[hobbit] Messages file not reporting

[Allan.Marillier at dana.com]

Hi Edward - I understand your frustration - I've been through the same 
things myself, and also initially not found the FAQ indicating that syslog 
monitoring is not yet supported. I believe that Henrik is making it a 
priority since so many of us are asking for it but there is no news yet or 
commitment from him on when it will be available.

I searched deadcat.net and didn't find anything that looked worth using to 
me, but I may have missed it. One thing I have been working on, but I've 
had a few problems, is writing a custom extension. The extension itself is 
very easy to do - e.g. I have written two for my Linux servers, one to run 
some sql code to attach to an Oracle instance and report green if it is up 
or red if it is down, and another to check LAN adapter settings and turn 
yellow if it is not set to 100Mb full duplex. I have been working on a 
syslog monitor which looks at /var/log/messages, checks the inode to be 
sure logrotate has not run, and then uses tail to parse the last n lines. 
I determine n by checking how many lines are in the file with wc and 
recording that to a file on disk, then later come back and do the same 
again. If the inode is the same, and wc -l returned 1000 but now returns 
1057, then I do tail -n 57 /var/log/messages | grep -i error and look for 
any problems.

The problem I've encountered is that sometimes the inode changes. Yes, it 
really does and I'm not crazy, give it a try on Linux. Copy 
/var/log/messages, then ls -al -i the copy. Edit it with vi, even if all 
you do is open, then write and quit with no actual changes, and more often 
than not, the inode will change. I don't understand it. If I can get this 
working I'd be happy to share my custom extension with you - or maybe you 
will have some ideas on a different and more robust approach.

I'm assuming of course that you're Unix/Linux based, which is not always a 
good assumption!





Edward Croft <ecroft at openratings.com> 
02/02/2006 05:16 PM
Please respond to
hobbit at hswn.dk


To
hobbit at hswn.dk
cc

Subject
Re: [hobbit] Messages file not reporting






On Thu, 2006-02-02 at 22:31 +0100, Etienne Roulland wrote: 

Edward Croft wrote:
> Why thank you. I did find the one line:
> It does not currently provide any data for the system-log "msgs" column.
>
> That is all it says. Does not currently. Sooooo when can it be 
> expected, if ever?
> This one thing prevents me from using it as the programs that monitor 
> our systems
> write warnings into the log file which currently gets picked up by big 
> brother and an
> alert sent.


You can use external script from http://www.deadcat.net/ to monitor your 
logfiles.


To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk




Thank you. I appreciate your response.


-- 
Edward M. Croft
Sr. Systems Engineer
Open Ratings, Inc.
200 West Street
Waltham, MA 02451-1121




********************************************************************************
This e-mail, and any attachments, is intended solely for use by the 
addressee(s) named above.  It may contain the confidential or 
proprietary information of Dana Corporation, its subsidiaries, 
affiliates or business partners.  If you are not the intended recipient 
of this e-mail or are an unauthorized recipient of the information, you 
are hereby notified that any dissemination, distribution or copying 
of this e-mail or any attachments, is strictly prohibited.  If you have 
received this e-mail in error, please immediately notify the sender 
by reply e-mail and permanently delete the original and any copies 
or printouts.

Computer viruses can be transmitted via email. The 
recipient should check this e-mail and any attachments for the 
presence of viruses. Dana Corporation accepts no liability for any 
damage caused by any virus transmitted by this e-mail. 

English, Francais, Espanol, Deutsch, Italiano, Portugues:
http://www.dana.com/overview/EmailDisclaimer.shtm

********************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20060203/15431e7b/attachment.html>