Monitoring file sizes

9 messages in this thread

list Paul Ward · Thu, 8 Jan 2009 15:05:01 +1300 ·

Hi All,

I a bit of a newbie to hobbit / xymon so please forgive me.

I have been trying to get my hobbit server to monitor a file called
/home/xymon/test.txt, so I can log the growth on it, should I append
TRACK to it?

I have modified client-local.cfg and added
[linux]
log:/var/log/messages:10240
file:/home/xymon/test.txt

I have no data in hobbit to show for this what am I doing wrong?

Thanks


-- 

email: user-0f18dc2f935b@xymon.invalid
website: http://www.pward.co.uk
MSN: user-a51fe8e4fa06@xymon.invalid
Skype: paul.n.ward

list Darrin Khan · Thu, 8 Jan 2009 13:30:22 +1100 ·

Hi Paul,

You will also need an entry in the hobbit-clients.cfg file.

The entry in client-local.cfg tells the hobbit client to check this file and
send the details on the file
back to the server, where as the one in hobbit-clients.cfg does the
evaluation of the data
returned from the hobbit client.

It is pretty well documented. Maybe something like ..

HOST=nms.am.my.net
    FILE /bin/sh yellow TRACK

Hope this helps ..

Darrin

2009/1/8 Paul Ward <user-0f18dc2f935b@xymon.invalid>

▸ quoted from Paul Ward

Hi All,

I a bit of a newbie to hobbit / xymon so please forgive me.

I have been trying to get my hobbit server to monitor a file called
/home/xymon/test.txt, so I can log the growth on it, should I append
TRACK to it?

I have modified client-local.cfg and added
[linux]
log:/var/log/messages:10240
file:/home/xymon/test.txt

I have no data in hobbit to show for this what am I doing wrong?

Thanks


--

email: user-0f18dc2f935b@xymon.invalid
website: http://www.pward.co.uk
MSN: user-a51fe8e4fa06@xymon.invalid
Skype: paul.n.ward

--


Darrin Khan
user-8737e9cc15a9@xymon.invalid

Timothy Leary  - "Women who seek to be equal with men lack ambition."

list Rich Smrcina · Wed, 07 Jan 2009 20:31:58 -0600 ·

▸ quoted from Paul Ward

Paul Ward wrote:

Hi All,

I a bit of a newbie to hobbit / xymon so please forgive me.

I have been trying to get my hobbit server to monitor a file called
/home/xymon/test.txt, so I can log the growth on it, should I append
TRACK to it?

I have modified client-local.cfg and added
[linux]
log:/var/log/messages:10240
file:/home/xymon/test.txt

I have no data in hobbit to show for this what am I doing wrong?

Thanks

In hobbit-clients.cfg on the server you need to add a FILE entry.  See the commentary at 
the beginning of the file for details.

-- 
Rich Smrcina
VM Assist, Inc.
Phone: XXX-XXX-XXXX
Ans Service:  XXX-XXX-XXXX
http://www.linkedin.com/in/richsmrcina

Catch the WAVV!  http://www.wavv.org
WAVV 2009 - Orlando, FL - May 15-19, 2009

list Paul Ward · Thu, 8 Jan 2009 15:52:56 +1300 ·

Thanks for your help,

I will wait for dome data to turn up now.
The other thing though is I have         DIR /home TRACK
In the hobbit-clients.cfg but no DIR are showing up in xymon under
filesystems or files?
Is there again something I have not done?

Thanks

2009/1/8 Rich Smrcina <user-cf452ff334e0@xymon.invalid>:

▸ quoted from Paul Ward

Paul Ward wrote:

Hi All,

I a bit of a newbie to hobbit / xymon so please forgive me.

I have been trying to get my hobbit server to monitor a file called
/home/xymon/test.txt, so I can log the growth on it, should I append
TRACK to it?

I have modified client-local.cfg and added
[linux]
log:/var/log/messages:10240
file:/home/xymon/test.txt

I have no data in hobbit to show for this what am I doing wrong?

Thanks

In hobbit-clients.cfg on the server you need to add a FILE entry.  See the
commentary at the beginning of the file for details.

