[hobbit] Problems with IGNORE in hobbit-client.cfg

[Dominique Frise]

Give this a try:

HOST=s068a300
    LOG     %.* %(fatal|error) IGNORE=%(?-i)smb_proc_readdir_long

 From hobbit-client.cfg(5):
...
      Note that Xymon defaults  to  case-
      insensitive  pattern matching; if that is not what you want,
      put "(?-i)" between the "%" and the  regular  expression  to
      turn  this off. E.g. "%(?-i)HTTPD" will match the word HTTPD
      only when it is upper-case.
...


 > Another question: if I have many IGNOREs, can I put them on multiple
 > lines for readability like this:

I don't think this is supported.
Rules are separated with | (pipe)

E.g.:  IGNORE=%(?-i)forceload|hypervisor\sLDC


BTW: hobbitd_client can be used for testing your rules:

[bb at iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: testhost
Hosttype []: linux
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/log/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Testmessage ERROR smb_proc_readdir_long
log line:
Log status is green

Hostname (.=end, ?=dump, !=reload) [testhost]:


Dominique

thorsten.erdmann at daimler.com wrote:
> 
> Hi
> 
> I have some difficulties to ignore some messages using the 
> hobbit-client.cfg file.
> 
> I want to ignore all messages that contain the word "smb_proc_readdir_long".
> 
> So I build such rule:
> 
> HOST=s068a300
>         LOG     %.* %(fatal|error)   COLOR=red   
> IGNORE=smb_proc_readdir_long
>         LOG     %.* warning          COLOR=yellow
> 
> I also tried IGNORE=%smb...
> 
> If I write a message to /var/log/user like this:
> 
> logger -p daemon.notice Testmessage ERROR smb_proc_readdir_long
> 
> the message is not ignored by Hobbit:
> 
> System logs at Fri Sep 4 11:08:39 CEST 2009
> 
>  Critical entries in /var/log/messages
>  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 
> smb_proc_readdir_long
>  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 
> smb_proc_readdir_long
> 
> 
> Another question: if I have many IGNOREs, can I put them on multiple 
> lines for readability like this:
> 
> HOST=s068a300
>         LOG     %.* %(fatal|error)   COLOR=red  
>          IGNORE=smb_proc_readdir_long
>          IGNORE=blabla
>          IGNORE=nonsense
>         LOG     %.* warning          COLOR=yellow
>  
> 
> 
>  
> Thorsten Erdmann
> 
> If you are not the intended addressee, please inform us immediately that 
> you have received this e-mail in error, and delete it. We thank you for 
> your cooperation.
>