[hobbit] Problems with MSG filter

[Matthew Moldvan]

Oops, did I actually say that?  Forgot the ^ is beggining of the line ... 
must have been a long day.  :P

Matt.

Unix System Administrator
Computer Science Corporation
General Dynamics Land Systems
38500 Mound Rd.
Sterling Heights, MI.  48310
Desk: (586) 825-8294
Oracle IM: moldvanm

This is a PRIVATE message. If you are not the intended recipient, please 
delete without copying and kindly advise us by e-mail of the mistake in 
delivery. 
NOTE: Regardless of content, this e-mail shall not operate to bind CSC to 
any order or other contract unless pursuant to explicit written agreement 
or government initiative expressly permitting the use of e-mail for such 
purpose.





Re: [hobbit] Problems with MSG filter

Matthew Moldvan 
to:
hobbit
01/07/2010 04:52 PM

Please respond to hobbit







A quick thought: the disk regular expressions start with "%^", whereas 
your HOST and LOG portions are missing the caret (^).  That might be a 
first step... 

Hope that helps, 
Matt. 

Unix System Administrator
Computer Science Corporation
General Dynamics Land Systems
38500 Mound Rd.
Sterling Heights, MI.  48310
Desk: (586) 825-8294
Oracle IM: moldvanm

This is a PRIVATE message. If you are not the intended recipient, please 
delete without copying and kindly advise us by e-mail of the mistake in 
delivery. 
NOTE: Regardless of content, this e-mail shall not operate to bind CSC to 
any order or other contract unless pursuant to explicit written agreement 
or government initiative expressly permitting the use of e-mail for such 
purpose. 




[hobbit] Problems with MSG filter


thorsten.erdmann 
to: 
hobbit 
01/07/2010 02:26 AM


Please respond to hobbit 








Hi

I have some problems filtering entries from the msg test. I have several 
hosts, running SuSE which often produce the following messages in 
/var/log/messages:

Jan  7 08:09:22 s068c320 ntpd[4944]: kernel time sync error 0001

The hosts are named s068c320, s068c321, s068c322, ...

So I made the following entries in the hobbit-clients.cfg on the 
Hobbitserver, to filter out these messages:

HOST=%s068c32*
       LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

It does not work. The messages come up as an error anyway.
Here is my whole hobbit-clients.cfg



HOST=s068310i
       DISK    %^/platform.*  IGNORE

HOST=s068310b
       DISK    %^/platform.*  IGNORE

HOST=s068a300
       LOG     %.* %(fatal|error)   COLOR=red 
IGNORE=%(smb_proc_readdir_long|peer)
       LOG     %.* warning          COLOR=yellow
#        DISK    * 10 15

HOST=s068c327
       DISK    /mnt           IGNORE

HOST=%s068c32*
       LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd

HOST=s068c320,s068c321,s068c322
       PROC    "lmgrd -c" 1 1
       PROC    "pam_lmd" 1 1

DEFAULT
       # These are the built-in defaults.
       UP      1h
       LOAD    5.0 10.0
       DISK    * 90 95
       DISK    /media/cdrom 101 101
       MEMPHYS 100 101
       MEMSWAP 50 80
       MEMACT  90 97

       LOG     %.* %(fatal|error)   COLOR=red 
IGNORE=%(read_socket_data|peer)
       LOG     %.* warning          COLOR=yellow

What's wrong there?
BTW: the smb_proc_readdir_log filter also does not work.

Thank you
Thorsten Erdmann

If you are not the intended addressee, please inform us immediately that 
you have received this e-mail in error, and delete it. We thank you for 
your cooperation. 
This is an e-mail from General Dynamics Land Systems. It is for the 
intended recipient only and may contain confidential and privileged 
information. No one else may read, print, store, copy, forward or act in 
reliance on it or its attachments. If you are not the intended recipient, 
please return this message to the sender and delete the message and any 
attachments from your computer. Your cooperation is appreciated. 
This is an e-mail from General Dynamics Land Systems. It is for the 
intended recipient only and may contain confidential and privileged 
information. No one else may read, print, store, copy, forward or act in 
reliance on it or its attachments. If you are not the intended recipient, 
please return this message to the sender and delete the message and any 
attachments from your computer. Your cooperation is appreciated. 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20100108/d8e9ed0b/attachment.html>