[hobbit] LOG pattern not matching

[Charles Jones]

Your syntax is wrong.  For logfile monitoring you must have the 
following in hobbit-clients.cfg:
*LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

So, using one of your examples below, it should be:

LOG /var/adm/messages WARNING COLOR=yellow

If you need a reference just check the man pages, either on your Hobbit 
instance, or at:
http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html
http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html

-Charles

Steve Holmes wrote:
> Hi all,
>
> I may not be understanding how the LOG match-pattern works.
>
> In my hobbit-clients.cfg file I have under the DEFAULT section the 
> following:
>
>         LOG %.* NOTICE
>         LOG %.* ERROR
>         LOG %.* WARNING COLOR=yellow
>         LOG %.* notice COLOR=yellow
>         LOG %.* error COLOR=yellow
>         LOG %.* daemon.error COLOR=yellow
>         LOG %.* warning COLOR=yellow
>         LOG %.* warn COLOR=yellow
>
> At the moment on my hobbit server I have a green status for the host 
> mentor and the following messages in /var/adm/messages:
>
> [msgs:/var/adm/messages]
> <...SKIPPED...>
> purdue.edu <http://purdue.edu> scsi: [ID 107833 kern.warning] WARNING: 
> /pci at 9,600000/SUNW,qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
>     Error for Command: read(10)                Error Level: Retryable
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Requested Block: 
> 33383911                  Error Block: 33383911
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Vendor: 
> SEAGATE                            Serial Number: 0317A1JGAZ 
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Sense Key: Media Error
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     ASC: 0x11 (unrecovered read error), 
> ASCQ: 0x0, FRU: 0xf
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW, 
> qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
>     Error for Command: write(10)               Error Level: Retryable
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Requested Block: 
> 33982299                  Error Block: 33982299
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Vendor: 
> SEAGATE                            Serial Number: 0317A1JGAZ 
> May  9 11:07:36 mentor.ics.purdue.edu <http://mentor.ics.purdue.edu> 
> scsi: [ID 107833 kern.notice]     Sense Key: Unit Attention
>
> The above is copied from the hobbit display reached by clicking on the 
> [/var/adm/messages] link on the msgs page for this host.
>
> In the client-local.cfg I have:
>
> [sunos]
> log:/var/adm/messages:10240
>
>
> So why is the page green? There are at least 3 strings that should 
> match to turn it yellow, right? And incidentally, the BB server I'm 
> running on another host *does* show yellow. I'm trying to validate my 
> hobbit configuration by making sure it matches the running BB server. 
> And it doesn't for msgs, ever.
>
> Thanks,
> Steve.
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070509/2dbb8093/attachment.html>