Charles,
I had read the man page, honest. I read the following:
"logfilename" is the name of the logfile. Only logentries from this
filename will be matched against this rule. Note that "logfilename"
can be a regular expression (if prefixed with a '%' character).
to mean that %.* would match all logfilenames. Guest not, huh?
Thanks, I'll try that.
Steve.
On 5/9/07, *Charles Jones* <user-e86b4aeade4e@xymon.invalid
<mailto:user-e86b4aeade4e@xymon.invalid>> wrote:
Your syntax is wrong. For logfile monitoring you must have the
following in hobbit-clients.cfg:
*LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*
So, using one of your examples below, it should be:
LOG /var/adm/messages WARNING COLOR=yellow
If you need a reference just check the man pages, either on your
Hobbit instance, or at:
http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html
<http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html>;
http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html
<http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html>;
-Charles
Steve Holmes wrote: Hi all,
I may not be understanding how the LOG match-pattern works.
In my hobbit-clients.cfg file I have under the DEFAULT section
the following:
LOG %.* NOTICE
LOG %.* ERROR
LOG %.* WARNING COLOR=yellow
LOG %.* notice COLOR=yellow
LOG %.* error COLOR=yellow
LOG %.* daemon.error COLOR=yellow
LOG %.* warning COLOR=yellow
LOG %.* warn COLOR=yellow
At the moment on my hobbit server I have a green status for the
host mentor and the following messages in /var/adm/messages:
[msgs:/var/adm/messages]
<...SKIPPED...>
purdue.edu <http://purdue.edu>; scsi: [ID 107833 kern.warning]
WARNING: /pci at 9,600000/SUNW,qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
(ssd1):
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; Error for Command:
read(10) Error Level: Retryable
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Requested Block: 33383911 Error Block: 33383911
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Vendor: SEAGATE Serial Number:
0317A1JGAZ
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Sense Key: Media Error
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.warning]
WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
(ssd1):
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; Error for Command:
write(10) Error Level: Retryable
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Requested Block: 33982299 Error Block: 33982299
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Vendor: SEAGATE Serial Number:
0317A1JGAZ
May 9 11:07:36 mentor.ics.purdue.edu
<http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]
Sense Key: Unit Attention
The above is copied from the hobbit display reached by clicking
on the [/var/adm/messages] link on the msgs page for this host.
In the client-local.cfg I have:
[sunos]
log:/var/adm/messages:10240
So why is the page green? There are at least 3 strings that
should match to turn it yellow, right? And incidentally, the BB
server I'm running on another host *does* show yellow. I'm trying
to validate my hobbit configuration by making sure it matches the
running BB server. And it doesn't for msgs, ever.
Thanks,
Steve.
--
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)
We in America do not have government by the majority. We have
government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)