Re: [hobbit] Re: need help with IGNORE pattern

[Dominique Frise <dominique.frise (at) unil.ch>]

Asif Iqbal wrote:
> On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
> <dominique.frise (at) unil.ch> wrote:
> > Asif Iqbal wrote:
> > > On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <vadud3 (at) gmail.com> wrote:
> > > > This is the data in /var/adm/messages file
> > > >
> > > >  Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
> > > > fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
> > > > error(0xe); reason:  No Connection(0x5)
> > > >
> > > >
> > > > This is the entry in hobbit-client.cfg
> > > >
> > > >  LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*
> > > >
> > > > I also tried %.*fcsm.* with no avail
> > > >
> > > > But I am still getting alerts for that line in messages file
> > > >
> > > > What am I doing wrong?
> > > Still looking for a suggestion
> > >
> > > > --
> > > > Asif Iqbal
> > > > PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
> > Try this : IGNORE=%(?-i)fcsm.*
> > You can then try that regexp with "hobbitd_client --test"
>
>
> Just tried that. Still getting `red'
>
> (hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
> 2008-11-18 11:29:36 Using default environment file
> /export/home/hobbit/server/etc/hobbitserver.cfg
> Hostname (.=end, ?=dump, !=reload) []: server
> Hosttype []:
> Test (cpu, mem, disk, proc, log, port): log
> log filename: /var/adm/messages
> To read log data from a file, enter '@FILENAME' at the prompt
> log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
> WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
> Transport error(0xe); reason: No Connection(0x5)
> log line:
> Log status is red
>
> &red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
> error(0xe); reason: No Connection(0x5)
>
>
> I am wondering if hobbit is misbehaving?!
>
> > Dominique
> >
> > To unsubscribe from the hobbit list, send an e-mail to
> > hobbit-unsubscribe (at) hswn.dk
I could test your rule successfuly on our Xymon installation:

[bb (at) iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: iris
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING: 
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport 
error(0xe); reason: No Connection(0x5)
log line:
Log status is green

Hostname (.=end, ?=dump, !=reload) [iris]:



- Make sure you don't have other rules for /var/adm/messages in 
hobbit-clients.cfg.

- Check your pcre installation.

[bb (at) iris bin]$ pcretest
PCRE version 7.7 2008-05-07

  re> /(?-i)fcsm.*/
data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING: 
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport 
error(0xe); reason: No Connection(0x5)
 0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID 
0xfffffa failed state: Packet Transport error(0xe); reason: No 
Connection(0x5)
data>


The above check shows that pcre is behaving as expected. (see man page 
for pcretest)


Dominique