LOG alert not showing yellow

5 messages in this thread

list Robert Manocchia · Tue, 5 Jun 2007 15:38:21 -0400 ·

I have a small problem. I've set up monitoring of the /var/log/messages
logfile to search for the string "authentication failure" and alert with a
yellow button in the MSG column. I can see the error displayed when I click
on the button below the Msg column header but it does not turn yellow.

 
 Below is the entry in the clients-local.cfg file:

 
[batman]

log:/var/log/messages:10240

ignore MARK

 
This is the entry in the hobbit-clients.cfg file:

 
HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 
Why doesn't this give me a yellow alert.

 
 Thanks

 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

list Sello Tlabela SD · Wed, 6 Jun 2007 07:37:24 +0200 ·

Hi Manocchia,

 
It could be access rights, if you are running hobbit using the init
script it will run as user hobbit and make sure that hobbit user can
read /var/log/messages

 
Regards

 
Sello Tlabela

▸ quoted from Robert Manocchia

From: Manocchia, Robert [mailto:user-615a9b935f98@xymon.invalid] 
Sent: 05 June 2007 21:38
To: 'user-ae9b8668bcde@xymon.invalid'
Subject: [hobbit] LOG alert not showing yellow

I have a small problem. I've set up monitoring of the
/var/log/messages logfile to search for the string "authentication
failure" and alert with a yellow button in the MSG column. I can see
the error displayed when I click on the button below the Msg column
header but it does not turn yellow.

 Below is the entry in the clients-local.cfg file:

[batman]

log:/var/log/messages:10240

ignore MARK

This is the entry in the hobbit-clients.cfg file:

HOST=batman

        LOG     /var/log/messages       authentication failure
color=yellow

Why doesn't this give me a yellow alert.

 Thanks

Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at 
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

list Robert Manocchia · Wed, 6 Jun 2007 08:42:48 -0400 ·

The /var/log/messages file has rw-r-r-- access rights so the hobbit user can
read the file.

▸ quoted from Sello Tlabela SD


 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

-----Original Message-----
From: Sello Tlabela (SD) [mailto:user-68d80b7df288@xymon.invalid] 
Sent: Wednesday, June 06, 2007 1:37 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] LOG alert not showing yellow

 
Hi Manocchia,

 
It could be access rights, if you are running hobbit using the init script
it will run as user hobbit and make sure that hobbit user can read
/var/log/messages

 
Regards

 
Sello Tlabela

 
From: Manocchia, Robert [mailto:user-615a9b935f98@xymon.invalid] 
Sent: 05 June 2007 21:38
To: 'user-ae9b8668bcde@xymon.invalid'
Subject: [hobbit] LOG alert not showing yellow

 
I have a small problem. I've set up monitoring of the /var/log/messages
logfile to search for the string "authentication failure" and alert with a
yellow button in the MSG column. I can see the error displayed when I click
on the button below the Msg column header but it does not turn yellow.

 
 Below is the entry in the clients-local.cfg file:

 
[batman]

log:/var/log/messages:10240

ignore MARK

 
This is the entry in the hobbit-clients.cfg file:

 
HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 
Why doesn't this give me a yellow alert.

 
 Thanks

 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at 
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

list Giovanni - Gestor Redix · Wed, 06 Jun 2007 09:48:06 -0300 ·

Try using this syntax (changing space with \s + pcre)
        LOG     /var/log/messages       %authentication\sfailure  color=yellow

Giovanni M. Frainer - Gestor

▸ quoted from Sello Tlabela SD



Sello Tlabela (SD) wrote:

Hi Manocchia,

 
It could be access rights, if you are running hobbit using the init script it will run as user hobbit and make sure that hobbit user can read /var/log/messages

 
Regards

 
Sello Tlabela

 
*From:* Manocchia, Robert [mailto:user-615a9b935f98@xymon.invalid]
*Sent:* 05 June 2007 21:38
*To:* 'user-ae9b8668bcde@xymon.invalid'
*Subject:* [hobbit] LOG alert not showing yellow

 
I have a small problem. I've set up monitoring of the /var/log/messages logfile to search for the string "authentication failure" and alert with a yellow button in the MSG column. I can see the error displayed when I click on the button below the Msg column header but it does not turn yellow.

 
 Below is the entry in the clients-local.cfg file:

 
[batman]

log:/var/log/messages:10240

ignore MARK

 
This is the entry in the hobbit-clients.cfg file:

 
HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 
Why doesn't this give me a yellow alert.

 
 Thanks

 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

list Robert Manocchia · Wed, 6 Jun 2007 09:00:49 -0400 ·

I tried the following syntax:

 
  LOG   /var/log/messages          %authentication\sfailure  color=yellow

 
The messages appears as an alert but the color remains green.

 
  Is this syntax correct?

▸ signature


 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

-----Original Message-----

▸ quoted from Giovanni - Gestor Redix

From: Giovanni - Gestor Redix [mailto:user-e1d5cb184a81@xymon.invalid] 
Sent: Wednesday, June 06, 2007 8:48 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: Re: [hobbit] LOG alert not showing yellow

 
Try using this syntax (changing space with \s + pcre)
        LOG     /var/log/messages       %authentication\sfailure
color=yellow


Giovanni M. Frainer - Gestor


Sello Tlabela (SD) wrote: 

Hi Manocchia,

 
It could be access rights, if you are running hobbit using the init script
it will run as user hobbit and make sure that hobbit user can read
/var/log/messages

 
Regards

 
Sello Tlabela

 
From: Manocchia, Robert [mailto:user-615a9b935f98@xymon.invalid
<mailto:user-615a9b935f98@xymon.invalid> ] 
Sent: 05 June 2007 21:38


To: 'user-ae9b8668bcde@xymon.invalid <mailto:user-ae9b8668bcde@xymon.invalid> '

▸ quoted from Giovanni - Gestor Redix

Subject: [hobbit] LOG alert not showing yellow

 
I have a small problem. I've set up monitoring of the /var/log/messages
logfile to search for the string "authentication failure" and alert with a
yellow button in the MSG column. I can see the error displayed when I click
on the button below the Msg column header but it does not turn yellow.

 
 Below is the entry in the clients-local.cfg file:

 
[batman]

log:/var/log/messages:10240

ignore MARK

 
This is the entry in the hobbit-clients.cfg file:

 
HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 
Why doesn't this give me a yellow alert.

 
 Thanks

 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX


EMail user-615a9b935f98@xymon.invalid <mailto:user-615a9b935f98@xymon.invalid>

▸ quoted from Giovanni - Gestor Redix


 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at 
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF


<http://www.telkom.co.za/TelkomEMailLegalNotice.PDF>; 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

LOG alert not showing yellow 🔗 link

LOG alert not showing yellow