need help with IGNORE pattern

14 messages in this thread

list Asif Iqbal · Mon, 17 Nov 2008 17:43:55 -0500 ·

This is the data in /var/adm/messages file

  Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

  LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Asif Iqbal · Tue, 18 Nov 2008 10:28:45 -0500 ·

▸ quoted from Asif Iqbal

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

▸ quoted from Asif Iqbal

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Dominique Frise · Tue, 18 Nov 2008 16:44:00 +0100 ·

▸ quoted from Asif Iqbal

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"


Dominique

list Asif Iqbal · Tue, 18 Nov 2008 11:33:49 -0500 ·

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise

▸ quoted from Dominique Frise

<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"


Just tried that. Still getting `red'

(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]

▸ quoted from Dominique Frise

WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)


log line:
Log status is red

&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:

▸ quoted from Dominique Frise

fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)


I am wondering if hobbit is misbehaving?!

Dominique

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Asif Iqbal · Tue, 18 Nov 2008 11:37:13 -0500 ·

▸ quoted from Asif Iqbal

On Tue, Nov 18, 2008 at 11:33 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"


Just tried that. Still getting `red'

(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red

&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)

Here is the relevant line from the dump output of `hobbitd_client --test'

LOG /var/adm/messages MATCH=%(?-i)WARNING|(?-i)ERROR COLOR=red
IGNORE=%(?-i)fcsm.* HOST=server (line: 613)

▸ quoted from Asif Iqbal

I am wondering if hobbit is misbehaving?!

Dominique

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Steve Holmes · Tue, 18 Nov 2008 12:11:48 -0500 ·

This has been a problem for a long time (one of only 2 things I can fault
xymon for) and I hope it is on the list of things to fix in the next
release.

I have nothing that can help you  except to say that having tried many, many
different combinations of quotes and regular expressions, all I have been
able to conclude is that sometimes it works and sometimes it doesn't. I have
not been able to determine a pattern.
Steve Holmes
Purdue University

▸ quoted from Asif Iqbal


On Tue, Nov 18, 2008 at 11:37 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 11:33 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

list Asif Iqbal · Tue, 18 Nov 2008 12:26:59 -0500 ·

▸ quoted from Steve Holmes

On Tue, Nov 18, 2008 at 12:11 PM, Steve Holmes <user-ec1bf77b1b44@xymon.invalid> wrote:

This has been a problem for a long time (one of only 2 things I can fault
xymon for) and I hope it is on the list of things to fix in the next
release.

I have nothing that can help you  except to say that having tried many, many
different combinations of quotes and regular expressions, all I have been
able to conclude is that sometimes it works and sometimes it doesn't. I have
not been able to determine a pattern.

I bet there are more people in that list. Let's hope Henrik has a
quick workaround (crossing my fingers)

▸ quoted from Steve Holmes

Steve Holmes
Purdue University

On Tue, Nov 18, 2008 at 11:37 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 11:33 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Dominique Frise · Wed, 19 Nov 2008 08:14:54 +0100 ·

▸ quoted from Asif Iqbal

Asif Iqbal wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"


Just tried that. Still getting `red'

(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red

&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)


I am wondering if hobbit is misbehaving?!

Dominique

I could test your rule successfuly on our Xymon installation:

[bb at iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: iris

▸ quoted from Asif Iqbal

Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt


log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:

▸ quoted from Asif Iqbal

fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport 
error(0xe); reason: No Connection(0x5)
log line:


Log status is green

Hostname (.=end, ?=dump, !=reload) [iris]:


- Make sure you don't have other rules for /var/adm/messages in 
hobbit-clients.cfg.

- Check your pcre installation.

[bb at iris bin]$ pcretest
PCRE version 7.7 2008-05-07

   re> /(?-i)fcsm.*/
data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:

▸ quoted from Asif Iqbal

fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport 
error(0xe); reason: No Connection(0x5)


  0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID 
0xfffffa failed state: Packet Transport error(0xe); reason: No 
Connection(0x5)
data>


The above check shows that pcre is behaving as expected. (see man page 
for pcretest)


Dominique

list Asif Iqbal · Wed, 19 Nov 2008 10:42:55 -0500 ·

I am using hobbit 4.2 with all-in-one patch as my server.

