Asif Iqbal wrote:
On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:
Asif Iqbal wrote:
On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:
This is the data in /var/adm/messages file
Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
This is the entry in hobbit-client.cfg
LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*
I also tried %.*fcsm.* with no avail
But I am still getting alerts for that line in messages file
What am I doing wrong?
Still looking for a suggestion
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"
Just tried that. Still getting `red'
(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red
&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
I am wondering if hobbit is misbehaving?!
Dominique
I could test your rule successfuly on our Xymon installation:
[bb at iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: iris
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
log line:
Log status is green
Hostname (.=end, ?=dump, !=reload) [iris]:
- Make sure you don't have other rules for /var/adm/messages in
hobbit-clients.cfg.
- Check your pcre installation.
[bb at iris bin]$ pcretest
PCRE version 7.7 2008-05-07
re> /(?-i)fcsm.*/
data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
0xfffffa failed state: Packet Transport error(0xe); reason: No
Connection(0x5)
data>
The above check shows that pcre is behaving as expected. (see man page
for pcretest)
Dominique