Alerting on the existence of a file with wildcards
list Michael Burger
I've successfully tested monitoring for the appearance of a statically
defined file (i.e. no wildcards), and have been happy with the result.
I'm now tasked with trying to alarm on the appearance of file where only
part of the filename will be static, hence the need for wildcards.
I'm at the point where the presence of a file causes a green condition,
and the removal of that file causes a white condition.
The client-local.cfg is set up to look like this (the commented lines
are my various attempts to test/change the behavior):
file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort
-r`
#file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort
-r | head -n 1`
#file:`find /opt/WSCluster1/WebSphere/wp_profile | grep javacore | sort
-r | head -n 1`
#file:`find /opt/WSCluster2/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`
#file:`find /opt/WSCluster3/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`
log:/var/adm/syslog/syslog.log:10240
The analysis.cfg is set up like so (again, commented lines are my
attempts to test/change the behavior):
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.) yellow
NOEXIST
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
yellow
I've put a test file out,
/opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is
reporting green on the file's existence...which, of course, is not the
desired behavior.
My guess is that I'm completely bollixing the regex...any thoughts or
help would be appreciated.
--
Mike Burger
AIX Administrator
<http://freedomhome.fhmc.local/intranet/main.jsp>;
Phone (XXX) XXX-XXXX, Fax (XXX) XXX-XXXX, Cell (XXX) XXX-XXXX
E-mail: user-c26873f0522a@xymon.invalid
"Once word leaks out that a pirate's gone soft, people begin to disobey
you and then it's nothing but work, work, work, all the time."
--Westley/The Dread Pirate Roberts
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for
the sole use of the intended recipient(s) and may contain confidential
information. Any unauthorized review, use, disclosure, alteration or
distribution is strictly prohibited and may violate state or federal law. If you
are not the intended recipient, please contact the sender by reply e-mail,
delete this email and destroy all copies of the message.
list Jeremy Laidman
I'm guessing the same. The "^" means to tie to the start of the string, which makes no sense unless it's at the start of the string. Try something like this: FILE /opt/WSCluster1/WebSphere/wp_profile/%^javacore yellow NOEXIST Note that the regex "^javacore" will match anything starting with "javacore" no matter what follows. It's as if there's an implied wildcard at the end. J On 29 December 2012 01:04, Michael Burger
▸
<user-c26873f0522a@xymon.invalid>wrote:
I’ve successfully tested monitoring for the appearance of a statically
defined file (i.e. no wildcards), and have been happy with the result.****
** **
I’m now tasked with trying to alarm on the appearance of file where only
part of the filename will be static, hence the need for wildcards.****
** **
I’m at the point where the presence of a file causes a green condition,
and the removal of that file causes a white condition.****
** **
The client-local.cfg is set up to look like this (the commented lines are
my various attempts to test/change the behavior):****
** **
file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r`
****
#file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r
| head -n 1`****
#file:`find /opt/WSCluster1/WebSphere/wp_profile | grep javacore | sort -r
| head -n 1`****
#file:`find /opt/WSCluster2/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`****
#file:`find /opt/WSCluster3/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`****
log:/var/adm/syslog/syslog.log:10240****
** **
The analysis.cfg is set up like so (again, commented lines are my attempts
to test/change the behavior):****
** **
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.) yellow
NOEXIST****
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow****
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.) yellow
****
** **
I’ve put a test file out,
/opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is reporting
green on the file’s existence…which, of course, is not the desired behavior.
****
** **
My guess is that I’m completely bollixing the regex…any thoughts or help
would be appreciated.****
** **
--****
*Mike Burger*****
*AIX Administrator*
*[image: cid:image001.gif at 01CC72C8.834C1990]*<http://freedomhome.fhmc.local/intranet/main.jsp>; **** *Phone (XXX) XXX-XXXX**, **Fax** **(XXX) XXX-XXXX, Cell (XXX) XXX-XXXX *** *E-mail: **user-c26873f0522a@xymon.invalid*<user-9fdcca966073@xymon.invalid>
▸
****
"Once word leaks out that a pirate's gone soft, people begin to disobey
you and then it's nothing but work, work, work, all the time."
--Westley/The Dread Pirate Roberts****
** **
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for
the sole use of the intended recipient(s) and may contain confidential
information. Any unauthorized review, use, disclosure, alteration or
distribution is strictly prohibited and may violate state or federal law. If you
are not the intended recipient, please contact the sender by reply e-mail,
delete this email and destroy all copies of the message.
list David Baldwin
Michael,
Regular expressions must be specified for the entire match, so the
following is probably closer to the mark:
FILE %/opt/WSCluster.*/WebSphere/wp_profile/javacore yellow NOEXIST
In the client-local.cfg you can probably try an alternative also:
file:`find /opt/WSCluster*/WebSphere/wp_profile -type f -name javacore*
| sort -r`
David.▸
I’ve successfully tested monitoring for the appearance of a statically
defined file (i.e. no wildcards), and have been happy with the result.
I’m now tasked with trying to alarm on the appearance of file where
only part of the filename will be static, hence the need for wildcards.
I’m at the point where the presence of a file causes a green
condition, and the removal of that file causes a white condition.
