[Xymon] server-side message pre-processor?

[Thomas Eckert]

I guess removing these hosts entirely from hosts.cfg not possible because there are _some_ metrics from the evildoers you are interested in? (Which would rule out the iptables solution suggested by Galen)

To my knowledge there is no such mechanism you are looking for.

Thomas

On Nov 3, 2015 3:03 AM, Galen Johnson <Galen.Johnson at sas.com> wrote:
>
> Can't you just set up iptables to drop the traffic so it never actually reaches the server?  Something like
>
> iptables -A INPUT -s 12.34.56.78 -p tcp --destination-port 1984 -j DROP
>
> =G=
> ________________________________________
> From: Xymon <xymon-bounces at xymon.com> on behalf of John Thurston <john.thurston at alaska.gov>
> Sent: Monday, November 2, 2015 7:59 PM
> To: xymon at xymon.com
> Subject: [Xymon] server-side message pre-processor?
>
> Is there a mechanism through which I can dump certain host+test
> combinations to /dev/null ?
>
> By way of example, let's hypothetically say I had a set of hosts whose
> owner steadfastly refused to clean up their data streams. They might be
> sending thousands of garbage test results to my server. The xymon server
> might be defined to not propagate the test results to the non-green
> screen, and there may be no alerts defined for the host+test
> combinations. But the xymon server is still passing thousands of garbage
> messages through its parsing, evaluating, graphing, and alerting
> handlers. Xymongen is still including these ignored messages in the list
> of "events received" at the bottom of the non-green page.
>
> It would be cool if there were a way to create a flush-list for which:
>     This host+test message combination will always be flushed.
>     It will never get past the parsing handler.
>     It won't be recorded.
>     It wont be reported.
>     It will not pass "go".
>     It will not collect $200.
>     It will just disappear.
>
> Alternatively, the ability to prevent a host+test combination appearing
> on the "events received int the past x minutes" portion of the non-green
> page would be a big help. In the hypothetical situation outlined above,
> the thousands of messages from those hosts would push every other
> meaningful message off the bottom of that list of events.
>
> --
>     Do things because you should, not just because you can.
>
> John Thurston    907-465-8591
> John.Thurston at alaska.gov
> Enterprise Technology Services
> Department of Administration
> State of Alaska
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon