[hobbit] LOG pattern not matching

[Charles Jones]

Hmm actually you are right about the regex, it *should* work. I'd try 
making it work without the regex first, if that works, then I would try 
putting quotes around the logfilename regex, ie
LOG "%.*" WARNING COLOR=yellow

You aren't supposed to need the quotes, but I've had to use it for PROC 
regex entries in hobbit-clients.cfg before.

-Charles

Steve Holmes wrote:
> Charles,
> I had read the man page, honest. I read the following:
>
> "logfilename" is the name of the logfile. Only logentries from this 
> filename will be matched against this rule. Note that "logfilename" 
> can be a regular expression (if prefixed with a '%' character).
>
> to mean that %.* would match all logfilenames. Guest not, huh?
>
> Thanks, I'll try that.
>
> Steve.
>
>
>
> On 5/9/07, *Charles Jones* <jonescr at cisco.com 
> <mailto:jonescr at cisco.com>> wrote:
>
>     Your syntax is wrong.  For logfile monitoring you must have the
>     following in hobbit-clients.cfg:
>     *LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*
>
>     So, using one of your examples below, it should be:
>
>     LOG /var/adm/messages WARNING COLOR=yellow
>
>     If you need a reference just check the man pages, either on your
>     Hobbit instance, or at:
>     http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html
>     <http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html>
>     http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html
>     <http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html>
>
>     -Charles
>
>
>     Steve Holmes wrote:
>>     Hi all,
>>
>>     I may not be understanding how the LOG match-pattern works.
>>
>>     In my hobbit-clients.cfg file I have under the DEFAULT section
>>     the following:
>>
>>             LOG %.* NOTICE
>>             LOG %.* ERROR
>>             LOG %.* WARNING COLOR=yellow
>>             LOG %.* notice COLOR=yellow
>>             LOG %.* error COLOR=yellow
>>             LOG %.* daemon.error COLOR=yellow
>>             LOG %.* warning COLOR=yellow
>>             LOG %.* warn COLOR=yellow
>>
>>     At the moment on my hobbit server I have a green status for the
>>     host mentor and the following messages in /var/adm/messages:
>>
>>     [msgs:/var/adm/messages]
>>     <...SKIPPED...>
>>     purdue.edu <http://purdue.edu> scsi: [ID 107833 kern.warning]
>>     WARNING: /pci at 9,600000/SUNW,qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
>>     (ssd1):
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu>     Error for Command:
>>     read(10)                Error Level: Retryable
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Requested Block: 33383911                  Error Block: 33383911
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Vendor: SEAGATE                            Serial Number:
>>     0317A1JGAZ 
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Sense Key: Media Error
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.warning]
>>     WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
>>     (ssd1):
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu>     Error for Command:
>>     write(10)               Error Level: Retryable
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Requested Block: 33982299                  Error Block: 33982299
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Vendor: SEAGATE                            Serial Number:
>>     0317A1JGAZ 
>>     May  9 11:07:36 mentor.ics.purdue.edu
>>     <http://mentor.ics.purdue.edu> scsi: [ID 107833 kern.notice]    
>>     Sense Key: Unit Attention
>>
>>     The above is copied from the hobbit display reached by clicking
>>     on the [/var/adm/messages] link on the msgs page for this host.
>>
>>     In the client-local.cfg I have:
>>
>>     [sunos]
>>     log:/var/adm/messages:10240
>>
>>
>>     So why is the page green? There are at least 3 strings that
>>     should match to turn it yellow, right? And incidentally, the BB
>>     server I'm running on another host *does* show yellow. I'm trying
>>     to validate my hobbit configuration by making sure it matches the
>>     running BB server. And it doesn't for msgs, ever.
>>
>>     Thanks,
>>     Steve.
>>
>
>
>
>
> -- 
> I believe I found the missing link between animal and civilized man. It is
> us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)
>
> We in America do not have government by the majority. We have 
> government by
> the majority who participate. -Thomas Jefferson, third US president,
> architect and author (1743-1826) 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070509/c1be6ea1/attachment.html>