The client-local.cfg is set up to look like this (the commented lines
are my various attempts to test/change the behavior):
file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore | sort -r`
#file:`find /opt/WSCluster*/WebSphere/wp_profile | grep javacore |
sort -r | head -n 1`
#file:`find /opt/WSCluster1/WebSphere/wp_profile | grep javacore |
sort -r | head -n 1`
#file:`find /opt/WSCluster2/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`
#file:`find /opt/WSCluster3/WebSphere/wp_profile | grep javacore >
/dev/null | sort -r | head --lines=1`
log:/var/adm/syslog/syslog.log:10240
The analysis.cfg is set up like so (again, commented lines are my
attempts to test/change the behavior):
FILE /opt/WSCluster1/WebSphere/wp_profile/%javacore(^*.)
yellow NOEXIST
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.)
NOEXIST yellow
# FILE /opt/WSCluster(^*.)/WebSphere/wp_profile/javacore(^*.) yellow
I’ve put a test file out,
/opt/WSCluster1/WebSphere/wp_profile/javacore.mike1, and Xymon is
reporting green on the file’s existence…which, of course, is not the
desired behavior.
My guess is that I’m completely bollixing the regex…any thoughts or
help would be appreciated.
--
*Mike Burger*
*AIX Administrator*
*cid:image001.gif at 01CC72C8.834C1990* <http://freedomhome.fhmc.local/intranet/main.jsp>; *Phone (XXX) XXX-XXXX**, **Fax****(XXX) XXX-XXXX, Cell (XXX) XXX-XXXX ***
▸
*E-mail: **user-c26873f0522a@xymon.invalid*
"Once word leaks out that a pirate's gone soft, people begin to
disobey you and then it's nothing but work, work, work, all the time."
--Westley/The Dread Pirate Roberts
CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for
the sole use of the intended recipient(s) and may contain confidential
information. Any unauthorized review, use, disclosure, alteration or
distribution is strictly prohibited and may violate state or federal law. If you
are not the intended recipient, please contact the sender by reply e-mail,
delete this email and destroy all copies of the message.
--
David Baldwin - Senior Systems Administrator (Datacentres + Networks) Information and Communication Technology Services Australian Sports Commission http://ausport.gov.au Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616 user-cbbf693f2c89@xymon.invalid Leverrier Street Bruce ACT 2617 Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
list Jeremy Laidman
On 2 January 2013 14:10, David Baldwin <user-cbbf693f2c89@xymon.invalid> wrote:
Regular expressions must be specified for the entire match
Doh! Yes, what he said. I parsed the strings starting at the percent. Oops. J
list Michael Burger
I'll give it a try...thank you both very much.
▸
-- Mike Burger AIX Administrator <http://freedomhome.fhmc.local/intranet/main.jsp>; Phone (XXX) XXX-XXXX, Fax (XXX) XXX-XXXX, Cell (XXX) XXX-XXXX E-mail: user-c26873f0522a@xymon.invalid "Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts From: Jeremy Laidman [mailto:user-71895fb2e44c@xymon.invalid] Sent: Tuesday, January 01, 2013 11:02 PM To: David Baldwin Cc: Michael Burger; xymon at xymon.com Subject: Re: [Xymon] Alerting on the existence of a file with wildcards On 2 January 2013 14:10, David Baldwin <user-cbbf693f2c89@xymon.invalid> wrote: Regular expressions must be specified for the entire match Doh! Yes, what he said. I parsed the strings starting at the percent. Oops. J CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.
list Michael Burger
Here's what finally worked for generating the alarms: FILE %/opt/WSCluster.*/WebSphere/wp_profile/javacore.* yellow NOEXIST I believe that the .* after "WSCluster" was terminating the initial regex, as what I was seeing was the same behavior (white with files not found, green when the files existed). Setting "javacore" to "javacore.*" as well generated the yellow alarms I was looking for.
▸
-- Mike Burger AIX Administrator <http://freedomhome.fhmc.local/intranet/main.jsp>; Phone (XXX) XXX-XXXX, Fax (XXX) XXX-XXXX, Cell (XXX) XXX-XXXX E-mail: user-c26873f0522a@xymon.invalid "Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts
From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf
Of Michael Burger
Sent: Wednesday, January 02, 2013 7:55 AM
To: Jeremy Laidman; David Baldwin
Cc: xymon at xymon.com
▸
Subject: Re: [Xymon] Alerting on the existence of a file with wildcards I'll give it a try...thank you both very much. -- Mike Burger AIX Administrator <http://freedomhome.fhmc.local/intranet/main.jsp>; Phone (XXX) XXX-XXXX, Fax (XXX) XXX-XXXX, Cell (XXX) XXX-XXXX E-mail: user-c26873f0522a@xymon.invalid "Once word leaks out that a pirate's gone soft, people begin to disobey you and then it's nothing but work, work, work, all the time." --Westley/The Dread Pirate Roberts From: Jeremy Laidman [mailto:user-71895fb2e44c@xymon.invalid] Sent: Tuesday, January 01, 2013 11:02 PM To: David Baldwin Cc: Michael Burger; xymon at xymon.com Subject: Re: [Xymon] Alerting on the existence of a file with wildcards On 2 January 2013 14:10, David Baldwin <user-cbbf693f2c89@xymon.invalid> wrote: Regular expressions must be specified for the entire match Doh! Yes, what he said. I parsed the strings starting at the percent. Oops. J CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message. CONFIDENTIALITY NOTICE: This e-mail message, including all attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, alteration or distribution is strictly prohibited and may violate state or federal law. If you are not the intended recipient, please contact the sender by reply e-mail, delete this email and destroy all copies of the message.