[hobbit] Alerting & IGNORE

[John Glowacki]

John Glowacki wrote:
> James Wade wrote:
>> I can't get the ignore working. Is this syntax wrong:
>>
>> HOST=sau102
>>
>>         LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error IGNORE="%setuid
>> execution not allowed" COLOR=yellow
>>
>> Thie above is in the hobbit-clients.cfg file.
> 
> Both of these lines work for me.
> 
> HOST=host1
>   LOG     /var/adm/messages %(?-i)WARNING COLOR=yellow "IGNORE=%WARNING:
> /var/adm/utmp exists"
> HOST=host2
>   LOG     /var/adm/messages %(?-i)WARNING "IGNORE=%VOLTAGE:" COLOR=yellow
> 
> 
> Try moving your quote.
> 
> LOG /var/adm/messages %(?-i)NOTICE|WARNING|Error "IGNORE=%setuid
> execution not allowed" COLOR=yellow
> 
> John
> 
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe at hswn.dk
> 

I forgot I also had to exclude the hosts from the CLASS. So check if you
have another rule that would alert.

CLASS=sunos EXHOST=host1,host2
    LOG     /var/adm/messages %(?-i)FAILED COLOR=yellow
    LOG     %.* %(?-i)NOTICE COLOR=yellow
    LOG     /var/adm/messages %NFS.*not.responding.still.trying COLOR=yellow
    LOG     /var/adm/messages %(?-i)REASON COLOR=red
    LOG     /var/adm/messages %(?-i)WARNING COLOR=yellow