[hobbit] Re: need help with IGNORE pattern

[Dominique Frise]

Asif Iqbal wrote:
> I am using hobbit 4.2 with all-in-one patch as my server.
> 
> On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise
> <dominique.frise at unil.ch> wrote:
>> Asif Iqbal wrote:
>>> On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
>>> <dominique.frise at unil.ch> wrote:
>>>> Asif Iqbal wrote:
>>>>> On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
>>>>>> This is the data in /var/adm/messages file
>>>>>>
>>>>>>  Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
>>>>>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>>>>>> error(0xe); reason:  No Connection(0x5)
>>>>>>
>>>>>>
>>>>>> This is the entry in hobbit-client.cfg
>>>>>>
>>>>>>  LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*
>>>>>>
>>>>>> I also tried %.*fcsm.* with no avail
>>>>>>
>>>>>> But I am still getting alerts for that line in messages file
>>>>>>
>>>>>> What am I doing wrong?
>>>>> Still looking for a suggestion
>>>>>
>>>>>> --
>>>>>> Asif Iqbal
>>>>>> PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
>>>>>>
>>>>>
>>>> Try this : IGNORE=%(?-i)fcsm.*
>>>> You can then try that regexp with "hobbitd_client --test"
>>>
>>> Just tried that. Still getting `red'
>>>
>>> (hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
>>> 2008-11-18 11:29:36 Using default environment file
>>> /export/home/hobbit/server/etc/hobbitserver.cfg
>>> Hostname (.=end, ?=dump, !=reload) []: server
>>> Hosttype []:
>>> Test (cpu, mem, disk, proc, log, port): log
>>> log filename: /var/adm/messages
>>> To read log data from a file, enter '@FILENAME' at the prompt
>>> log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
>>> WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
>>> Transport error(0xe); reason: No Connection(0x5)
>>> log line:
>>> Log status is red
>>>
>>> &red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
>>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>>> error(0xe); reason: No Connection(0x5)
>>>
>>>
>>> I am wondering if hobbit is misbehaving?!
>>>
>>>> Dominique
>>>>
>>>> To unsubscribe from the hobbit list, send an e-mail to
>>>> hobbit-unsubscribe at hswn.dk
>>>>
>>>>
>>>>
>>>
>>>
>> I could test your rule successfuly on our Xymon installation:
>>
>> [bb at iris bin]$ ./hobbitd_client --test
>> Hostname (.=end, ?=dump, !=reload) []: iris
>> Hosttype []:
>> Test (cpu, mem, disk, proc, log, port): log
>> log filename: /var/adm/messages
>> To read log data from a file, enter '@FILENAME' at the prompt
>> log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>> error(0xe); reason: No Connection(0x5)
>> log line:
>> Log status is green
>>
>> Hostname (.=end, ?=dump, !=reload) [iris]:
>>
>>
>>
>> - Make sure you don't have other rules for /var/adm/messages in
>> hobbit-clients.cfg.
>>
>> - Check your pcre installation.
>>
>> [bb at iris bin]$ pcretest
>> PCRE version 7.7 2008-05-07
>>
>>  re> /(?-i)fcsm.*/
>> data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
>> fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
>> error(0xe); reason: No Connection(0x5)
>>  0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
>> 0xfffffa failed state: Packet Transport error(0xe); reason: No
>> Connection(0x5)
>> data>
>>
>>
>> The above check shows that pcre is behaving as expected. (see man page for
>> pcretest)
>>
>>
>> Dominique
>>
>> To unsubscribe from the hobbit list, send an e-mail to
>> hobbit-unsubscribe at hswn.dk
>>
>>
>>
> 
> 
> 
Hmmm... I meant Xymon to be modern ;-)

We are also using Hobbit 4.2.0 with all-in-one-patch.
Pcre is not part of Hobbit but used in regexp pattern matching.
You should check it to make sure it works as expected.

Dominique