[hobbit] custom event log

[Henrik Stoerner]

On Wed, Jul 26, 2006 at 01:30:05AM +0200, Kolbjørn Barmen wrote:
> 
> I've set up an irc-bot to tail the allevents log, do some simple
> reformatting before puting it out on our "sysadm" channel.
> 
> First, what are all the columns in that log.. I dont grasp 5th and 8th :)

hostname, servicename, eventtime, changetime, duration, new color,
oldcolor, trend.

The "trend" value is 2 if the change is for the worse (eg yellow->red),
1 if it is getting better (red -> yellow). Anything else should not
happen.

But perhaps you shouldn't use the allevents log, but the Hobbit "status
change" channel, because:

> Secondly, is there a way to generate a similar log with a summary of the
> event attached at the end?

Try running (as the hobbit user):
   bbcmd hobbitd_channel --channel=stachg cat
What you'll get is a message whenever there is a test changes status.
The message begins with a line like

@@stachg#67898|1153893946.152988|10.29.75.39||myhost|disk|1153895746|red|yellow|1153892146|0||0|0

These fields, delimited by '|' signs, are:
* keyword + sequence number
* timestamp (1153893946.152988)
* IP of the host that sent the status message (10.29.75.39)
* A blank field (reserved for future use)
* hostname (myhost)
* servicename (disk)
* time when the status message *expires* (1153895746)
* the new color (red)
* the old color (yellow)
* time when the previous change happened (1153892146)
* If the status is disabled, then this has the time when the disabling
  expires (here: 0, so not disabled)
* The disable message (here it is empty)
* Downtime active flag - 1 if there is an active DOWNTIME setting for
  this test.
* client message timestamp - if we have a full Hobbit "client" message
  for this host, then this is the timestamp of the client message.

It is guaranteed that there are no '|' chars in this line, except those
that act as delimiters. If the disable message text contains '|' signs,
they have been transformed to "\p". Newlines in the disable message
should not happen, but if there are any they will show up as "\n".
Tabs are "\t".

After this line comes the full text of the status message, and the
message ends with a line containing only "@@"

Gobbling up these messages is fairly simple - there's a hobbitd_sample
utility included with Hobbit that does it in C, but I'm sure anyone with
a bit of experience could implement it in Perl.


Regards,
Henrik