--
Rich Smrcina
VM Assist, Inc.
Phone: XXX-XXX-XXXX
Ans Service:  XXX-XXX-XXXX
http://www.linkedin.com/in/richsmrcina

Catch the WAVV!  http://www.wavv.org
WAVV 2009 - Orlando, FL - May 15-19, 2009

-- 

email: user-0f18dc2f935b@xymon.invalid
website: http://www.pward.co.uk
MSN: user-a51fe8e4fa06@xymon.invalid
Skype: paul.n.ward

list Rich Smrcina · Thu, 08 Jan 2009 07:28:29 -0600 ·

Directory monitoring also requires a setting on the client so that the client knows what 
to send to the server.  See client-local.cfg on your client.

▸ quoted from Paul Ward


Paul Ward wrote:

Thanks for your help,

I will wait for dome data to turn up now.
The other thing though is I have         DIR /home TRACK
In the hobbit-clients.cfg but no DIR are showing up in xymon under
filesystems or files?
Is there again something I have not done?

Thanks

-- 
Rich Smrcina
VM Assist, Inc.
Phone: XXX-XXX-XXXX
Ans Service:  XXX-XXX-XXXX
http://www.linkedin.com/in/richsmrcina

Catch the WAVV!  http://www.wavv.org
WAVV 2009 - Orlando, FL - May 15-19, 2009

list Colin Coe · Mon, 18 Apr 2016 07:42:50 +0800 ·

Hi all

I'm trying to monitor some log files on Windows 7 clients.  I have this in
the analysis.cfg file:
---
HOST=%client.*
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<1G red TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<1G red TRACK
---

The files are displayed but regardless of the file size, the test stays
green.

I want the test to go red when the files exceed 1GB and yellow when greater
than 500MB.

Any ideas where I'm going wrong?

Thanks

CC

list David Baldwin · Mon, 18 Apr 2016 10:40:47 +1000 ·

▸ quoted from Colin Coe

On 18/04/2016 9:42 am, Colin Coe wrote:

Hi all

I'm trying to monitor some log files on Windows 7 clients.  I have
this in the analysis.cfg file:
--- 
HOST=%client.*
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<1G red TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<1G red TRACK
---

The files are displayed but regardless of the file size, the test
stays green.

I want the test to go red when the files exceed 1GB and yellow when
greater than 500MB.

Any ideas where I'm going wrong?

Is your filename supposed to be a regex? Wildcard matching isn't builtin.

Try:

FILE "%C:\users\user\Documents\ClientTiming.*log" SIZE<500M yellow TRACK

For starters.

Also, have you checked the file data is in your client data report to
match? Note that client-local.cfg only supports explicit filenames
unless this is an extension for whatever Windows Xymon client you are using.

An alternative approach is to monitor the size of the folder containing
the log files. OK if only a few designated logs in there. Not so good if
you've got unlimited history, etc.

I have the following for my Windows clients:

(in /etc/client-local.cfg)

[win32]
dir:C:\inetpub
dir:C:\ProgramData\Microsoft\Windows\WER
dir:C:\Windows\Logs\CBS
dir:C:\Windows\Temp

(in analysis.cfg)
DIR C:\Windows\Logs\CBS yellow SIZE<200000 TRACK=C-CBS
DIR C:\Windows\Logs\CBS red SIZE<500000
DIR C:\ProgramData\Microsoft\Windows\WER yellow SIZE<200000
TRACK=C-WER
DIR C:\ProgramData\Microsoft\Windows\WER red SIZE<500000
DIR C:\Windows\Temp yellow SIZE<200000 TRACK=C-Windows-Temp
EXHOST=%(sccm)
DIR C:\Windows\Temp red SIZE<500000 EXHOST=%(sccm)

David.

--
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Digital Information Management and Technology
Australian Sports Commission http://ausport.gov.au
Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616
user-cbbf693f2c89@xymon.invalid 1 Leverrier Street Bruce ACT 2617
Our Values: RESPECT + INTEGRITY + TEAMWORK + EXCELLENCE

Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.

list Colin Coe · Mon, 18 Apr 2016 10:52:21 +0800 ·

Hi David and thanks for the reply

I've corrected the regex but the test is still not going red.

