Re: [hobbit] Problems with MSG filter

[Darrin Khan <medavian (at) gmail.com>]

Hello Thorsten,

I have had similar issues previously with Postgres errors. I found it
easier to have the log lines removed on the client side, saves the
logs from even reaching the xymon server.

This is going by memory as i am not in the office, but it should be
something like the following in the client-local.cfg ..

[sql0.my.net]
log:/var/log/messages:10240
ignore ntpd

Note, that this will strip out any lines with ntpd in it, so you may
miss other issues related to ntpd.

Hope this is a help

Darrin

2010/1/7  <thorsten.erdmann (at) daimler.com>:
>
> Hi
>
> I have some problems filtering entries from the msg test. I have several
> hosts, running SuSE which often produce the following messages in
> /var/log/messages:
>
> Jan  7 08:09:22 s068c320 ntpd[4944]: kernel time sync error 0001
>
> The hosts are named s068c320, s068c321, s068c322, ...
>
> So I made the following entries in the hobbit-clients.cfg on the
> Hobbitserver, to filter out these messages:
>
> HOST=%s068c32*
>         LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd
>
> It does not work. The messages come up as an error anyway.
> Here is my whole hobbit-clients.cfg
>
>
>
> HOST=s068310i
>         DISK    %^/platform.*  IGNORE
>
> HOST=s068310b
>         DISK    %^/platform.*  IGNORE
>
> HOST=s068a300
>         LOG     %.* %(fatal|error)   COLOR=red
> IGNORE=%(smb_proc_readdir_long|peer)
>         LOG     %.* warning          COLOR=yellow
> #        DISK    * 10 15
>
> HOST=s068c327
>         DISK    /mnt           IGNORE
>
> HOST=%s068c32*
>         LOG     %.* %(fatal|error)   COLOR=red   IGNORE=ntpd
>
> HOST=s068c320,s068c321,s068c322
>         PROC    "lmgrd -c" 1 1
>         PROC    "pam_lmd" 1 1
>
> DEFAULT
>         # These are the built-in defaults.
>         UP      1h
>         LOAD    5.0 10.0
>         DISK    * 90 95
>         DISK    /media/cdrom 101 101
>         MEMPHYS 100 101
>         MEMSWAP 50 80
>         MEMACT  90 97
>
>         LOG     %.* %(fatal|error)   COLOR=red
>  IGNORE=%(read_socket_data|peer)
>         LOG     %.* warning          COLOR=yellow
>
> What's wrong there?
> BTW: the smb_proc_readdir_log filter also does not work.
>
> Thank you
> Thorsten Erdmann
>
> If you are not the intended addressee, please inform us immediately that you
> have received this e-mail in error, and delete it. We thank you for your
> cooperation.
>



-- 
Darrin Khan
medavian (at) gmail.com

Ted Turner  - "Sports is like a war without the killing." -
http://www.brainyquote.com/quotes/authors/t/ted_turner.html