Antwort: Re: [hobbit] Problems with IGNORE in hobbit-client.cfg

[thorsten.erdmann at daimler.com]

> HOST=s068a300
>     LOG     %.* %(fatal|error) IGNORE=%(?-i)smb_proc_readdir_long
This also does not work.
But that seems clear to me. I would switch case _in_sensitivity off, so it 
would be case sensitive, that is more likely to fail.

Thorsten

> 
>  From hobbit-client.cfg(5):
> ...
>       Note that Xymon defaults  to  case-
>       insensitive  pattern matching; if that is not what you want,
>       put "(?-i)" between the "%" and the  regular  expression  to
>       turn  this off. E.g. "%(?-i)HTTPD" will match the word HTTPD
>       only when it is upper-case.
> ...
> 
> 
>  > Another question: if I have many IGNOREs, can I put them on multiple
>  > lines for readability like this:
> 
> I don't think this is supported.
> Rules are separated with | (pipe)
> 
> E.g.:  IGNORE=%(?-i)forceload|hypervisor\sLDC
> 
> 
> BTW: hobbitd_client can be used for testing your rules:
> 
> [bb at iris bin]$ ./hobbitd_client --test
> Hostname (.=end, ?=dump, !=reload) []: testhost
> Hosttype []: linux
> Test (cpu, mem, disk, proc, log, port): log
> log filename: /var/log/messages
> To read log data from a file, enter '@FILENAME' at the prompt
> log line: Testmessage ERROR smb_proc_readdir_long
> log line:
> Log status is green
> 
> Hostname (.=end, ?=dump, !=reload) [testhost]:
> 
> 
> Dominique
> 
> thorsten.erdmann at daimler.com wrote:
> > 
> > Hi
> > 
> > I have some difficulties to ignore some messages using the 
> > hobbit-client.cfg file.
> > 
> > I want to ignore all messages that contain the word 
"smb_proc_readdir_long".
> > 
> > So I build such rule:
> > 
> > HOST=s068a300
> >         LOG     %.* %(fatal|error)   COLOR=red 
> > IGNORE=smb_proc_readdir_long
> >         LOG     %.* warning          COLOR=yellow
> > 
> > I also tried IGNORE=%smb...
> > 
> > If I write a message to /var/log/user like this:
> > 
> > logger -p daemon.notice Testmessage ERROR smb_proc_readdir_long
> > 
> > the message is not ignored by Hobbit:
> > 
> > System logs at Fri Sep 4 11:08:39 CEST 2009
> > 
> >  Critical entries in /var/log/messages
> >  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 

> > smb_proc_readdir_long
> >  .2009/09/04 11:03:53][s068a300:daemon.notice] root: Testmessage ERROR 

> > smb_proc_readdir_long
> > 
> > 
> > Another question: if I have many IGNOREs, can I put them on multiple 
> > lines for readability like this:
> > 
> > HOST=s068a300
> >         LOG     %.* %(fatal|error)   COLOR=red 
> >          IGNORE=smb_proc_readdir_long
> >          IGNORE=blabla
> >          IGNORE=nonsense
> >         LOG     %.* warning          COLOR=yellow
> > 
> > 
> > 
> > 
> > Thorsten Erdmann
> > 
> > If you are not the intended addressee, please inform us immediately 
that 
> > you have received this e-mail in error, and delete it. We thank you 
for 
> > your cooperation.
> > 
> 
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
> 
> 


If you are not the intended addressee, please inform us immediately that you have received this e-mail in error, and delete it. We thank you for your cooperation.  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20090909/0d4f77da/attachment.html>