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise

▸ quoted from Dominique Frise

<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"


Just tried that. Still getting `red'

(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red

&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)


I am wondering if hobbit is misbehaving?!

Dominique

I could test your rule successfuly on our Xymon installation:

[bb at iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: iris
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
log line:
Log status is green

Hostname (.=end, ?=dump, !=reload) [iris]:


- Make sure you don't have other rules for /var/adm/messages in
hobbit-clients.cfg.

- Check your pcre installation.

[bb at iris bin]$ pcretest
PCRE version 7.7 2008-05-07

 re> /(?-i)fcsm.*/
data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
 0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
0xfffffa failed state: Packet Transport error(0xe); reason: No
Connection(0x5)
data>


The above check shows that pcre is behaving as expected. (see man page for
pcretest)


Dominique

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Steve Holmes · Wed, 19 Nov 2008 22:39:53 -0500 ·

▸ quoted from Dominique Frise

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise <user-78ab6673b600@xymon.invalid>wrote:

- Make sure you don't have other rules for /var/adm/messages in
hobbit-clients.cfg.

What? Why? How can you live with only one rule?

Steve
-- 
Truth never damages a cause that is just. -Mohandas Karamchand Gandhi
(1869-1948)

list Asif Iqbal · Thu, 20 Nov 2008 00:10:21 -0500 ·

▸ quoted from Asif Iqbal

On Tue, Nov 18, 2008 at 11:33 AM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

[..stripped for brevity..]
I am wondering if hobbit is misbehaving?!


hobbit is *definitely* misbehaving.

If my log line: in the following test does not have the exact word
`WARNING' *only* then I get green for the with this ignore pattern
%fcsm.*. It should be always green if `fcsm' shows up in log line

Here are the relevant lines in hobbit-client.cfg file
[....]
HOST=server
LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" COLOR=red IGNORE=%fcsm.*
[...]

Here are the two tests. First one failing (because of the WARNING) and
second one passes
(both of them should pass according to hobbit-client.cfg man page)

(hobbit)@hobbit:~/server$ ./bin/hobbitd_client --test

▸ quoted from Asif Iqbal

Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt


log line: Nov 19 18:25:07 server fcsm: [ID 517869 kern.warning]

▸ quoted from Asif Iqbal

WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red


&red Nov 19 18:25:07 server fcsm: [ID 517869 kern.warning] WARNING:

▸ quoted from Asif Iqbal

fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)


Hostname (.=end, ?=dump, !=reload) [server]:

▸ quoted from Asif Iqbal

Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt


log line: Nov 19 18:25:07 server fcsm: [ID 517869 kern.warning] :

▸ quoted from Asif Iqbal

fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
log line:
Log status is green


Hostname (.=end, ?=dump, !=reload) [server]:

How do I submit this bug? I tested it with hobbit-4.3 trunk's
hobbitd_client and showing same behavior.

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

list Dominique Frise · Thu, 20 Nov 2008 07:24:26 +0100 ·

▸ quoted from Steve Holmes

Steve Holmes wrote:

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise <user-78ab6673b600@xymon.invalid> wrote:


    - Make sure you don't have other rules for /var/adm/messages in
    hobbit-clients.cfg.


What? Why? How can you live with only one rule?
 Steve
-- 
Truth never damages a cause that is just. -Mohandas Karamchand Gandhi (1869-1948)

The rule used by Asif is generic (no HOST=...).
Keeping only this rule will help debugging.


Dominique

list Dominique Frise · Thu, 20 Nov 2008 07:39:54 +0100 ·

▸ quoted from Asif Iqbal

Asif Iqbal wrote:

I am using hobbit 4.2 with all-in-one patch as my server.

