LOG pattern not matching 🔗 link

Steve Holmes wrote:

Hi all,

I may not be understanding how the LOG match-pattern works.

In my hobbit-clients.cfg file I have under the DEFAULT section the following:

        LOG %.* NOTICE
        LOG %.* ERROR
        LOG %.* WARNING COLOR=yellow
        LOG %.* notice COLOR=yellow
        LOG %.* error COLOR=yellow
        LOG %.* daemon.error COLOR=yellow
        LOG %.* warning COLOR=yellow
        LOG %.* warn COLOR=yellow

At the moment on my hobbit server I have a green status for the host mentor and the following messages in /var/adm/messages:

[msgs:/var/adm/messages]
<...SKIPPED...>

The above is copied from the hobbit display reached by clicking on the [/var/adm/messages] link on the msgs page for this host.

In the client-local.cfg I have:

[sunos]
log:/var/adm/messages:10240


So why is the page green? There are at least 3 strings that should match to turn it yellow, right? And incidentally, the BB server I'm running on another host *does* show yellow. I'm trying to validate my hobbit configuration by making sure it matches the running BB server. And it doesn't for msgs, ever.

Thanks,
Steve.

On 5/9/07, Charles Jones <user-e86b4aeade4e@xymon.invalid> wrote:

 Your syntax is wrong.  For logfile monitoring you must have the following
in hobbit-clients.cfg:
*LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

So, using one of your examples below, it should be:

LOG /var/adm/messages WARNING COLOR=yellow

If you need a reference just check the man pages, either on your Hobbit
instance, or at:
http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html

http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html

-Charles

Steve Holmes wrote:

Hi all,

I may not be understanding how the LOG match-pattern works.

In my hobbit-clients.cfg file I have under the DEFAULT section the
following:

        LOG %.* NOTICE
        LOG %.* ERROR
        LOG %.* WARNING COLOR=yellow
        LOG %.* notice COLOR=yellow
        LOG %.* error COLOR=yellow
        LOG %.* daemon.error COLOR=yellow
        LOG %.* warning COLOR=yellow
        LOG %.* warn COLOR=yellow

At the moment on my hobbit server I have a green status for the host
mentor and the following messages in /var/adm/messages:

[msgs:/var/adm/messages]
<...SKIPPED...>
purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW,
qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
read(10)                Error Level: Retryable
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Requested Block: 33383911                  Error Block: 33383911
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Sense Key: Media Error
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.warning]
WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
write(10)               Error Level: Retryable
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Requested Block: 33982299                  Error Block: 33982299
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Sense Key: Unit Attention

The above is copied from the hobbit display reached by clicking on the
[/var/adm/messages] link on the msgs page for this host.

In the client-local.cfg I have:

[sunos]
log:/var/adm/messages:10240


So why is the page green? There are at least 3 strings that should match
to turn it yellow, right? And incidentally, the BB server I'm running on
another host *does* show yellow. I'm trying to validate my hobbit
configuration by making sure it matches the running BB server. And it
doesn't for msgs, ever.

Thanks,
Steve.

-- 

Steve Holmes wrote:

Charles,
I had read the man page, honest. I read the following:

"logfilename" is the name of the logfile. Only logentries from this 
filename will be matched against this rule. Note that "logfilename" 
can be a regular expression (if prefixed with a '%' character).

to mean that %.* would match all logfilenames. Guest not, huh?

Thanks, I'll try that.

Steve.


On 5/9/07, *Charles Jones* <user-e86b4aeade4e@xymon.invalid 
<mailto:user-e86b4aeade4e@xymon.invalid>> wrote:

    Your syntax is wrong.  For logfile monitoring you must have the
    following in hobbit-clients.cfg:
    *LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

    So, using one of your examples below, it should be:

    LOG /var/adm/messages WARNING COLOR=yellow

    If you need a reference just check the man pages, either on your
    Hobbit instance, or at:
    http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html

    <http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html>;

    -Charles


    Steve Holmes wrote:

    Hi all,

    I may not be understanding how the LOG match-pattern works.

