[Xymon] Log file monitoring

[W.J.M. Nelis]

Hello,

> Hi all,
>
> As far as I can see there is no built in way in Xymon to monitor a log 
> for the number of times a string has occurred in a specified time period. 
> Is this something that other people would find useful? (even if it was 
> only a count of occurrences within the last 30 minutes and not a 
> configurable time).
>
>
This is a useful feature, but I doubt if I will use it if implemented in Xymon.

I've written two custom scripts which do just this type of data collection. 
One script counts the number of denied licence requests from the FLEXlm log 
file (one log file per product), the other one counts the number of DHCP 
discovers, requests etc. from the ISC dhcpd log file.

Both scripts use quit different counting strategies. The first script 
counts the number of denied license request since the start of this year. 
The result is fed into RRD, using a DS of type DERIVE with a minimum of 
zero. The minimum suppresses the negative spike at each new year.

The second script starts reading the log file at the location where it 
stopped the last time. This is a faster method, but it introduces small 
errors. Some (small) parts of the log file can be scanned twice or some 
(small) parts are never scanned, depending on the moment the file size 
(which is the starting point for the next pass) is retrieved.

Both scripts do something special with fast repeating entries: if two or 
more license requests from one requester for one particular product are 
denied within two seconds the set of di=enials is counted as one denial, 
and hosts which send many DHCP requests are reported. Hence the doubt if I 
will use a similar functionality in Xymon.

Regards,
   Wim Nelis.





******************************************************************************************************************

The NLR disclaimer is valid for NLR e-mail messages.

This message is only meant for providing information. Nothing in this e-mail message amounts to a contractual
or legal commitment on the part of the sender.
This message may contain information that is not intended for you. If you are not the addressee or if this
message was sent to you by mistake, you are requested to inform the sender and delete the message.
Sender accepts no liability for damage of any kind resulting from the risks inherent in the electronic
transmission of messages.
 
******************************************************************************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20140303/6be96a6f/attachment.html>