[hobbit] Re: need help with IGNORE pattern

Dominique Frise dominique.frise at unil.ch
Thu Nov 20 07:39:54 CET 2008


Asif Iqbal wrote:
> I am using hobbit 4.2 with all-in-one patch as my server.
> 
> On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise
> <dominique.frise at unil.ch> wrote:
>> Asif Iqbal wrote:
>>> On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
>>> <dominique.frise at unil.ch> wrote:
>>>> Asif Iqbal wrote:
>>>>> On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
>>>>>> This is the data in /var/adm/messages file
>>>>>>
>>>>>>  Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
>>>>>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>>>>>> error(0xe); reason:  No Connection(0x5)
>>>>>>
>>>>>>
>>>>>> This is the entry in hobbit-client.cfg
>>>>>>
>>>>>>  LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*
>>>>>>
>>>>>> I also tried %.*fcsm.* with no avail
>>>>>>
>>>>>> But I am still getting alerts for that line in messages file
>>>>>>
>>>>>> What am I doing wrong?
>>>>> Still looking for a suggestion
>>>>>
>>>>>> --
>>>>>> Asif Iqbal
>>>>>> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>>>>>>
>>>>>
>>>> Try this : IGNORE=%(?-i)fcsm.*
>>>> You can then try that regexp with "hobbitd_client --test"
>>>
>>> Just tried that. Still getting `red'
>>>
>>> (hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
>>> 2008-11-18 11:29:36 Using default environment file
>>> /export/home/hobbit/server/etc/hobbitserver.cfg
>>> Hostname (.=end, ?=dump, !=reload) []: server
>>> Hosttype []:
>>> Test (cpu, mem, disk, proc, log, port): log
>>> log filename: /var/adm/messages
>>> To read log data from a file, enter '@FILENAME' at the prompt
>>> log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
>>> WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
>>> Transport error(0xe); reason: No Connection(0x5)
>>> log line:
>>> Log status is red
>>>
>>> &red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
>>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>>> error(0xe); reason: No Connection(0x5)
>>>
>>>
>>> I am wondering if hobbit is misbehaving?!
>>>
>>>> Dominique
>>>>
>>>> To unsubscribe from the hobbit list, send an e-mail to
>>>> hobbit-unsubscribe at hswn.dk
>>>>
>>>>
>>>>
>>>
>>>
>> I could test your rule successfuly on our Xymon installation:
>>
>> [bb at iris bin]$ ./hobbitd_client --test
>> Hostname (.=end, ?=dump, !=reload) []: iris
>> Hosttype []:
>> Test (cpu, mem, disk, proc, log, port): log
>> log filename: /var/adm/messages
>> To read log data from a file, enter '@FILENAME' at the prompt
>> log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>> error(0xe); reason: No Connection(0x5)
>> log line:
>> Log status is green
>>
>> Hostname (.=end, ?=dump, !=reload) [iris]:
>>
>>
>>
>> - Make sure you don't have other rules for /var/adm/messages in
>> hobbit-clients.cfg.
>>
>> - Check your pcre installation.
>>
>> [bb at iris bin]$ pcretest
>> PCRE version 7.7 2008-05-07
>>
>>  re> /(?-i)fcsm.*/
>> data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>> error(0xe); reason: No Connection(0x5)
>>  0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
>> 0xfffffa failed state: Packet Transport error(0xe); reason: No
>> Connection(0x5)
>> data>
>>
>>
>> The above check shows that pcre is behaving as expected. (see man page for
>> pcretest)
>>
>>
>> Dominique
>>
>> To unsubscribe from the hobbit list, send an e-mail to
>> hobbit-unsubscribe at hswn.dk
>>
>>
>>
> 
> 
> 
Hmmm... I meant Xymon to be modern ;-)

We are also using Hobbit 4.2.0 with all-in-one-patch.
Pcre is not part of Hobbit but used in regexp pattern matching.
You should check it to make sure it works as expected.

Dominique



More information about the Xymon mailing list