[Xymon] Logfile syntax client-local.cfg

[shea, greg]

Hi Jeremy,

The 2nd option works perfectly thanks.  I tried variants of \`, (), export, with no results, but this was so simple.
Thanks again
Greg Shea
EMC Corporation

From: Jeremy Laidman [mailto:jlaidman at rebel-it.com.au]
Sent: Tuesday, May 14, 2013 12:34 AM
To: shea, greg
Cc: xymon at xymon.com
Subject: Re: [Xymon] Logfile syntax client-local.cfg

Greg

So there are multiple logfiles at any one time?

Let's say you want the last logfile in that form, regardless of the date:

log:`find /opt/NetQoS/logs/nqnapacapd_\* -mtime -2 2>/dev/null | tail -1`

This gets all files with that name and are up to 2 days old, and gets the last one.  This assumes that "find" shows files in date order, which should be true because of the YYMMDD format you're using.  You might think to do the same with "ls" or "echo" rather than find, but these give an output with the asterisk when there are no files found.

Or, let's say you only want to inspect a file if it has today's date, even if it's not the latest, or ignoring yesterday's file even if it is the latest:

log:`echo /opt/NetQoS/logs/nqnapacapd_$(date +%Y%m%d)"`

The problem here is that there's no way to use backquotes, and no simple way to escape them.  So I used bash's ability to use $(cmd) as an equivalent to `cmd`.

If you don't have bash, this should work:

log:`printf "/opt/NetQoS/logs/nqnapacapd_"; date +%Y%m%d`

The printf generates the start of the log filename, but suppresses the newline.  Then the date command output is tacked onto the end of the filename, ready for the logfetch process to use.

If you don't have printf, then you can do the same newline-suppression with various forms of echo available in different shells, such as "echo -n text" or "echo text\c".  Or to make it shell-agnostic, use the echo binary /usr/bin/echo which typically supports the "\c" newline suppression method.

Or even simpler, use the date command to also show the filename part too:

log:`date "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

Bear in mind that your log rotation might not happen at midnight.  If this is the case, you might want to look at yesterday's log for the first hour or two of the day.  The GNU "date" command can be told to use an offset, like so:

log:`date --date "now -90 minutes" "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

For non-GNU date commands that don't support "--date", you can simulate such an offset by overriding the timezone environment variable with an offset, with granularity of an hour.  So if your timezone is offset from UTC by +7 (7 hours ahead) and you wanted to look at the log for yesterday in the first hour of the day and from today for the rest of the time, you could use this:

log:`TZ=UTC+6 date "+/opt/NetQoS/logs/nqnapacapd_%Y%m%d"`

Note that I can't get this to work to give the correct time for me, probably because my understanding of how TZ affects the date command is not very good.  For some reason, I can't get the date command to show my current time even when I set TZ to "XYZ+10" where my timezone is currently 10 hours ahead of UTC, and instead I have to use "TZ=XYZ-10" for it to work for me.  But if you set the string to "+%H:M:S" and play around with the timezone offset, you can work out what it needs to be to get the what the log was N hours ago.

To cope with log rotation, I'd be using the very first example above, that always shows the log file with the latest timestamp, but being mindful that this can be wrong if a logfile was created during an fault with the system clock (eg someone accidentally set the year to 2014), causing the "latest" logfile to be wrong for 12 months.

J


On 14 May 2013 04:17, shea, greg <greg.shea at emc.com<mailto:greg.shea at emc.com>> wrote:
Hi folks,

Need some help with adding this logfile to client-local.cfg.  I have a logfile like " /opt/NetQoS/logs/nqnapacapd_20130513.log"
I know I can create that date via `date '+%Y%m%d'`, but I've tried a number of ways to add this, but none were successful.

Any help with the correct syntax would be appreciated.
Greg Shea
EMC Corporation


_______________________________________________
Xymon mailing list
Xymon at xymon.com<mailto:Xymon at xymon.com>
http://lists.xymon.com/mailman/listinfo/xymon

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20130514/6fd0d8e7/attachment.html>