Wants Status to change for MSGS (Log file) for Hobbit Client 🔗 link

Hello,


I'm having a problem with getting a hobbit client to change status of 'MSGS'
to Red if Hobbit finds the word "error" in /var/log/messages.

A few things to note:


   - The Client *can* transmit data to the hobbit server for all other
   statuses(memory, procs, disk, etc..) without any problems
   - The ''hobbit'' account does have read access to /var/log/messages
   - The Client launches Hobbit with the ''-local'' option to allow use of
   localclients.cfg
   - I've frequently ran ''logger -p" to force the word ''error'' into
   /var/log/messages.
   - The hostname matches what's in bb-hosts and the config files on both
   client and server
   - Linux client and server


*Here is what I have in  /home/hobbit/client/etc/localclient.cfg on the
Hobbit Client:*
============================================================
DEFAULT
        UP      1h
        LOAD    5.0 10.0
        DISK    * 90 95
        MEMPHYS 100 101
        MEMSWAP 50 80
        MEMACT  90 97

LOG /var/log/messages error COLOR=red         ##This does not work
PROC "/opt/openfiler/sbin/opendev" 1 2 yellow   ##This works fine
============================================================

*Here is what I have in /home/hobbit/server/etc/client-local.cfg on the
Hobbit Server:*
============================================================
[linux]
log:/var/log/messages:10240
============================================================


*And here is what I have in /home/hobbit/server/etc/hobbit-clients.cfg on
the Hobbit Server:*
============================================================
UP      1h
LOAD    5.0 10.0
DISK    * 90 95
SWAP    20 40
MEMPHYS 100 101
MEMSWAP 50 80
MEMACT  90 97
LOG /var/log/messages error COLOR=red HOST=gsxxx.xxxxxi.com
============================================================


And  yet I cannot get the status of MSGS to go to Red for the client when I
put 'error' into /var/log/messages

Thanks,

Richard, 

Without looking at the man pages I'll just give an example that seems to work fine for me.  I don't know if you need to apply any kind of regex to something as simple as 'error' but it probably would not hurt to give it a try.


LOG  %/var/log/(kern|messages) "%(error|ext3_journal_start_sb|Detected aborted journal|rabid monkeys|and so on)" COLOR=yellow


Regards, 

Tim

From: Richard Quinn [user-8355688bb613@xymon.invalid]
Sent: Wednesday, September 29, 2010 6:09 PM
To: xymon at xymon.com
Subject: [xymon] Wants Status to change for MSGS (Log file) for Hobbit Client

Hello,


I'm having a problem with getting a hobbit client to change status of 'MSGS' to Red if Hobbit finds the word "error" in /var/log/messages.

A few things to note:


 *   The Client *can* transmit data to the hobbit server for all other statuses(memory, procs, disk, etc..) without any problems
 *   The ''hobbit'' account does have read access to /var/log/messages
 *   The Client launches Hobbit with the ''-local'' option to allow use of localclients.cfg
 *   I've frequently ran ''logger -p" to force the word ''error'' into /var/log/messages.
 *   The hostname matches what's in bb-hosts and the config files on both client and server
 *   Linux client and server


Here is what I have in  /home/hobbit/client/etc/localclient.cfg on the Hobbit Client:
============================================================
DEFAULT
        UP      1h
        LOAD    5.0 10.0
        DISK    * 90 95
        MEMPHYS 100 101
        MEMSWAP 50 80
        MEMACT  90 97

LOG /var/log/messages error COLOR=red         ##This does not work
PROC "/opt/openfiler/sbin/opendev" 1 2 yellow   ##This works fine
============================================================

Here is what I have in /home/hobbit/server/etc/client-local.cfg on the Hobbit Server:
============================================================
[linux]
log:/var/log/messages:10240
============================================================


And here is what I have in /home/hobbit/server/etc/hobbit-clients.cfg on the Hobbit Server:
============================================================
UP      1h
LOAD    5.0 10.0
DISK    * 90 95
SWAP    20 40
MEMPHYS 100 101
MEMSWAP 50 80
MEMACT  90 97

LOG /var/log/messages error COLOR=red HOST=gsxxx.xxxxxi.com<http://gsxxx.xxxxxi.com>;

============================================================


And  yet I cannot get the status of MSGS to go to Red for the client when I put 'error' into /var/log/messages

Thanks,

In <user-b5b22eea2c1c@xymon.invalid> Richard Quinn <user-8355688bb613@xymon.invalid> writes:

Rule of thumb: ALWAYS keep the default settings last. If you have 
a rule that applies to a specific host, like this one:

LOG /var/log/messages error COLOR=red HOST=gsxxx.xxxxxi.com

make sure you put that before the DEFAULT settings. If you
want it to apply to all Linux hosts, use the CLASS setting:

CLASS=linux
	LOG /var/log/messages error COLOR=red


Another thing to check: Look at the "Client data" link from
any of the current statuses for the host. Near the bottom are
the log message data and the log entries - make sure
/var/log/messages shows up there, and that the data you expect
to see is actually there. Remember, the client only looks at
log-entries that have happened in the past 30 minutes.


Regards,
Henrik

In <i8190o$stv$user-e356fad9864f@xymon.invalid> Henrik "Størner" <user-ce4a2c883f75@xymon.invalid> writes:

Sorry, didn't notice at first that you are running the client
in "local" mode. In that case you won't have the client data
available.


Regards,
Henrik

On Wed, 29 Sep 2010 20:09:04 -0500, Richard Quinn

<user-8355688bb613@xymon.invalid> wrote:

This was a problem to me during several months and finally, someone helped
me out on the mailing list. You have to create a file in the Hobbit tmp/
directory :
  # cat ..../hobbit-monitor/client/tmp/logfetch.<HOSTNAME>.cfg
  log:/var/log/messages:10240
  log:/var/log/mail.log:10240
  log:/var/log/auth.log:10240

<HOSTNAME> is the hostname of your machine (I used to do : touch
tmp/logfetch.`hostname`.cfg). Once this file is created and filed in, you
will see the light ;)

On Thursday, 30 September 2010 07:11:42 L.M.J wrote:

*If* you run the client in local mode, I believe you should only need to put the content that would otherwise go in client-local.cfg on the server in localclient.cfg on the client. I don't think you should need to create the logfetch file manually.

If you don't run the client in local mode, the client should create this file itself, from the configuration for the client in the client-local.cfg file on the server.


Regards,
Buchan