[Xymon] Logfile syntax client-local.cfg

[Jeremy Laidman]

Greg

So there are multiple logfiles at any one time?

Let's say you want the last logfile in that form, regardless of the date:

log:`find /opt/NetQoS/logs/nqnapacapd_\* -mtime -2 2>/dev/null | tail -1`

This gets all files with that name and are up to 2 days old, and gets the
last one.  This assumes that "find" shows files in date order, which should
be true because of the YYMMDD format you're using.  You might think to do
the same with "ls" or "echo" rather than find, but these give an output
with the asterisk when there are no files found.

Or, let's say you only want to inspect a file if it has today's date, even
if it's not the latest, or ignoring yesterday's file even if it is the
latest:

log:`echo /opt/NetQoS/logs/nqnapacapd_$(date +%Y%m%d)"`

The problem here is that there's no way to use backquotes, and no simple
way to escape them.  So I used bash's ability to use $(cmd) as an
equivalent to `cmd`.

If you don't have bash, this should work:

log:`printf "/opt/NetQoS/logs/nqnapacapd_"; date +%Y%m%d`

The printf generates the start of the log filename, but suppresses the
newline.  Then the date command output is tacked onto the end of the
filename, ready for the logfetch process to use.

If you don't have printf, then you can do the same newline-suppression with
various forms of echo available in different shells, such as "echo -n text"
or "echo text\c".  Or to make it shell-agnostic, use the echo binary
/usr/bin/echo which typically supports the "\c" newline suppression method.

Or even simpler, use the date command to also show the filename part too:

log:`date "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

Bear in mind that your log rotation might not happen at midnight.  If this
is the case, you might want to look at yesterday's log for the first hour
or two of the day.  The GNU "date" command can be told to use an offset,
like so:

log:`date --date "now -90 minutes" "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

For non-GNU date commands that don't support "--date", you can simulate
such an offset by overriding the timezone environment variable with an
offset, with granularity of an hour.  So if your timezone is offset from
UTC by +7 (7 hours ahead) and you wanted to look at the log for yesterday
in the first hour of the day and from today for the rest of the time, you
could use this:

log:`TZ=UTC+6 date "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

Note that I can't get this to work to give the correct time for me,
probably because my understanding of how TZ affects the date command is not
very good.  For some reason, I can't get the date command to show my
current time even when I set TZ to "XYZ+10" where my timezone is currently
10 hours ahead of UTC, and instead I have to use "TZ=XYZ-10" for it to work
for me.  But if you set the string to "+%H:M:S" and play around with the
timezone offset, you can work out what it needs to be to get the what the
log was N hours ago.

To cope with log rotation, I'd be using the very first example above, that
always shows the log file with the latest timestamp, but being mindful that
this can be wrong if a logfile was created during an fault with the system
clock (eg someone accidentally set the year to 2014), causing the "latest"
logfile to be wrong for 12 months.

J



On 14 May 2013 04:17, shea, greg <greg.shea at emc.com> wrote:

> Hi folks,****
>
> ** **
>
> Need some help with adding this logfile to client-local.cfg.  I have a
> logfile like " /opt/NetQoS/logs/nqnapacapd_20130513.log"****
>
> I know I can create that date via `date '+%Y%m%d'`, but I've tried a
> number of ways to add this, but none were successful.****
>
> ** **
>
> Any help with the correct syntax would be appreciated.****
>
> Greg Shea****
>
> EMC Corporation****
>
> ** **
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20130514/1160b06e/attachment.html>