    In my hobbit-clients.cfg file I have under the DEFAULT section
    the following:

            LOG %.* NOTICE
            LOG %.* ERROR
            LOG %.* WARNING COLOR=yellow
            LOG %.* notice COLOR=yellow
            LOG %.* error COLOR=yellow
            LOG %.* daemon.error COLOR=yellow
            LOG %.* warning COLOR=yellow
            LOG %.* warn COLOR=yellow

    At the moment on my hobbit server I have a green status for the
    host mentor and the following messages in /var/adm/messages:

    [msgs:/var/adm/messages]
    <...SKIPPED...>
    purdue.edu <http://purdue.edu>; scsi: [ID 107833 kern.warning]
    WARNING: /pci at 9,600000/SUNW,qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
    (ssd1):
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>;     Error for Command:
    read(10)                Error Level: Retryable
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Requested Block: 33383911                  Error Block: 33383911
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Vendor: SEAGATE                            Serial Number:
    0317A1JGAZ 
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Sense Key: Media Error
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.warning]
    WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
    (ssd1):
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>;     Error for Command:
    write(10)               Error Level: Retryable
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Requested Block: 33982299                  Error Block: 33982299
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Vendor: SEAGATE                            Serial Number:
    0317A1JGAZ 
    May  9 11:07:36 mentor.ics.purdue.edu
    <http://mentor.ics.purdue.edu>; scsi: [ID 107833 kern.notice]    
    Sense Key: Unit Attention

    The above is copied from the hobbit display reached by clicking
    on the [/var/adm/messages] link on the msgs page for this host.

    In the client-local.cfg I have:

    [sunos]
    log:/var/adm/messages:10240


    So why is the page green? There are at least 3 strings that
    should match to turn it yellow, right? And incidentally, the BB
    server I'm running on another host *does* show yellow. I'm trying
    to validate my hobbit configuration by making sure it matches the
    running BB server. And it doesn't for msgs, ever.

    Thanks,
    Steve.

-- 
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have 
government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)

Steve.


On 5/9/07, Charles Jones <user-e86b4aeade4e@xymon.invalid> wrote:

 Hmm actually you are right about the regex, it *should* work. I'd try
making it work without the regex first, if that works, then I would try
putting quotes around the logfilename regex, ie
LOG "%.*" WARNING COLOR=yellow

You aren't supposed to need the quotes, but I've had to use it for PROC
regex entries in hobbit-clients.cfg before.

-Charles

Steve Holmes wrote:

Charles,
I had read the man page, honest. I read the following:

"logfilename" is the name of the logfile. Only logentries from this
filename will be matched against this rule. Note that "logfilename" can be a
regular expression (if prefixed with a '%' character).

to mean that %.* would match all logfilenames. Guest not, huh?

Thanks, I'll try that.

Steve.


On 5/9/07, Charles Jones <user-e86b4aeade4e@xymon.invalid> wrote:

Your syntax is wrong.  For logfile monitoring you must have the
following in hobbit-clients.cfg:
*LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

So, using one of your examples below, it should be:

LOG /var/adm/messages WARNING COLOR=yellow

If you need a reference just check the man pages, either on your Hobbit
instance, or at:
http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html

http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html


-Charles

Steve Holmes wrote:

Hi all,

I may not be understanding how the LOG match-pattern works.

In my hobbit-clients.cfg file I have under the DEFAULT section the
following:

        LOG %.* NOTICE
        LOG %.* ERROR
        LOG %.* WARNING COLOR=yellow
        LOG %.* notice COLOR=yellow
        LOG %.* error COLOR=yellow
        LOG %.* daemon.error COLOR=yellow
        LOG %.* warning COLOR=yellow
        LOG %.* warn COLOR=yellow

At the moment on my hobbit server I have a green status for the host
mentor and the following messages in /var/adm/messages:

[msgs:/var/adm/messages]
<...SKIPPED...>
purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW,
qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1):
May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
read(10)                Error Level: Retryable
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Requested Block: 33383911                  Error Block: 33383911
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Sense Key: Media Error
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.warning]
WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0
(ssd1):
May  9 11:07:36 mentor.ics.purdue.edu     Error for Command:
write(10)               Error Level: Retryable
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Requested Block: 33982299                  Error Block: 33982299
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Vendor: SEAGATE                            Serial Number: 0317A1JGAZ
May  9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice]
Sense Key: Unit Attention

The above is copied from the hobbit display reached by clicking on the
[/var/adm/messages] link on the msgs page for this host.

In the client-local.cfg I have:

[sunos]
log:/var/adm/messages:10240


So why is the page green? There are at least 3 strings that should match
to turn it yellow, right? And incidentally, the BB server I'm running on
another host *does* show yellow. I'm trying to validate my hobbit
configuration by making sure it matches the running BB server. And it
doesn't for msgs, ever.

Thanks,
Steve.

--
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government
by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)

-- 
I believe I found the missing link between animal and civilized man. It is
us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by
the majority who participate. -Thomas Jefferson, third US president,
architect and author (1743-1826)