[Xymon] [Possible Spam] Fwd: client-local.cfg ignore a complicated line - syntax issue?

[Andy Smith]

Betsy Schwartz wrote:
> Sorry meant to cc the previous message to the list. Correcting the line 
> wrapping made my lines start to take effect but also caused logfetch to 
> dump core
> 
> This causes a core dump:
> log:/appdata/logserver/local7.log:102400
> trigger brocade
> ignore %.*(apcontroller|cli.WARNING|cli.NOTICE).*
> 
> This works
> log:/appdata/logserver/local7.log:102400
> trigger brocade
> ignore apcontroller
> 
> so now, question is how to ignore more than one thing :-)
> It sounds from this thread (Thanks Jeremy) that maybe multiple bogus 
> trigger lines would help:
> http://lists.xymon.com/archive/2013-August/038002.html
> 
> ---------- Forwarded message ----------
> From: *Betsy Schwartz* <betsy.schwartz at gmail.com 
> <mailto:betsy.schwartz at gmail.com>>
> Date: Fri, Sep 12, 2014 at 7:44 AM
> Subject: Re: [Xymon] client-local.cfg ignore a complicated line - syntax 
> issue?
> To: Jeremy Laidman <jlaidman at rebel-it.com.au 
> <mailto:jlaidman at rebel-it.com.au>>
> 
> 
> Hm, somewhere in there I had gotten onto one line, thanks
> this is for client-launch.cfg
> 
> I tried this
> ignore %(?-i)apcontroller|cli.WARNING|cli.NOTICE
> 
> and got a core dump on the client
> upgraded the client from 4.3.12 to 4.3.17
> still got a core dump
> 
> [root at syslog1 logs]# tail xymonclient.log
> /home/xymon/client/bin/xymonclient.sh: line 60: 33209 Segmentation 
> fault      (core dumped) $XYMONHOME/bin/logfetch $LOGFETCHCFG 
> $LOGFETCHSTATUS >> $MSGTMPFILE
> 

I have a note in my client-local.cfg that having both trigger and ignore 
for a log definition causes logfetch to crash, so I figured you can do 
one or the other but not both at the client side.  I ended up with 
something quite sophisticated as suggested on this list using backticks 
to execute the grep on the client side and creating a temporary file 
which is then analysed as normal at the server.  It works well.
-- 
Andy