[Xymon] Serial alarm feeds- Now remote client.

[Kevin King]

Probably should rename this thread as we are talking the xymon remote client
here.

 

I did get log fetch to work with your script, sorta. I added the file in the
script to collect and it collects it and posts it to the message column

 

Good.

 

This is with your xymon remote client.

but of course it is not processed for alerts, Just collected.

 

So it just needs an entry in analysis.cfg?

 

I might try it but doubt it will work right, as you explain below.

I added this to the xymonclient-linux.sh that I use for the hosts I use your
script for. Hmmm If I get this other log fetch working I might be able to
smash your script with this and make that work.  Ok better stick to one
thing at a time.

 

Always.

 

echo "[msgs:/var/log/messages]"

tail -c 10240 /var/log/messages | egrep -v MARK

echo "[msgs:/var/TKLC/log/syscheck/fail_log]"

tail -c 10240 /var/TKLC/log/syscheck/fail_log

 

Well this works, in as much as you'll get message lines in your client data,
but you'll end up with repeated and skipped messages.  So if you alert on
the text "WARNING" and it appears in the log, sure you'll get an alert. But
if the log gets less than 10k of data appended throughout the day, Xymon
will repeat the alert all day.  Or if, between one sample and the next, the
"WARNING" message and then 10k of log data is added, the second sample won't
see the matching message because it always gets the last 10k.

 

These issues are dealt with by the logfetch utility.  It keeps state so that
it (generally) gives out each log message line exactly once - none is missed
and none is repeated.

 

You can handle this yourself, by keeping state of the size of the log file
you're watching, and always tailing what's after that size.  You also have
to detect and handle log rotation.  Doable, but lots of trouble.  If you can
get logfetch to work, then why not use it.  Especially as it can give you
your (its) config file from client-local.cfg to boot.

 

I remember a nice log utility we had in Big brother. I want to say
message.sh and message2.sh or something like that. I remember a config file
where you could create alert text triggers, it even took care of multi-line
messages. It made sure it kept track of the lines processed.  Sean are you
lurking? 

 

-Kevin

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20130827/2af8b23f/attachment.html>