[hobbit] LOG pattern not matching

[Steve Holmes]

Charles, thanks for your help. Just changing the filename regexp to a
constant didn't work, but doing that *and* changing the matching string *to*
a regexp did work. I have also found that the IGNORE string has to be a
regexp to work. I'm pretty sure the manual pages will need to be updated.

Thanks,
Steve.


On 5/9/07, Charles Jones <jonescr at cisco.com> wrote:
>
>  Hmm actually you are right about the regex, it *should* work. I'd try
> making it work without the regex first, if that works, then I would try
> putting quotes around the logfilename regex, ie
> LOG "%.*" WARNING COLOR=yellow
>
> You aren't supposed to need the quotes, but I've had to use it for PROC
> regex entries in hobbit-clients.cfg before.
>
> -Charles
>
> Steve Holmes wrote:
>
> Charles,
> I had read the man page, honest. I read the following:
>
> "logfilename" is the name of the logfile. Only logentries from this
> filename will be matched against this rule. Note that "logfilename" can be a
> regular expression (if prefixed with a '%' character).
>
> to mean that %.* would match all logfilenames. Guest not, huh?
>
> Thanks, I'll try that.
>
> Steve.
>
>
>
> On 5/9/07, Charles Jones <jonescr at cisco.com> wrote:
> >
> > Your syntax is wrong.  For logfile monitoring you must have the
> > following in hobbit-clients.cfg:
> > *LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*
> >
> > So, using one of your examples below, it should be:
> >
> > LOG /var/adm/messages WARNING COLOR=yellow
> >
> > If you need a reference just check the man pages, either on your Hobbit
> > instance, or at:
> > http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html
> >
> > http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html
> >
> >
> > -Charles
> >
> > Steve Holmes wrote:
> >
> > Hi all,
> >
> > I may not be understanding how the LOG match-pattern works.
> >
> > In my hobbit-clients.cfg file I have under the DEFAULT section the
> > following:
> >
> >         LOG %.* NOTICE
> >         LOG %.* ERROR
> >         LOG %.* WARNING COLOR=yellow
> >         LOG %.* notice COLOR=yellow
> >         LOG %.* error COLOR=yellow
> >         LOG %.* daemon.error COLOR=yellow
> >         LOG %.* warning COLOR=yellow
> >         LOG %.* warn COLOR=yellow
> >
> > At the moment on my hobbit server I have a green status for the host
> > mentor and the following messages in /var/adm/messages:
> >
> > [msgs:/var/adm/messages]
> > <...SKIPPED...>
> > purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW,
> > qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
> > May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
> > read(10)                Error Level: Retryable
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Requested Block: 33383911                  Error Block: 33383911
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Sense Key: Media Error
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.warning]
> > WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
> > (ssd1):
> > May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
> > write(10)               Error Level: Retryable
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Requested Block: 33982299                  Error Block: 33982299
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
> > May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
> > Sense Key: Unit Attention
> >
> > The above is copied from the hobbit display reached by clicking on the
> > [/var/adm/messages] link on the msgs page for this host.
> >
> > In the client-local.cfg I have:
> >
> > [sunos]
> > log:/var/adm/messages:10240
> >
> >
> > So why is the page green? There are at least 3 strings that should match
> > to turn it yellow, right? And incidentally, the BB server I'm running on
> > another host *does* show yellow. I'm trying to validate my hobbit
> > configuration by making sure it matches the running BB server. And it
> > doesn't for msgs, ever.
> >
> > Thanks,
> > Steve.
> >
> >
> >
>
>
> --
> I believe I found the missing link between animal and civilized man. It is
> us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)
>
> We in America do not have government by the majority. We have government
> by
> the majority who participate. -Thomas Jefferson, third US president,
> architect and author (1743-1826)
>
>
>


-- 
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20070510/21e3e1ee/attachment.html>