Ignoring Veeam Backup filesystems 🔗 link

I'm deploying Veeam Backup & Replication to perform systems.? I have a few Linux hosts that require being backed up via the local agent instead of using a VM-based backup. The backups run in the middle of the night as you might expect.? 2AM Sunday, I received a full filesystem alarm on a Linux host I'm testing.? It cleared in the next test sweep 5 minutes later but the unnecessarily alarms woke me up.? I want to minimize that from happening.

The Veeam agent creates and mounts devices under /tmp for the backup.? The df line from the filesystem alarm looks like:
Filesystem?????? 1024-blocks ? Used Available? Capacity? Mounted on
/dev/veeamimage7 ? ? 4128448 4026052 ? ? ? ? 0????? 100% /tmp/{16296b8b-8ad4-6614-6da9-aacdc519bd6b}

The actual filesystem name is different on each host.? I assume it's based on the host's BIOS UUID or the block ID.? I don't want to add individual lines for each host.

I want to add the following line to my analysis.cfg in the "CLASS=linux" section:
DISK %^/tmp/\{[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}\} IGNORE

Questions:
1.)? Is this regex valid for the analysis.cfg?
2.)? Is there a better way to handle this?

Thanks,
--Robert.


Robert Herron

Hello Robert,

If you do not expect to mount something else in /tmp, you may use
something like:
DISK %^/tmp/.* IGNORE
seems easier to read and understand, however may be too wide.

If you expect to mount something else in /tmp, then your regex seems OK
and unavoidable
Le 08/02/2021 ? 16:38, Robert Herron a ?crit :

I'm deploying Veeam Backup & Replication to perform systems.  I have a few
Linux hosts that require being backed up via the local agent instead of
using a VM-based backup.   The backups run in the middle of the night as
you might expect.  2AM Sunday, I received a full filesystem alarm on a
Linux host I'm testing.  It cleared in the next test sweep 5 minutes later
but the unnecessarily alarms woke me up.  I want to minimize that from
happening.

The Veeam agent creates and mounts devices under /tmp for the backup.  The
df line from the filesystem alarm looks like:
Filesystem       1024-blocks    Used Available  Capacity  Mounted on
/dev/veeamimage7     4128448 4026052         0      100%
/tmp/{16296b8b-8ad4-6614-6da9-aacdc519bd6b}

The actual filesystem name is different on each host.  I assume it's based
on the host's BIOS UUID or the block ID.  I don't want to add individual
lines for each host.

I want to add the following line to my analysis.cfg in the "CLASS=linux"
section:
DISK
%^/tmp/\{[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}\}
IGNORE

Questions:
1.)  Is this regex valid for the analysis.cfg?
2.)  Is there a better way to handle this?

Thanks,
--Robert.


Robert Herron
user-8b27ea4290da@xymon.invalid

On Mon, Feb 8, 2021, 5:23 PM Jeremy Laidman <user-0608abae5e7c@xymon.invalid> wrote:

I'm with Robert - simple and good enough is often better than perfect but
unfathomable. Consider how likely it is that you would care about a
filesystem mounted under /tmp to be full.

Here's a slightly more accurate match, but still very simple:

DISK %^/tmp/\{.*\} IGNORE

This will match any string in the form {*}.

Another option is to add "delayred=disk:5" into the hosts.cfg entry for
the hosts that get the local backups. This will delay the alert long enough
for the filesystem to be un-mounted. However, there's a risk that a genuine
alert for another filesystem is delayed by 5 minutes.

On Tue, 9 Feb 2021 at 02:44, Damien Martins via Xymon <xymon at xymon.com>
wrote:

---------- Forwarded message ----------
From: Damien Martins <user-c12727b399f0@xymon.invalid>
To: xymon at xymon.com
Cc:
Bcc:
Date: Mon, 8 Feb 2021 16:44:22 +0100
Subject: Re: [Xymon] Ignoring Veeam Backup filesystems

Hello Robert,

If you do not expect to mount something else in /tmp, you may use
something like:
DISK %^/tmp/.* IGNORE
seems easier to read and understand, however may be too wide.

If you expect to mount something else in /tmp, then your regex seems OK
and unavoidable
Le 08/02/2021 ? 16:38, Robert Herron a ?crit :

I'm deploying Veeam Backup & Replication to perform systems.  I have a
few Linux hosts that require being backed up via the local agent instead of
using a VM-based backup.   The backups run in the middle of the night as
you might expect.  2AM Sunday, I received a full filesystem alarm on a
Linux host I'm testing.  It cleared in the next test sweep 5 minutes later
but the unnecessarily alarms woke me up.  I want to minimize that from
happening.

The Veeam agent creates and mounts devices under /tmp for the backup.
The df line from the filesystem alarm looks like:
Filesystem       1024-blocks    Used Available  Capacity  Mounted on
/dev/veeamimage7     4128448 4026052         0      100%
/tmp/{16296b8b-8ad4-6614-6da9-aacdc519bd6b}

The actual filesystem name is different on each host.  I assume it's
based on the host's BIOS UUID or the block ID.  I don't want to add
individual lines for each host.

I want to add the following line to my analysis.cfg in the "CLASS=linux"
section:
DISK
%^/tmp/\{[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}\}
IGNORE

Questions:
1.)  Is this regex valid for the analysis.cfg?
2.)  Is there a better way to handle this?

Thanks,
--Robert.


Robert Herron
user-8b27ea4290da@xymon.invalid

Xymon mailing user-d459c9d661b6@xymon.invalid


---------- Forwarded message ----------
From: Damien Martins via Xymon <xymon at xymon.com>
To: xymon at xymon.com
Cc:
Bcc:
Date: Mon, 8 Feb 2021 16:44:22 +0100
Subject: Re: [Xymon] Ignoring Veeam Backup filesystems