In <user-8be2e3e23809@xymon.invalid> "Rafal Roginela" <user-744e62462615@xymon.invalid> writes:
I have a PIX that sends syslog to my hobbit server I also have cron job
that runs a script that analyses that log file and gives me a nice
looking results that are piped out to a text file:
196 MB XX.XX.XX.XX
100 MB XX.XX.XX.XX
18 MB XX.XX.XX.XX
12 MB XX.XX.XX.XX
7 MB XX.XX.XX.XX
6 MB XX.XX.XX.XX
4 MB XX.XX.XX.XX
2 MB XX.XX.XX.XX
Ran at Fri Dec 19 11:40:36 2008
What I would like to do is generate a custom test that would be able to,
at the very least, display this output so I can easily look at it by
clicking on the green dot for this custom test.
That's easy. This script will do it, just add a section to hobbitlaunch.cfg
to run this every 5 minutes or so.
#!/bin/sh
PIXLOGFILE=/var/log/pixlog.txt
PIXHOSTNAME=pix.foo.com
PIXCOLUMNNAME=talkers
$BB $BBDISP "status $PIXHOSTNAME.$PIXCOLUMNNAME green `date`
`cat $PIXLOGFILE`
"
exit 0
Modify the PIXLOGFILE / PIXHOSTNAME / PIXCOLUMNNAME to suit your
setup.
But it would be cool if I could graph it
That's a bit more tricky. I guess those "XX.XX.XX.XX" are IP's ?
And if they are IP-adresses of remote hosts talking to your site,
then perhaps they change a lot ? In that case graphing it is pretty
un-interesting, because one IP will not show up for very long in
your data.
On the other hand, if your PIX only gets traffic from a limited
number of IP's, then it would make sense to create an RRD (graph
database file) for each IP. It would probably be easier if your
output would list the IP first and then the MB-value; then you
could use the SPLITNCV handler that is built into Xymon 4.2.2
to parse the data and generate the RRD files. See the hobbitd_rrd
man-page and "Custom graphs" section in the on-line help on
your Hobbit server.
PS If anyone has ever ran into this also: My pix is sysloging to the
hobbit box good; I even have it going to a separate file for easy
sorting but I'm finding that it clogs up my messages file with duplicate
entries no mater which facility I try (right now I have used local4
through local6 changing the appropriate commands in the pix).
See your syslog.conf man-page. It depends on the exact flavor of
syslogd your system has, but on my Linux box one can filter out
certain facility.priority items from a logfile by using the "!"
operator, or by specifying "none" as the priority. So on your
"messages" syslog.conf entry, adding "log4,log5,log6.none" to the
set of selectors should weed out your PIX logs from going to
the messages file.
Regards,
Henrik