Xymon Mailing List Archive search

hobbitclient + msgs test sugesstion

list Rich Smrcina
Tue, 29 Nov 2005 15:23:03 -0600
Message-Id: <user-23f311510e50@xymon.invalid>

Doesn't the current bb implementation only monitor log file messages 
issued during a time period just past (like 30 minutes)?

I like the expression matching idea, but repetitively walking through 
the whole thing could introduce alot of overhead.  It would be 
beneficial walk backward from the end of the file to a pre-configured 
point in the past, then scan the messages.  Sorry if this is obvious... :)

Henrik Stoerner wrote:
Hi Peter (and anyone else interested),

On Tue, Nov 29, 2005 at 08:26:14PM +0100, Peter Welter wrote:
Since the msgs-check is not available yet in the Hobbit display, I
want to make a suggestion to have it enabled relatively easy. I think
of two methods:

-1- A client must have read access to the file [client picks out the
   "interesting" bits]

-2- Your Hobbit server must _also_ be a central loghost. [allows
   centralized configuration of how to monitor the logs]

I'm not really thrilled with either of these - sorry! Each of them
have some drawbacks: The first one moves the configuration of what
logs to monitor away from the central hobbit server, and the 
second one only works for logs that go through the syslog interface.
If I want to monitor e.g. an Apache webserver error-log, or the
custom logs from a BEA server, solution 2) won't work. I dont see
how it can work with logs from a Windows server either. Plus it
adds load to the central Hobbit server to deal with all of the
logfiles.

So - I think some other solution is needed, and I've been thinking
about how to do it. So far it's just ideas - no code. But I believe
the log checking has to happen on each client, but controlled by
a central configuration. So what I plan to implement is something
like this:

* The configuration of what logs to monitor and what strings to
  look for is maintained on the central Hobbit server, either as
  an addition to the hobbit-clients.cfg file, or in a separate
  file - that isn't really important.
* When a client connects and sends in a client-side message, the
  Hobbit server accepts the client message, but also sends back
  the current log-check configuration info. By re-using the
  client connection, the overhead involved in pushing the 
  configuration to each client becomes almost nil.
* When the client has a log-check configuration, it knows what logs
  to check for what strings, and can include that information in
  the normal client message it sends back to the Hobbit server.
  That means the client will need a tool to do the logfile checking;
  probably using a client-side regular-expression matching tool
  like "grep". It can either be built into the Hobbit client, or
  it could just rely on the existing "grep" utility found on the
  system - this would probably be the simplest to implement.


Regards,
Henrik

-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006