<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What I meant by non standard log file was just not the default /var/adm/messages.<o:p></o:p></p>
<p class="MsoNormal">Looking at the contents of a different file example /var/adm/6800.log.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Server client-local.cfg file<o:p></o:p></p>
<p class="MsoNormal">[Fully-Qualified-Hostname]<o:p></o:p></p>
<p class="MsoNormal">log:/var/adm/messages:10240<o:p></o:p></p>
<p class="MsoNormal">file:/var/adm/6800.log<o:p></o:p></p>
<p class="MsoNormal">log:/var/adm/6800.log:10240<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Update I did find my trouble. I was updating 1 of 2 xymon servers correctly the test/backup server but I found the primary xymon server was over writing my changes in the tmp/logfetch.Fully-Qualified-Hostname.cfg after the test/backup server
made the changes. I was in a loop where 1 xymon server made the change and the other xymon server changed it back.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for pointing out the xymon server updates the client tmp/logfetch.Fully-Qualified-Hostname.cfg when you make changes to the servers etc/client-local.cfg<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks<o:p></o:p></p>
<p class="MsoNormal">Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Jeremy Laidman <jeremy@laidman.org> <br>
<b>Sent:</b> Wednesday, June 22, 2022 6:53 PM<br>
<b>To:</b> POLYAK, TIM P <tp6891@att.com><br>
<b>Cc:</b> xymon@xymon.com<br>
<b>Subject:</b> Re: [Xymon] trying to monitor non-standard logfile with server client-local.cfg and failing<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Tim<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">On Thu, 23 Jun 2022 at 02:24, POLYAK, TIM P <<a href="mailto:tp6891@att.com">tp6891@att.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I am trying to monitor non-standard logfile with server client-local.cfg and failing.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you explain how it's non-standard? Are you trying to monitor the contents or the attributes of the file? Would a "log:/var/adm/6800.log" entry be more suitable for a logfile?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Here is what I tried so far in the client-local.cfg file<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[host=hostname]<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">file:/var/adm/6800.log<br>
and<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[hostname]<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">file:/var/adm/6800.log<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The correct format is the latter.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Firstly, note that it can take something like 10 minutes for log/file monitoring to start reporting due to delays in propagating the config to the clients, and then for the clients to report back again based on the config.<br>
<br>
What I would do is look in the $XYMONTMP directory on the client (defined in xymonclient.cfg, often /tmp, /var/tmp or /dev/shm) for the temporary files created by the client. They will be called logfetch.<hostname>.cfg and logfetch.<hostname>.status.<br>
<br>
The cfg file is essentially just the [hostname] section from the client-local.cfg, retrieved when the client last reported to the server.<br>
<br>
The status file has a line for every "file:" entry in the client-local.cfg file, and is used to track the logfile position on each run. If you don't have any "file:" entries in your client-local.cfg file for a server, it might not have a status file.<br>
<br>
So, first see if the cfg file is present. If not, your update to client-local.cfg might not have been detected by the xymond process on the Xymon server. Usually it picks this up by itself, but if not, you could restart xymond and see if that helps (again,
wait 10 minutes to see progress). If the cfg file is present, see if its contents make sense (that is, match what's in the client-local.cfg file on the server).<br>
<br>
J<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>