[Xymon] LOG alert with GROUP?

[Larry Barber]

So everybody can see it (only hit "reply", not "reply to all" the first
time:

In alerts.cfg the SERVICE needs to be msgs, not log.

Thanks,
Larry Barber


On Mon, May 28, 2012 at 11:39 AM, Nick Pettefar <Nick at pettefar.com> wrote:

> I am trying to use the GROUP keyword in a LOG alert to send an e-mail
> when "Warning" is in a certain log file and it isn't working.  Is it
> possible?
>
> client-local.cfg
> [acnsvr1-ge1]
> log:/data/conductor/log/checkExtractDelivery.log:10240
>
> analysis.cfg
> HOST=acnsvr1-ge1
>        LOG     /data/conductor/log/checkExtractDelivery.log Warning
> COLOR=red GROUP=checkExtractDelivery
>
> alerts.cfg
> GROUP=checkExtractDelivery HOST=acnsvr1-ge1
> MAIL nick at xxxx.com SERVICE=log COLOR=red
>
>
> No mail is sent.  The server can send e-mails (checked using the same
> address with mailx).
>
> What does the "group not in include list" Failed message mean?
>
> ../bin/xymond_alert --debug --test acnsvr1-ge1 GROUP=checkExtractDelivery
> 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/hosts.cfg
> 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/alerts.cfg
> 6485 2012-05-28 17:33:42 Opening file /home/xymon/server/etc/holidays.cfg
> 6485 2012-05-28 17:33:42 send_alert
> acnsvr1-ge1:GROUP=checkExtractDelivery state 0
> 00006485 2012-05-28 17:33:42 send_alert
> acnsvr1-ge1:GROUP=checkExtractDelivery state Paging
> 00006485 2012-05-28 17:33:42 Matching host:service:page
> 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule
> line 127
> 00006485 2012-05-28 17:33:42 Failed 'GROUP=checkExtractDelivery
> HOST=acnsvr1-ge1' (group not in include list)
> 00006485 2012-05-28 17:33:42 Matching host:service:page
> 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule
> line 143
> 00006485 2012-05-28 17:33:42 *** Match with 'HOST=*' ***
> 6485 2012-05-28 17:33:42 Found a first matching rule
> 00006485 2012-05-28 17:33:42 Matching host:service:page
> 'acnsvr1-ge1:GROUP=checkExtractDelivery:QuartetPrCore' against rule
> line 144
> 00006485 2012-05-28 17:33:42 *** Match with 'MAIL   qtnoc at xxxx.com
> COLOR=red REPEAT=4h' ***
> 6485 2012-05-28 17:33:42   repeat
> acnsvr1-ge1|GROUP=checkExtractDelivery|mail|qtnoc at xxxx.com at 0
> 6485 2012-05-28 17:33:42   Alert for
> acnsvr1-ge1:GROUP=checkExtractDelivery to qtnoc at xxxx.com
> 00006485 2012-05-28 17:33:42 Mail alert with command
> '/var/spool/mail/root "Xymon [12345]
> acnsvr1-ge1:GROUP=checkExtractDelivery CRITICAL (RED)" qtnoc at xxxx.com'
> 6485 2012-05-28 17:33:42 No more secondary matching rule
>
> Regards,
>
> Nick Pettefar
> _______________________________________________
> Xymon mailing list
> Xymon at xymon.com
> http://lists.xymon.com/mailman/listinfo/xymon
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20120528/5452eaf0/attachment.html>