Alerting on number of times a keyword appers in a logfile? 🔗 link

Is this possible without an ext script?

-Charles

After searching the Hobbit mailing list, I believe the answer to this question is "no". All I found is mention of how Henrik first created the linecount functionality (http://www.hswn.dk/hobbiton/2006/06/msg00084.html).

So it looks like I will have to implement this myself.  I'm thinking this would be easiest to do as a *server* side ext script, rather than client, since I am using the linecount option, the hobbit client is already sending the number of times the keyword appears in the /client data/.  Here's a snippet of my client data message for a particular host:

[linecount:/apps/apache/logs/access_main_log]
SessionTimeouts: 1683

*So I guess my question is now, how can I access client data for a host from a server side ext script?*
I tried doing a recursive grep for "Session" in the data and tmp directories, and found nothing?

-Charles

Charles Jones wrote:

Is this possible without an ext script?

-Charles

Use CLIENT side.  Much easier.  Don't try to leverage what the client is
already doing.


	From: Charles Jones [mailto:user-e86b4aeade4e@xymon.invalid] 
	Sent: Monday, December 11, 2006 1:09 PM
	To: user-ae9b8668bcde@xymon.invalid
	Subject: [hobbit] Accessing "client data" from a server side ext
script? (Re: [hobbit] Alerting on number of times a keyword appers in a
logfile?)

	
	
	After searching the Hobbit mailing list, I believe the answer to
this question is "no". All I found is mention of how Henrik first
created the linecount functionality
(http://www.hswn.dk/hobbiton/2006/06/msg00084.html). 
	
	So it looks like I will have to implement this myself.  I'm
thinking this would be easiest to do as a server side ext script, rather
than client, since I am using the linecount option, the hobbit client is
already sending the number of times the keyword appears in the client
data.  Here's a snippet of my client data message for a particular host:
	
	
	[linecount:/apps/apache/logs/access_main_log]
	SessionTimeouts: 1683
	So I guess my question is now, how can I access client data for
a host from a server side ext script?
	I tried doing a recursive grep for "Session" in the data and tmp
directories, and found nothing?
	
	-Charles
	
	Charles Jones wrote: 

		Is this possible without an ext script? 
		
		-Charles

Writing client-side scripts is difficult in my environment because I have dozens of servers whose hobbit directories are on a shared SAN, so for any client-side script that needs to only run on a few hosts, I have to put checks in to make sure that $HOSTNAME is equal to the hosts I want it to run on.  Also, the builtin linecount function is already sending the counts for the keywords to the hobbit server, so why run another process on the client to do the same thing when the server already has the data.

Since my last email I have figured out how to access the client data from the server.  In my case this is:

./bb 127.0.0.1 "clientlog prod-web-12 section=linecount:/apps/apache/logs/access_main_log"
Which returns:
[linecount:/apps/apache/logs/access_main_log]
SessionTimeouts: 1756

So now I can make a server side ext script which processes the latest linecounts and sends alerts if they exceed a certain threshold.  Hopefully Henrik will add a more graceful solution for this in a future version of Hobbit.

-Charles

Hubbard, Greg L wrote:

Charles Jones wrote :

Try with :

bb 127.0.0.1 "hobbitdboard host=youclientname test=msgs fields=msg"

you then get the status message. You can now send another status message
(under another column name).


-- 
Charles Goyard - user-98f9625a7a59@xymon.invalid - (+33) 1 45 38 01 31

On Mon, Dec 11, 2006 at 12:08:55PM -0700, Charles Jones wrote:

  bb 127.0.0.1 "clientlog MYHOST section=logfile:/var/log/messages"

The "section" is optional; if omitted, you'll get the entire client
message.

It's in the bb(1) man-page ...


Regards,
Henrik