Please can someone help me regarding the precedence of rules in
analysis.cfg?
analysis.cfg example to illustrate my questions:
#-----------------------------------------------------------
HOST=Win32Server
DISK C 85 90
DEFAULT
DISK * 90 95
CLASS=win32
DISK C 80 90
LOG %.* %error COLOR=yellow
LOG eventlog:Application %warning COLOR=yellow
IGNORE="%warning .* Symantec AntiVirus .* Could not scan .* files inside
.* due to extraction errors encountered by the Decomposer
Engines\.Application has encountered an error"
#-----------------------------------------------------------
Assumption: Host 'Win32Server' is a CLASS=win32 server running in central
mode
DISK questions:
1. Does Win32Server's C disk go yellow at 85, 90 or 95% ?
2. Is this because of the ORDER of the applying rules (first HOST, then
DEFAULT, then CLASS)
or is it because HOST is more specific then CLASS and CLASS is more
specific then DEFAULT?
3. Does Xymon at all try to find further possibly matching DISK rules
after the first matching
rule - underneath HOST in this example - has been encountered?
LOG questions:
1. If an eventlog message happens to match the 1st of the above listed LOG
rules
(because it contains 'error'), will the second rule be evaluated at
all?
2. And if the 2nd rule should get evaluated, which of the 2 rules would
take precedence?
(Assuming both rules logically match, but have conflicting effects
because of the IGNORE
- i.e. a line that matches the IGNORE and hence has also the word
'error' in it.
Will it be ignored, because the 2nd rule applies? Or will it show
yellow, because
the 1st rule applies? And why is this so?
3. The answers to the 2 prior questions will probably already have
answered this one:
Should specific LOG rules appear before or after the more general ones
to give to give
the first match precedence?
Many thanks
Jürgen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20140813/fffa749e/attachment.html>