problem with LOG and IGNORE in analysis.cfg 🔗 link

Hi,

I have a server running Xymon 4.3.4 with a pretty basic analysis.cfg:

        DEFAULT
                # These are the built-in defaults.
                UP      1h
                LOAD    5.0 10.0
                DISK    * 90 95
                MEMPHYS 100 101
                MEMSWAP 50 80
                MEMACT  90 97
                LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST


However, the IGNORE doesn't seem to work for the LOG line:

        (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test
        Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com
        Hosttype []: sunos
        Test (cpu, mem, disk, proc, log, port): log
        log filename: /var/adm/messages
        To read log data from a file, enter '@FILENAME' at the prompt
        log line: ERROR this is just a TEST
        log line:
        Log status is red

        &red ERROR this is just a TEST


What's funnier is that the log lines that should trigger a red alert are turning out to be green:

        (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test
        Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com
        Hosttype []: sunos
        Test (cpu, mem, disk, proc, log, port): log
        log filename: /var/adm/messages
        To read log data from a file, enter '@FILENAME' at the prompt
        log line: this ERROR should be red
        log line:
        Log status is green


Am I not using the LOG and IGNORE correctly in analysis.cfg, or is this a bug?


Thanks,
Ray


This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.

Hi,

I have a server running Xymon 4.3.4 with a pretty basic analysis.cfg:

        DEFAULT
                # These are the built-in defaults.
                UP      1h
                LOAD    5.0 10.0
                DISK    * 90 95
                MEMPHYS 100 101
                MEMSWAP 50 80
                MEMACT  90 97
                LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST


However, the IGNORE doesn't seem to work for the LOG line:

        (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test
        Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com
        Hosttype []: sunos
        Test (cpu, mem, disk, proc, log, port): log
        log filename: /var/adm/messages
        To read log data from a file, enter '@FILENAME' at the prompt
        log line: ERROR this is just a TEST
        log line:
        Log status is red

        &red ERROR this is just a TEST


What's funnier is that the log lines that should trigger a red alert are turning out to be green:

        (xymon)@xymon:~$ /home/xymon/server/bin/xymond_client --test
        Hostname (.=end, ?=dump, !=reload) []: hostname.domain.com
        Hosttype []: sunos
        Test (cpu, mem, disk, proc, log, port): log
        log filename: /var/adm/messages
        To read log data from a file, enter '@FILENAME' at the prompt
        log line: this ERROR should be red
        log line:
        Log status is green


Am I not using the LOG and IGNORE correctly in analysis.cfg, or is this a bug?


Thanks,
Ray


This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.

I think your regular expressions are not right. Try runnign them
through pcretest.

               LOG /var/adm/messages %ERROR|WARNING COLOR=red IGNORE=TEST

I think that should be %(ERROR|WARNING)

[Raymond Lee]

pcretest checks out fine:

        (xymon)@xymon:~$ pcretest
        PCRE version 7.8 2008-09-05

          re> /ERROR|WARNING/
        data> this is an ERROR
         0: ERROR
        data> this is a WARNING
         0: WARNING


And the man page for analysis.cfg has this example:


       Example: Trigger a yellow warning on all occurrences of the word "WARN‐
       ING"  or "NOTICE" in the "daemon.log" file, except those from the "lpr"
       system:
            LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr

This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful.  If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.

[snip]

Known bug in 4.3.4. This patch fixes it.


Regards,
Henrik

I am going to install Xymon on Solaris 10.  Are there instructions on how to install Xymon on Solaris 10, what are the pre-requisites that need to be in place before the installation begins.  

Is there a way to install xymon without root or is root a requirement?

I installed BigBrother 1.9 on solaris 9 and it was a grulling process in finding all the required libraries for the open source to be installed.  Is the process similar to that for Xymon.

Are you installing xymon agents or server ?

I've compiled agents on Solaris 10 ( both x68 and SPARC ) without any
problems ( if required using libraries from opencsw.org ) and had
running server on OpenSolaris - also don't remember any problem with
the build.

So the best way to figure out - download, try to compile and ask in
case of issues :)

--
Alex


2011/8/12 LOZOVSKY, DANIEL L (ATTSI) <user-5085da3588ee@xymon.invalid>:

Server but I got them to give me red hat enterprise.  So, I think that will be better.  

----- Original Message -----
From: Alex Levin [mailto:user-4da80e0ba39d@xymon.invalid]
Sent: Tuesday, August 16, 2011 10:08 PM
To: LOZOVSKY, DANIEL L (ATTSI)
Cc: Henrik Størner <user-ce4a2c883f75@xymon.invalid>; xymon at xymon.com <xymon at xymon.com>
Subject: Re: [Xymon] Installing Xymon on Solaris 10

Are you installing xymon agents or server ?

I've compiled agents on Solaris 10 ( both x68 and SPARC ) without any
problems ( if required using libraries from opencsw.org ) and had
running server on OpenSolaris - also don't remember any problem with
the build.

So the best way to figure out - download, try to compile and ask in
case of issues :)

--
Alex


2011/8/12 LOZOVSKY, DANIEL L (ATTSI) <user-5085da3588ee@xymon.invalid>:

This is obviously old (CentOS 5.1) but should apply very closely if not
perfect short of the RPMForge package.

http://en.wikibooks.org/wiki/System_Monitoring_with_Xymon/Administration_Guide/Compiling_on_CentOS

Josh Luthman
Office: XXX-XXX-XXXX
Direct: XXX-XXX-XXXX
XXXX Wayne St
Suite XXXX
Troy, OH XXXXX


On Wed, Aug 17, 2011 at 1:13 AM, LOZOVSKY, DANIEL L (ATTSI)

<user-5085da3588ee@xymon.invalid>wrote: