[hobbit] LOG monitoring from serverside

[David Gore]

ZanDAhaR wrote:
> Dominique Frise wrote:
>> ZanDAhaR wrote:
>>> Hi All
>>>
>>> I have been playing with the latest release of the client and sever 
>>> over the past few days and have managed to get everything working 
>>> (and some cool new bits) apart from the log file monitoring. I can 
>>> get it so it shows the log file on the hobbit display/web but I 
>>> cannot get it to search for anything and cause a status change
>>>
>>> I have this in client-local.cfg
>>> [db184.corporatesystems.com.au]
>>> file:/usr/bin/make
>>> file:/usr/bin/gcc
>>> log:/var/log/messages:10240
>>>
>>> And then this in the hobbit-clients.cfg
>>>
>>> HOST=db184.corporatesystems.com.au
>>>    PORT "LOCAL=%([.:]10042)" state=LISTEN TEXT=WEBMIN
>>>    PORT "LOCAL=%([.:]22)" state=LISTEN TEXT=SSH
>>>    PORT "LOCAL=%([.:]50000)" state=LISTEN TEXT=DB2
>>>    PROC cron 1 -1 yellow
>>>    FILE /usr/bin/make MODE=644
>>>    FILE /usr/bin/gcc MODE=644
>>>    LOG /var/log/messages verify COLOR=yellow
>>>
>>> This is a few lines from the log
>>>
>>> [root at db184 root]# cat /var/log/messages |grep Verify
>>> Jun  5 03:00:04 db184 kernel: 3w-xxxx: scsi2: AEN: INFO: Verify 
>>> started: Unit #0.
>>> Jun  5 05:41:17 db184 kernel: 3w-xxxx: scsi2: AEN: INFO: Verify 
>>> complete: Unit #0.
>>> Jun  8 15:30:27 db184 kernel: 3w-xxxx: scsi2: AEN: INFO: Verify 
>>> started: Unit #0.
>>> Jun  8 15:30:29 db184 3w-xxxx[29749]: INFORMATION: Verify started on 
>>> unit 0 on controller ID:2. (0x29)
>>>
>>> I have tried regex entries and all sorts and still cant get anything 
>>> out of it and I'm going crazy. 'verify' is part of a string that 
>>> comes out when you start a verify on the 3ware raid controller in 
>>> that server. The man page says the matching string is case 
>>> insensitive but I have tried it with proper case also.
>>>
>>> Can someone please help point out the stupid thing I'm doing as I'm 
>>> sure the log file monitoring does actually work :)
>>>
>>> Cheers
>>>
>>> Allan
>>>
>>> To unsubscribe from the hobbit list, send an e-mail to
>>> hobbit-unsubscribe at hswn.dk
>>>
>>>
>> Extract of hobbit-clients.cfg man page:
>>
>>      Note that Hobbit defaults to  case-
>>      insensitive  pattern matching; if that is not what you want,
>>      put "(?-i)" between the "%" and the  regular  expression  to
>>      turn  this off.
>>
>>
>> Try this:
>>
>> LOG /var/log/messages %(?-i)verify COLOR=yellow
>>
>>
>>
>> Dominique
>> UNIL - University of Lausanne
>>
>> To unsubscribe from the hobbit list, send an e-mail to
>> hobbit-unsubscribe at hswn.dk
>>
> I had already tried that as per the man page and I also tried against 
> a lower case string such as 'session' which gets written everytime you 
> open an ssh connection and even that didnt do anything.
>
> Also something that I havent found clear is how do you define multiple 
> strings ? On the same line with spaces or one LOG line per string ?
>
> Allan
>
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
>
>
You do have to be very careful, if the log file is logging A LOT of 
messages.  Specifically  more than the 10240 bytes you are asking for.  
In other words, if the log file grows by more than 10240 bytes every 
five minutes you will lose part of the log file.


Your config entries look OK to me, those are both on the hobbit server 
right?  Do you see the 'Verify' string in the output on the web page, 
Client data link?

~David