Could you share your client-local.cfg?

Thanks

CC

On Mon, Apr 18, 2016 at 8:40 AM, David Baldwin <user-cbbf693f2c89@xymon.invalid

▸ quoted from David Baldwin

wrote:

On 18/04/2016 9:42 am, Colin Coe wrote:

Hi all

I'm trying to monitor some log files on Windows 7 clients.  I have this in
the analysis.cfg file:
---
HOST=%client.*
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTiming*log" SIZE<1G red TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<500M yellow TRACK
    FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<1G red TRACK
---

The files are displayed but regardless of the file size, the test stays
green.

I want the test to go red when the files exceed 1GB and yellow when
greater than 500MB.

Any ideas where I'm going wrong?

Is your filename supposed to be a regex? Wildcard matching isn't builtin.

Try:

FILE "%C:\users\user\Documents\ClientTiming.*log" SIZE<500M yellow TRACK

For starters.

Also, have you checked the file data is in your client data report to
match? Note that client-local.cfg only supports explicit filenames unless
this is an extension for whatever Windows Xymon client you are using.

An alternative approach is to monitor the size of the folder containing
the log files. OK if only a few designated logs in there. Not so good if
you've got unlimited history, etc.

I have the following for my Windows clients:

(in /etc/client-local.cfg)

[win32]
dir:C:\inetpub
dir:C:\ProgramData\Microsoft\Windows\WER
dir:C:\Windows\Logs\CBS
dir:C:\Windows\Temp

(in analysis.cfg)
        DIR C:\Windows\Logs\CBS yellow SIZE<200000 TRACK=C-CBS
        DIR C:\Windows\Logs\CBS red SIZE<500000
        DIR C:\ProgramData\Microsoft\Windows\WER yellow SIZE<200000
TRACK=C-WER
        DIR C:\ProgramData\Microsoft\Windows\WER red SIZE<500000
        DIR C:\Windows\Temp yellow SIZE<200000 TRACK=C-Windows-Temp
EXHOST=%(sccm)
        DIR C:\Windows\Temp red SIZE<500000 EXHOST=%(sccm)


David.

--
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Digital Information Management and Technology
Australian Sports Commission          http://ausport.gov.au


Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT user-0e3dcac72dc1@xymon.invalid          1 Leverrier Street Bruce ACT 2617

▸ quoted from David Baldwin

Our Values: RESPECT + INTEGRITY + TEAMWORK + EXCELLENCE


Keep up to date with what's happening in Australian sport visit


www.ausport.gov.au

▸ quoted from David Baldwin


This message is intended for the addressee named and may contain
confidential and privileged information. If you are not the intended
recipient please note that any form of distribution, copying or use of this
communication or the information in it is strictly prohibited and may be
unlawful. If you receive this message in error, please delete it and notify
the sender.

list David Baldwin · Mon, 18 Apr 2016 13:17:58 +1000 ·

Colin,

▸ quoted from Colin Coe

Hi David and thanks for the reply

I've corrected the regex but the test is still not going red.

Is there anything in the Client Data report?
You should see sections like:

[file:C:\WINDOWS\system.ini]
type:0x00020 (file)
mode:777 (not implemented)
linkcount:1
owner:0 (not implemented)
group:0 (not implemented)
size:219
atime:1247574897 (2009/07/14-12:34:57)
ctime:1247574897 (2009/07/14-12:34:57)
mtime:1244704084 (2009/06/11-07:08:04)

Could you share your client-local.cfg?

I don't have any wildcard matching, only specific named files, so
nothing I can send you.

From client-local.cfg man page:

    FILE CONFIGURATION ENTRIES
           A file monitoring entry is used to watch the meta-data of a
    file: Owner, group, size, permis-
           sions, checksum etc. It looks like this:

               file:/var/log/messages[:HASH]

           The  file:FILENAME  line  defines  the  filename  of the file
    to monitor.  As with the "log:"
           entries, a filename enclosed in backticks means a command
    which will generate  the  filenames
           dynamically.  The optional [:HASH] setting defines what type
    of hash to compute for the file:
           md5, sha1 or rmd160. By default, no hash is calculated.
           NOTE: If you want to check multiple files using a wildcard,
    you must use a command to  gener-
           ate the filenames. Putting wildcards directly into the file:
    entry will not work.

