[hobbit] log file monitoring issues

[Henrik Stoerner]

On Fri, Aug 11, 2006 at 01:37:28PM -0400, Gary B. wrote:
> Hmm.  Any ideas why the following wouldn't work?
> 
> log:/var/log/messages:10240
> ignore upsd* Client|Connection 127.0.0.1
> ignore session opened|closed for user mailman|root

Two errors: 

The first line has a wrong regex - it's a classic mistake to use 
"*" by itself to mean "anything", but that's not what it does. 
Your expression should be
   ignore upsd.* Client|Connection 127.0.0.1

Second, you can only have one "ignore" line. I admit that it would 
probably be useful to have multiple ignore lines, but that is
not possible right now.

> The "full log" output is still showing those lines.  Could it be the
> same reason I wasn't seeing any data at all on the other servers; that
> is, the log file just hasn't been updated, and it's still showing
> those from previous lines?

No, Hobbit processes all of the logfile data through the ignore- and
trigger patterns each time it sends a message to the server.

> If so, is there a way I could tell Hobbit to clear the existing data?

Yes: Delete the ~hobbit/client/tmp/logfetch.HOSTNAME.status file.


Regards,
Henrik