On 01/31/2014 11:19 PM, Mark Mulligan wrote:
You can add a text string at the end of the SVC statement
SVC Symantec_AntiVirus startup=automatic status=started "TEXT=Symantec_Endpoint_Protection"
It will display the text for the SVC so they are more human readable
Mark Mulligan
Associate Operations Engineer – Splunk and Xymon Admin
Thank you Mark,
That is a bit better.. however, for SVC test
HOST=SRV123
SVC D070AF2E-E343-40B9-9F23-45B8572309F4 startup=automatic status=started
without TEXT=, e.g. in alert emails for SRV123/svcs, the problem is described as
&red D070AF2E-E343-40B9-9F23-45B8572309F4: No matching service - want started/manual
but with "TEXT=ServiceA" added to the SVC definition, the description reads
&red ServiceA
I'd like to give the description "No matching service - want started/manual" to the poor operators
getting these alert messages, so some kind of embedding would be needed. Where might this parsing be
coded? I could look at the code.
This is for 4.3.13, I'll upgrade to the latest level and see if this has been changed somehow..
Br,
Juha Vuori