[Xymon] Ignore all log messages

[Jeremy Laidman]

First, please note that the parameter you provide to "trigger" and "ignore"
is a regular expression, and so the "%" is not required, and likely to be
problematic (meaning, it won't match unless there's an actual "%" in a log
line).

On 4 December 2014 at 05:22, Scot Kreienkamp <Scot.Kreienkamp at la-z-boy.com>
wrote:

>  Does anyone know if the ignore and trigger statements are applied per
> log?
>

Yes, they are per log.

These two options are fundamentally different, and applied at different
times in the log processing.  The "ignore" option specifies which lines
should be ignored completely.

>From what's left, some or all will be sent to the server.  You have a
certain number of bytes that the client will send back to the server, and
any more than that will be truncated.  The "trigger" option will look
through these un-ignored lines and give preference to the lines that match
the trigger string.  So these trigger-matched lines will get sent for
(almost) certain, and whatever doesn't match will be truncated before being
sent.

If you can use "ignore" to clean out enough lines so that what's left will
be under your limit (10kB), then that's all you need to do.  However, if
you cannot, you will end up with a truncated log, and so will need to use
"trigger" to make sure the interesting lines get through.

These two should work together, but due to a bug in the client-side code,
you can sometimes have problems.  So best to choose one or the other.

If what you're looking for is to send through ONLY the lines you care about
and want to alert on, then you might be able to use a negative-match
regular expression in your "ignore" definition.  Something like this:

ignore
^(?!.*(FATAL|Fatal|FAIL|Fail|fail|Error|ERROR|error|timestamp|deadlock|Deadlock|password
authentication failed|pg_hba.conf|invalid magic number))

This bit of regex magic matches any log line that doesn't include the
strings given, and in that way only non-matching lines are ignored.

J
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20141204/e52098ea/attachment.html>