<div dir="ltr">I'm with Robert - simple and good enough is often better than perfect but unfathomable. Consider how likely it is that you would care about a filesystem mounted under /tmp to be full.<div><br></div><div>Here's a slightly more accurate match, but still very simple:</div><div><br></div><div>DISK %^/tmp/\{.*\} IGNORE</div><div><br></div><div>This will match any string in the form {*}.</div><div><br></div><div>Another option is to add "delayred=disk:5" into the hosts.cfg entry for the hosts that get the local backups. This will delay the alert long enough for the filesystem to be un-mounted. However, there's a risk that a genuine alert for another filesystem is delayed by 5 minutes.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 9 Feb 2021 at 02:44, Damien Martins via Xymon <<a href="mailto:xymon@xymon.com">xymon@xymon.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br><br><br>---------- Forwarded message ----------<br>From: Damien Martins <<a href="mailto:damien@makelofine.org" target="_blank">damien@makelofine.org</a>><br>To: <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>Cc: <br>Bcc: <br>Date: Mon, 8 Feb 2021 16:44:22 +0100<br>Subject: Re: [Xymon] Ignoring Veeam Backup filesystems<br>
<div bgcolor="#FFFFFF">
<p>Hello Robert,</p>
<p>If you do not expect to mount something else in /tmp, you may use
something like:<br>
DISK %^/tmp/.* IGNORE<br>
seems easier to read and understand, however may be too wide.</p>
<p>If you expect to mount something else in /tmp, then your regex
seems OK and unavoidable<br>
</p>
<div>Le 08/02/2021 à 16:38, Robert Herron a
écrit :<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div>I'm deploying Veeam Backup & Replication to perform
systems. I have a few Linux hosts that require being backed
up via the local agent instead of using a VM-based backup.
The backups run in the middle of the night as you might
expect. 2AM Sunday, I received a full filesystem alarm on a
Linux host I'm testing. It cleared in the next test sweep 5
minutes later but the unnecessarily alarms woke me up. I want
to minimize that from happening.</div>
<div><br>
</div>
<div>The Veeam agent creates and mounts devices under /tmp for
the backup. The df line from the filesystem alarm looks like:</div>
<div style="margin-left:40px"><span style="font-family:monospace">Filesystem 1024-blocks
Used Available Capacity Mounted on<br>
</span></div>
<div style="margin-left:40px"><span style="font-family:monospace">/dev/veeamimage7 4128448
4026052 0 100%
/tmp/{16296b8b-8ad4-6614-6da9-aacdc519bd6b}</span></div>
<div><br>
</div>
<div>The actual filesystem name is different on each host. I
assume it's based on the host's BIOS UUID or the block ID. I
don't want to add individual lines for each host.<br>
</div>
<div><br>
</div>
<div>I want to add the following line to my analysis.cfg in the
"CLASS=linux" section:</div>
<div style="margin-left:40px"><span style="font-family:monospace">DISK
%^/tmp/\{[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}\}
IGNORE</span></div>
<div><br>
</div>
<div>Questions:</div>
<div>1.) Is this regex valid for the analysis.cfg?</div>
<div>2.) Is there a better way to handle this?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>--Robert.<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr"><br>
Robert Herron<br>
<a href="mailto:robert.herron@gmail.com" target="_blank">robert.herron@gmail.com</a></div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
Xymon mailing list
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a>
</pre>
</blockquote>
</div>
<br><br><br>---------- Forwarded message ----------<br>From: Damien Martins via Xymon <<a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a>><br>To: <a href="mailto:xymon@xymon.com" target="_blank">xymon@xymon.com</a><br>Cc: <br>Bcc: <br>Date: Mon, 8 Feb 2021 16:44:22 +0100<br>Subject: Re: [Xymon] Ignoring Veeam Backup filesystems<br>_______________________________________________<br>
Xymon mailing list<br>
<a href="mailto:Xymon@xymon.com" target="_blank">Xymon@xymon.com</a><br>
<a href="http://lists.xymon.com/mailman/listinfo/xymon" rel="noreferrer" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br>
</blockquote></div>