So unless you are dynamically generating the file name client side,
which would at least require PS client since BBWin doesn't support it,
that is the issue to solve, or else monitor the folder if that can be done.

David

▸ quoted from Colin Coe

Thanks

CC

On Mon, Apr 18, 2016 at 8:40 AM, David Baldwin


<user-cbbf693f2c89@xymon.invalid <mailto:user-cbbf693f2c89@xymon.invalid>>

▸ quoted from Colin Coe

wrote:

    On 18/04/2016 9:42 am, Colin Coe wrote:

    Hi all

    I'm trying to monitor some log files on Windows 7 clients.  I
    have this in the analysis.cfg file:
    --- 
    HOST=%client.*
        FILE "C:\users\user\Documents\ClientTiming*log" SIZE<500M
    yellow TRACK
        FILE "C:\users\user\Documents\ClientTiming*log" SIZE<1G red TRACK
        FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<500M
    yellow TRACK
        FILE "C:\users\user\Documents\ClientTrace*log"  SIZE<1G red TRACK
    ---

    The files are displayed but regardless of the file size, the test
    stays green.

    I want the test to go red when the files exceed 1GB and yellow
    when greater than 500MB.

    Any ideas where I'm going wrong?

    Is your filename supposed to be a regex? Wildcard matching isn't
    builtin.

    Try:

    FILE "%C:\users\user\Documents\ClientTiming.*log" SIZE<500M yellow
    TRACK

    For starters.

    Also, have you checked the file data is in your client data report
    to match? Note that client-local.cfg only supports explicit
    filenames unless this is an extension for whatever Windows Xymon
    client you are using.

    An alternative approach is to monitor the size of the folder
    containing the log files. OK if only a few designated logs in
    there. Not so good if you've got unlimited history, etc.

    I have the following for my Windows clients:

    (in /etc/client-local.cfg)

    [win32]
    dir:C:\inetpub
    dir:C:\ProgramData\Microsoft\Windows\WER
    dir:C:\Windows\Logs\CBS
    dir:C:\Windows\Temp

    (in analysis.cfg)
            DIR C:\Windows\Logs\CBS yellow SIZE<200000 TRACK=C-CBS
            DIR C:\Windows\Logs\CBS red SIZE<500000
            DIR C:\ProgramData\Microsoft\Windows\WER yellow
    SIZE<200000 TRACK=C-WER
            DIR C:\ProgramData\Microsoft\Windows\WER red SIZE<500000
            DIR C:\Windows\Temp yellow SIZE<200000
    TRACK=C-Windows-Temp EXHOST=%(sccm)
            DIR C:\Windows\Temp red SIZE<500000 EXHOST=%(sccm)


    David.

    -- 
    David Baldwin - Senior Systems Administrator (Datacentres + Networks)
    Digital Information Management and Technology
    Australian Sports Commission          http://ausport.gov.au
    Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616


    user-cbbf693f2c89@xymon.invalid <mailto:user-cbbf693f2c89@xymon.invalid>          1 Leverrier Street Bruce ACT 2617

▸ quoted from Colin Coe

    Our Values: RESPECT + INTEGRITY + TEAMWORK + EXCELLENCE


    Keep up to date with what's happening in Australian sport visit
    www.ausport.gov.au <http://www.ausport.gov.au>;

    This message is intended for the addressee named and may contain
    confidential and privileged information. If you are not the
    intended recipient please note that any form of distribution,
    copying or use of this communication or the information in it is
    strictly prohibited and may be unlawful. If you receive this
    message in error, please delete it and notify the sender.

-- 
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Digital Information Management and Technology
Australian Sports Commission          http://ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
user-cbbf693f2c89@xymon.invalid          1 Leverrier Street Bruce ACT 2617
Our Values: RESPECT + INTEGRITY + TEAMWORK + EXCELLENCE

Monitoring file sizes 🔗 link

Monitoring file sizes