Text Search Alerts 🔗 link

Hey.  I have taken over zymon in my department recently and am just getting used to it.  Sorry if this is a repeat question, but everything I'm finding is for hobbit not xymon and it seems to be quite different.  I wrote a script that outputs the result to a file.  Im trying to have xymon alert based on certain phrases in the file.

So on our main server page we have all of the ping imap etc.  We have a msgs column that is looking at system files.  Do you know where in the file structure this setting is located?  I cannot find where this is set so i can change it from the system files to the look at the right file.   Also, if someone has an example of what the syntax that i would put into that file to have it search that file, that would be amazing.  Lastly, do i need to do this on each client machine, or can it be done once on the server?

thank you so much for your help.  I really appreciate it.

David Balderston
Core Bio Services
user-63a5a9869cbc@xymon.invalid

Xymon and Hobbit are pretty much the same, Hobbit was renamed to Xymon for
legal reasons, since the rename there have been some additional features
added, but they are still substantially the same thing.

As far as the what files the msgs test looks at, this depends a good deal
on what you are monitoring. Is the monitored system Windows or a Unix
variant? Also, are the clients on those machines running in local or
centralized mode? If you are running in centralized mode you can get some
idea of what you need to do by reading the client-local.cfg and
analysis.cfg man pages. If you have a Windows box running in local mode,
you are pretty much stuck with what you get. Windows in localized mode can
be configured similar to Unix systems.

Thanks,
Larry Barber

On Tue, Jul 3, 2012 at 2:25 PM, Balderston, David <user-63a5a9869cbc@xymon.invalid> wrote:

David

One option is to send the output to a logfile (eg using "logger" for a
syslog-managed file, or just "echo $MSG >> $LOGFILE"), and then monitor the
log in Xymon.

This requires an entry in client-local.cfg to fetch the log data, and an
entry in analysis.cfg to look for strings and generate alarms.  Check out
the man pages for these two files for more information.  Here is an example
from my configuration:

client-local.cfg:
  [dns1]
  log:/var/log/named/named.log:1024
        ignore \s(general|xfer-in|xfer-out):\sinfo:
  log:/var/tmp/svnsync.log:1024


analysis.cfg
  HOST=%^dns\d+
        LOG /var/log/named/named.log "%(critical|general: error:)"
COLOR=red "IGNORE=%(zone serial unchanged)"
        LOG /var/tmp/svnsync.log %(ERROR) COLOR=red
        LOG /var/tmp/svnsync.log %(WARNING) COLOR=yellow

So here, I'm monitoring both the named.log file and the svnsync.log file.
 I generate red or yellow alerts based on the log entries.

Cheers
Jeremy

On Wed, Jul 4, 2012 at 5:25 AM, Balderston, David <user-63a5a9869cbc@xymon.invalid> wrote: