[hobbit] Re: need help with IGNORE pattern

[Asif Iqbal]

I am using hobbit 4.2 with all-in-one patch as my server.

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise
<dominique.frise at unil.ch> wrote:
> Asif Iqbal wrote:
>>
>> On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
>> <dominique.frise at unil.ch> wrote:
>>>
>>> Asif Iqbal wrote:
>>>>
>>>> On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
>>>>>
>>>>> This is the data in /var/adm/messages file
>>>>>
>>>>>  Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
>>>>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>>>>> error(0xe); reason:  No Connection(0x5)
>>>>>
>>>>>
>>>>> This is the entry in hobbit-client.cfg
>>>>>
>>>>>  LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*
>>>>>
>>>>> I also tried %.*fcsm.* with no avail
>>>>>
>>>>> But I am still getting alerts for that line in messages file
>>>>>
>>>>> What am I doing wrong?
>>>>
>>>> Still looking for a suggestion
>>>>
>>>>> --
>>>>> Asif Iqbal
>>>>> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>>>>>
>>>>
>>>>
>>> Try this : IGNORE=%(?-i)fcsm.*
>>> You can then try that regexp with "hobbitd_client --test"
>>
>>
>> Just tried that. Still getting `red'
>>
>> (hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
>> 2008-11-18 11:29:36 Using default environment file
>> /export/home/hobbit/server/etc/hobbitserver.cfg
>> Hostname (.=end, ?=dump, !=reload) []: server
>> Hosttype []:
>> Test (cpu, mem, disk, proc, log, port): log
>> log filename: /var/adm/messages
>> To read log data from a file, enter '@FILENAME' at the prompt
>> log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
>> WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
>> Transport error(0xe); reason: No Connection(0x5)
>> log line:
>> Log status is red
>>
>> &red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>> error(0xe); reason: No Connection(0x5)
>>
>>
>> I am wondering if hobbit is misbehaving?!
>>
>>>
>>> Dominique
>>>
>>> To unsubscribe from the hobbit list, send an e-mail to
>>> hobbit-unsubscribe at hswn.dk
>>>
>>>
>>>
>>
>>
>>
> I could test your rule successfuly on our Xymon installation:
>
> [bb at iris bin]$ ./hobbitd_client --test
> Hostname (.=end, ?=dump, !=reload) []: iris
> Hosttype []:
> Test (cpu, mem, disk, proc, log, port): log
> log filename: /var/adm/messages
> To read log data from a file, enter '@FILENAME' at the prompt
> log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
> error(0xe); reason: No Connection(0x5)
> log line:
> Log status is green
>
> Hostname (.=end, ?=dump, !=reload) [iris]:
>
>
>
> - Make sure you don't have other rules for /var/adm/messages in
> hobbit-clients.cfg.
>
> - Check your pcre installation.
>
> [bb at iris bin]$ pcretest
> PCRE version 7.7 2008-05-07
>
>  re> /(?-i)fcsm.*/
> data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
> error(0xe); reason: No Connection(0x5)
>  0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
> 0xfffffa failed state: Packet Transport error(0xe); reason: No
> Connection(0x5)
> data>
>
>
> The above check shows that pcre is behaving as expected. (see man page for
> pcretest)
>
>
> Dominique
>
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
>
>
>



-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu