[hobbit] process check problem

[Adam Scheblein]

Henrik Stoerner wrote:

>On Tue, Nov 15, 2005 at 09:08:28AM -0600, Adam Scheblein wrote:
>  
>
>>Greetings,
>>
>>I have modified the ps in all my clients so that it also sends out 
>>per-process cpu usage, and now am trying to use a regular perl 
>>expression in the search for processes with a certain usage percentage.  
>>Here is what i have:
>>%(8\d{2}\.\d{2})|(9[0-4]\.\d{2}) and %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) as 
>>2 of my searches
>>    
>>
>
>I think you have an error in that first expression - the "8\d{2}" seems
>wrong, if you want it to match number 80-89. It should be "8\d" without
>the "{2}".
>
>  
>
OK -- i checked my rules, and realized that i typed them into the e-mail 
wrong -- here is a direct cut/paste
PROC %(8\d\.\d{2})|(9[0-4]\.\d{2}) 0 0 yellow
PROC %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) 0 0 red

After i pasted this i realized that i was also pulling IP addresses, so 
i changed the rules to this:
PROC %\s+((8\d\.\d{2})|(9[0-4]\.\d{2}))\s+ 0 0 yellow
PROC %\s+((9[5-9]\.\d{2})|(1\d{2}\.\d{2}))\s+ 0 0 red


Which now work, but seems to be acting strange because when it finds a 
bad process it reports this(keep in mind that these are sorted by cpu 
usage and nothing has been edited/cut out):

red %\s+((9[5-9]\.\d{2})|(1\d{2}\.\d{2}))\s+ (found 7, req. at most 0)

adam     18178 18176 99.63 11:19:16 pts/3       02:00 -bash
root        19     0  0.55  Nov  8  ?           05:29 vxfsd

so i am not sure where the "found 7" is coming from, when clearly there 
is only 1...

Thanks,
Adam

>>These don't work however, because they pull up everything that is 8.xx 
>>8x.xx 9.xx 9x.xx 1.xx 1x.xx and 1xx.xx
>>    
>>
>
>I'm not sure what data you're feeding it, but I tried with this setup in
>hobbit-clients.cfg:
>
>HOST=localhost
>        PROC %(8\d\.\d{2})|(9[0-4]\.\d{2}) 0 0
>	PROC %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) 0 0
>
>This will give a red if any of the commands in the "ps" listing has the
>percentages 80-94 or 95-100. Now let's test it:
>
>$ bbcmd hobbitd_client --test
>Hostname (.=end, ?=dump, !=reload) [localhost]: localhost
>Test (cpu, mem, disk, proc): proc
>ps command string: 82.31 ls
>ps command string:
>Process %(8\d\.\d{2})|(9[0-4]\.\d{2}) color red: Count=1, min=0, max=0
>Process %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) color green: Count=0, min=0, max=0
>
>Good, the ps commandline string "82.31 ls" is matched as it should be.
>
>Hostname (.=end, ?=dump, !=reload) [localhost]:
>Test (cpu, mem, disk, proc): proc
>ps command string: 8.29 ls
>ps command string:
>Process %(8\d\.\d{2})|(9[0-4]\.\d{2}) color green: Count=0, min=0, max=0
>Process %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) color green: Count=0, min=0, max=0
>
>And the string "8.29 ls" is not matched. 
>
>Hostname (.=end, ?=dump, !=reload) [localhost]:
>Test (cpu, mem, disk, proc): proc
>ps command string: 100.00 muncher
>ps command string:
>Process %(8\d\.\d{2})|(9[0-4]\.\d{2}) color green: Count=0, min=0, max=0
>Process %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) color red: Count=1, min=0, max=0
>
>"100.00 muncher" is also matched
>
>Hostname (.=end, ?=dump, !=reload) [localhost]:
>Test (cpu, mem, disk, proc): proc
>ps command string: 1.00 low
>ps command string:
>Process %(8\d\.\d{2})|(9[0-4]\.\d{2}) color green: Count=0, min=0, max=0
>Process %(9[5-9]\.\d{2})|(1\d{2}\.\d{2}) color green: Count=0, min=0, max=0
>
>But "1.00 low" is now matched.
>
>
>So either your rules are different from what I've used, or your ps
>output is unlike that which I used. I think you'll need to post some
>more details for us to figure out what the problem is.
>
>
>Regards,
>Henrik
>
>
>To unsubscribe from the hobbit list, send an e-mail to
>hobbit-unsubscribe at hswn.dk
>
>
>  
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20051115/91a00dc9/attachment.html>