotes. Instead you want something like:</div><div><br></div><div>[host=test_server_41]<br>log:/var/log/messages:1024000<br>ignore (Failed to fetch|Failed to parse|Failed to evaluate)<br>trigger (ORA-04091|Failed to log off resource|Failed to log on resource)<br></div><div><br></div><div>It can be very painful to troubleshoot problems with client-local.cfg configs, especially as it can take up to 10 minutes for updates to propagate to clients and generate new results. I like to create my own copy of the logfile and the client-local.cfg snippet, and manually run logfetch (which is what processes the client-local.cfg lines). For example, this is what I used to diagnose Colin's problem:</div><div><br></div><div><font face="monospace">xymon@server:/tmp/logfetch-test><b> ls -l</b><br>total 8<br>-rw-r--r-- 1 xymon xymon 160 2019-09-18 16:49 my-client-local.cfg<br>-rw-r--r-- 1 xymon xymon 273 2019-09-18 16:34 my-logfile.log</font></div><div><font face="monospace"><br>xymon@server:/tmp/logfetch-test> <b>cat my-logfile.log</b><br>log line 1 ignore Failed to fetch bla bla<br>log line 2 ignore Failed to parse bla bla<br>log line 3 ignore Failed to evaluate bla bla<br>log line 4 trigger ORA-04091 bla bla<br>log line 5 trigger Failed to log off resource bla bla<br>log line 6 trigger Failed to log on resource bla bla</font></div><div><font face="monospace"><br>xymon@server:/tmp/logfetch-test> <b>cat my-client-local.cfg</b><br>log:my-logfile.log:1024000<br>ignore (Failed to fetch|Failed to parse|Failed to evaluate)<br>trigger (ORA-04091|Failed to log off resource|Failed to log on resource)</font></div><div><font face="monospace"><br>xymon@server:/tmp/logfetch-test> <b>$XYMONCLIENTHOME/bin/logfetch my-client-local.cfg /dev/null</b><br>[msgs:my-logfile.log]<br>log line 4 trigger ORA-04091 bla bla<br>log line 5 trigger Failed to log off resource bla bla<br>log line 6 trigger Failed to log on resource bla bla<br><br>[logfile:my-logfile.log]<br>type:100000 (file)<br>mode:644 (-rw-r--r--)<br>linkcount:1<br>owner:1984 (xymon)<br>group:1984 (xymon)<br>size:273<br>clock:1568789652 (2019/09/18-16:54:12)<br>atime:1568789652 (2019/09/18-16:54:12)<br>ctime:1568788625 (2019/09/18-16:37:05)<br>mtime:1568788446 (2019/09/18-16:34:06)</font><br><br></div><div>Cheers</div><div>Jeremy</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 18 Sep 2019 at 16:18, Colin Coe <<a href="mailto:colin.coe@gmail.com">colin.coe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Jeremy<div><br></div><div>What I'm finding is that I'm getting SMS alerts from Xymon about lines in /var/log/messages such as "Failed to evaluate"," Failed to fetch", and "Failed to calculate" which are normal for the application we're running. I only want SMS alerts about the Oracle error and failed to log o/off resource.</div><div><br></div><div>Thanks</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 18, 2019 at 1:37 PM Jeremy Laidman <<a href="mailto:jeremy@laidman.org" target="_blank">jeremy@laidman.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">"After picking out the "trigger" lines, any remaining space up to the maximum size is filled in with the most recent entries from the logfile."<div><br></div><div>So it will include what you request as well as whatever else that will fit.</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 18 Sep 2019 at 09:32, Colin Coe <<a href="mailto:colin.coe@gmail.com" target="_blank">colin.coe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi all<div><br></div><div>I have this entry in client-local.cfg</div><div>--- </div><div>[host=test_server_41]<br>log:/var/log/messages:1024000<br>ignore "%(Failed to fetch|Failed to parse|Failed to evaluate)"<br>trigger "%(ORA-04091|Failed to log off resource|Failed to log on resource)"<br></div><div>--- </div><div><br></div><div>And in analysis.cfg I have:</div><div>--- </div><div>HOST=
test_server_41
<br> LOG /var/log/messages %(ORA-04091|Failed to log off resource|Failed to log on resource) IGNORE=OCS color=red<br></div><div>--- </div><div><br></div><div>Needless to say I'm getting alerts for more than just "ORA-04091", "Failed to log off resource", and "Failed to log on resource".</div><div><br></div><div>Any ideas what I'm doing wrong?</div><div><br></div><div>Thanks</div><div><br></div></div>
_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote></div>
</blockquote></div>
</blockquote></div>