override CLASS(LOG) for one host

2 messages in this thread

list Bakkies Gatvol · Fri, 11 Oct 2013 08:46:49 -0400 ·

I have this and it is good

CLASS=linux
        PROC ntpd 
        PROC sshd 1 
        PROC cron
        FILE /var/log/messages red MODE=644
        LOG /var/log/messages %panic|error|Critical
        LOAD 25.0 35.0


except for the splunk server

on that ONE server I don't want above LOG to apply. 

How can I do that?


Gonda

list John Thurston · Fri, 11 Oct 2013 08:57:15 -0800 ·

▸ quoted from Bakkies Gatvol

On 10/11/2013 4:46 AM, Bakkies Gatvol wrote:

I have this and it is good

CLASS=linux
         PROC ntpd
         PROC sshd 1
         PROC cron
         FILE /var/log/messages red MODE=644
         LOG /var/log/messages %panic|error|Critical
         LOAD 25.0 35.0


except for the splunk server

Check in analysis.cfg.5.html under the section:
"RULES: APPLYING SETTINGS TO SELECTED HOSTS"

    HOST=%.*.foo.com
            LOAD 7.0 12.0 HOST=bax.foo.com
            LOAD 3.0 8.0

will result in the load-limits being 7.0/12.0 for the "bax.foo.com" host, and 3.0/8.0 for all other foo.com hosts.

I suspect the same option is available on LOG

-- 
    Do things because you should, not just because you can.

John Thurston    XXX-XXX-XXXX
user-ce4d79d99bab@xymon.invalid
Enterprise Technology Services
Department of Administration
State of Alaska

override CLASS(LOG) for one host 🔗 link

override CLASS(LOG) for one host