[Xymon] Text Search Alerts

[Jeremy Laidman]

David

One option is to send the output to a logfile (eg using "logger" for a
syslog-managed file, or just "echo $MSG >> $LOGFILE"), and then monitor the
log in Xymon.

This requires an entry in client-local.cfg to fetch the log data, and an
entry in analysis.cfg to look for strings and generate alarms.  Check out
the man pages for these two files for more information.  Here is an example
from my configuration:

client-local.cfg:
  [dns1]
  log:/var/log/named/named.log:1024
        ignore \s(general|xfer-in|xfer-out):\sinfo:
  log:/var/tmp/svnsync.log:1024


analysis.cfg
  HOST=%^dns\d+
        LOG /var/log/named/named.log "%(critical|general: error:)"
COLOR=red "IGNORE=%(zone serial unchanged)"
        LOG /var/tmp/svnsync.log %(ERROR) COLOR=red
        LOG /var/tmp/svnsync.log %(WARNING) COLOR=yellow

So here, I'm monitoring both the named.log file and the svnsync.log file.
 I generate red or yellow alerts based on the log entries.

Cheers
Jeremy

On Wed, Jul 4, 2012 at 5:25 AM, Balderston, David <dbalders at ucsd.edu> wrote:

> Hey.  I have taken over zymon in my department recently and am just
> getting used to it.  Sorry if this is a repeat question, but everything I'm
> finding is for hobbit not xymon and it seems to be quite different.  I
> wrote a script that outputs the result to a file.  Im trying to have xymon
> alert based on certain phrases in the file.
>
> So on our main server page we have all of the ping imap etc.  We have a
> msgs column that is looking at system files.  Do you know where in the file
> structure this setting is located?  I cannot find where this is set so i
> can change it from the system files to the look at the right file.   Also,
> if someone has an example of what the syntax that i would put into that
> file to have it search that file, that would be amazing.  Lastly, do i need
> to do this on each client machine, or can it be done once on the server?
>
> thank you so much for your help.  I really appreciate it.
>
> David Balderston
> Core Bio Services
> dbalders at ucsd.edu
>
>
>
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20120706/8d2e11d4/attachment.html>