[hobbit] possible issue with two hobbit servers reporting for the same client?

[Henrik Størner]

In <OFF6AB57C5.0DA01ADC-ON85257665.007099A1-85257665.00717534 at csc.com> Matthew Moldvan <mmoldvan at csc.com> writes:

>I have a question on monitoring separate filesystems with different 
>thresholds.  My hobbit-clients.cfg file on the Xymon server includes the 
>following:

>(Names changed to protect the innocent of course).

>$MACRO=%^(asdf|qwer|jalopy).*(a|s|h|l).xyz.com
>HOST=$MACRO
>        DISK    / 90 95 GROUP=SOMEONES_PAGER
>        DISK    %^/.+$ 90 95 GROUP=SOMEONES_EMAIL
>        DISK    %^/export/data/subdir/subdir2/log.* 95 99

>However, Xymon doesn't seem to honor the above DISK entries and still 
>marks both "/export/data/subdir/subdir2/log" and 
>"/export/data/subdir/subdir2/log2" as red when it hits 90%+ due to the 
>DEFAULT entry.

You should reverse the order of your rules. As the hobbit-clients.cfg man 
page says:

     "The entire file is evaluated from the top to bottom, and 
      the first match found is used. So you should put the specific 
      settings first, and the generic ones last.

So what happens is that your second rule "DISK %^/.+$" matches everything,
since all of your filesystems begin with "/", so that is the rule that
is applied.

(Your first rule is OK, because it is not a pattern - so it will only match
 the root filesystem).


>My questions at this point are:

>        - Are my regular expressions specified correctly?

Except for the order, yes.


>        - Does Xymon support full extended regular expressions?  (e.g. the 
>difference between grep and egrep on Sun systems)

Xymon uses the "pcre" library, so it support "Perl-compatible" regular
expressions. 


>        - Is my understanding of the above accurate with respect to alerts 
>about file system monitoring being generated on the server?

Not sure what you mean by this, but it seems ok. You must have some 
corresponding entries in your hobbit-alerts.cfg file for the
"SOMEONES_PAGER" and "SOMEONES_EMAIL" groups, like

    GROUP=SOMEONES_EMAIL
       MAIL joe at foo.com


Regards,
Henrik