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Tue, Nov 18, 2008 at 10:44 AM, Dominique Frise
<user-78ab6673b600@xymon.invalid> wrote:

Asif Iqbal wrote:

On Mon, Nov 17, 2008 at 5:43 PM, Asif Iqbal <user-6f4b51ac2a40@xymon.invalid> wrote:

This is the data in /var/adm/messages file

 Nov 17 15:25:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason:  No Connection(0x5)


This is the entry in hobbit-client.cfg

 LOG /var/adm/messages "%(?-i)WARNING|(?-i)ERROR" IGNORE=%fcsm.*

I also tried %.*fcsm.* with no avail

But I am still getting alerts for that line in messages file

What am I doing wrong?

Still looking for a suggestion

--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

Try this : IGNORE=%(?-i)fcsm.*
You can then try that regexp with "hobbitd_client --test"

Just tried that. Still getting `red'

(hobbit)@hobbit:~/server$ ./bin/bbcmd hobbitd_client --test
2008-11-18 11:29:36 Using default environment file
/export/home/hobbit/server/etc/hobbitserver.cfg
Hostname (.=end, ?=dump, !=reload) []: server
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning]
WARNING: fcsm(0): fc packet to DID 0xfffffa failed state: Packet
Transport error(0xe); reason: No Connection(0x5)
log line:
Log status is red

&red Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)


I am wondering if hobbit is misbehaving?!

Dominique

I could test your rule successfuly on our Xymon installation:

[bb at iris bin]$ ./hobbitd_client --test
Hostname (.=end, ?=dump, !=reload) []: iris
Hosttype []:
Test (cpu, mem, disk, proc, log, port): log
log filename: /var/adm/messages
To read log data from a file, enter '@FILENAME' at the prompt
log line: Nov 18 09:15:08 iris fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
log line:
Log status is green

Hostname (.=end, ?=dump, !=reload) [iris]:


- Make sure you don't have other rules for /var/adm/messages in
hobbit-clients.cfg.

- Check your pcre installation.

[bb at iris bin]$ pcretest
PCRE version 7.7 2008-05-07

 re> /(?-i)fcsm.*/
data> Nov 18 09:15:08 server fcsm: [ID 517869 kern.warning] WARNING:
fcsm(0): fc packet to DID 0xfffffa failed state: Packet Transport
error(0xe); reason: No Connection(0x5)
 0: fcsm: [ID 517869 kern.warning] WARNING: fcsm(0): fc packet to DID
0xfffffa failed state: Packet Transport error(0xe); reason: No
Connection(0x5)
data>


The above check shows that pcre is behaving as expected. (see man page for
pcretest)


Dominique

Hmmm... I meant Xymon to be modern ;-)

We are also using Hobbit 4.2.0 with all-in-one-patch.
Pcre is not part of Hobbit but used in regexp pattern matching.
You should check it to make sure it works as expected.

Dominique

list Asif Iqbal · Thu, 20 Nov 2008 09:15:23 -0500 ·

On Thu, Nov 20, 2008 at 1:24 AM, Dominique Frise

▸ quoted from Dominique Frise

<user-78ab6673b600@xymon.invalid> wrote:

Steve Holmes wrote:

On Wed, Nov 19, 2008 at 2:14 AM, Dominique Frise <user-78ab6673b600@xymon.invalid>
wrote:


   - Make sure you don't have other rules for /var/adm/messages in
   hobbit-clients.cfg.


What? Why? How can you live with only one rule?
 Steve
--
Truth never damages a cause that is just. -Mohandas Karamchand Gandhi
(1869-1948)

The rule used by Asif is generic (no HOST=...).
Keeping only this rule will help debugging.

I created a temporary hobbit-client.cfg file to test and put the
IGNORE pattern on DEFAULT instead of
host specific like you suggested and *only* then I get the expected result.

(hobbit)@hobbit:~/server$ ./bin/hobbitd_client
--config=/tmp/hobbit-clients.cfg --test

So I just removed that host specific rule and moved the IGNORE pattern
to DEFAULT.
Nasty workaround if you ask me :-)

Thanks for the help

▸ quoted from Dominique Frise

What? Why? How can you live with only one rule?
 Steve
--
Truth never damages a cause that is just. -Mohandas Karamchand Gandhi
(1869-1948)

Dominique

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu

need help with IGNORE pattern 🔗 link

need help with IGNORE pattern