Hello Robert,
If you do not expect to mount something else in /tmp, you may use something like:
DISK %^/tmp/.* IGNORE
seems easier to read and understand, however may be too wide.
If you expect to mount something else in /tmp, then your regex seems OK and unavoidable
Le 08/02/2021 ? 16:38, Robert Herron a ?crit?:
I'm deploying Veeam Backup & Replication to perform systems.? I have a few Linux hosts that require being backed up via the local agent instead of using a VM-based backup. The backups run in the middle of the night as you might expect.? 2AM Sunday, I received a full filesystem alarm on a Linux host I'm testing.? It cleared in the next test sweep 5 minutes later but the unnecessarily alarms woke me up.? I want to minimize that from happening.
The Veeam agent creates and mounts devices under /tmp for the backup.? The df line from the filesystem alarm looks like:
Filesystem?????? 1024-blocks ? Used Available? Capacity? Mounted on
/dev/veeamimage7 ? ? 4128448 4026052 ? ? ? ? 0????? 100% /tmp/{16296b8b-8ad4-6614-6da9-aacdc519bd6b}
The actual filesystem name is different on each host.? I assume it's based on the host's BIOS UUID or the block ID.? I don't want to add individual lines for each host.
I want to add the following line to my analysis.cfg in the "CLASS=linux" section:
DISK %^/tmp/\{[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}\} IGNORE
Questions:
1.)? Is this regex valid for the analysis.cfg?
2.)? Is there a better way to handle this?
Thanks,
--Robert.
Robert Herron
user-8b27ea4290da@xymon.invalid <mailto:user-8b27ea4290da@xymon.invalid>