LOG test fails to IGNORE ?

7 messages in this thread

list Jerry Yu · Thu, 28 Sep 2006 17:01:40 -0400 ·

hi,
I have one single Hobbit server running 4.2RC1-20060712 on CentOS 4. Clients
have some harmless SELinux warning messages in /var/log/messages. I
configured Hobbit to ignore such lines (conf entries appended).
However, the LOG test still generates alerts. Below is excerpted from an
email alert. Any idea why? I brought up before 4.2 final version is
released, I believe, and was told it should not be the case.

&yellow Sep 28 15:58:20 saturn su[4070]: Warning!  Could not relabel  with
user_u:object_r:devpts_t, not relabeling.

---cut---x------ hobbit-clients.cfg -----x-------cut-----
HOST=saturn
log /var/log/messages %WARNING|NOTICE|ERROR COLOR=yellow IGNORE=relabeling
---cut---x------ clients-local.cfg -----x-------cut-----
[saturn]
log:/var/log/messages:10240
ignore MARK

list Jerry Yu · Fri, 29 Sep 2006 10:41:15 -0400 ·

any one ?

On 9/28/06, Jerry Yu <user-764c1f364fe0@xymon.invalid> wrote:

hi,
I have one single Hobbit server running 4.2RC1-20060712 on CentOS 4.
Clients have some harmless SELinux warning messages in /var/log/messages. I
configured Hobbit to ignore such lines (conf entries appended).
However, the LOG test still generates alerts. Below is excerpted from an
email alert. Any idea why? I brought up before 4.2 final version is
released, I believe, and was told it should not be the case.

&yellow Sep 28 15:58:20 saturn su[4070]: Warning!  Could not relabel  with
user_u:object_r:devpts_t, not relabeling.

---cut---x------ hobbit-clients.cfg -----x-------cut-----
HOST=saturn
log /var/log/messages %WARNING|NOTICE|ERROR COLOR=yellow IGNORE=relabeling
---cut---x------ clients-local.cfg -----x-------cut-----
[saturn]
log:/var/log/messages:10240
ignore MARK

list Olivier Boyaval · Fri, 29 Sep 2006 17:30:23 +0200 ·

Jerry Yu a écrit :

any one ?

On 9/28/06, *Jerry Yu* <user-764c1f364fe0@xymon.invalid <mailto:user-764c1f364fe0@xymon.invalid>>

▸ quoted from Jerry Yu

wrote:

    hi,
    I have one single Hobbit server running 4.2RC1-20060712 on CentOS
    4. Clients have some harmless SELinux warning messages in
    /var/log/messages. I configured Hobbit to ignore such lines (conf
    entries appended).
    However, the LOG test still generates alerts. Below is excerpted
    from an email alert. Any idea why? I brought up before 4.2 final
    version is released, I believe, and was told it should not be the
    case.

    &yellow Sep 28 15:58:20 saturn su[4070]: Warning!  Could not
    relabel  with user_u:object_r:devpts_t, not relabeling.

    ---cut---x------ hobbit-clients.cfg -----x-------cut-----
    HOST=saturn
    log /var/log/messages %WARNING|NOTICE|ERROR COLOR=yellow
    IGNORE=relabeling
    ---cut---x------ clients-local.cfg -----x-------cut-----
    [saturn]
    log:/var/log/messages:10240
    ignore MARK

You can test :

log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"

and

ignore RELABELING

Cdl

Olivier

list Jerry Yu · Fri, 29 Sep 2006 12:58:23 -0400 ·

The 'hobbit-clients.cfg' man page give this example:
LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr

This is identical to mine except the actual log file name and strings.

▸ quoted from Olivier Boyaval



On 9/29/06, Olivier Boyaval <user-f56ee5cec7be@xymon.invalid> wrote:

Jerry Yu a écrit :

any one ?

On 9/28/06, *Jerry Yu* <user-764c1f364fe0@xymon.invalid <mailto:user-764c1f364fe0@xymon.invalid>>
wrote:

    hi,
    I have one single Hobbit server running 4.2RC1-20060712 on CentOS
    4. Clients have some harmless SELinux warning messages in
    /var/log/messages. I configured Hobbit to ignore such lines (conf
    entries appended).
    However, the LOG test still generates alerts. Below is excerpted
    from an email alert. Any idea why? I brought up before 4.2 final
    version is released, I believe, and was told it should not be the
    case.

    &yellow Sep 28 15:58:20 saturn su[4070]: Warning!  Could not
    relabel  with user_u:object_r:devpts_t, not relabeling.

    ---cut---x------ hobbit-clients.cfg -----x-------cut-----
    HOST=saturn
    log /var/log/messages %WARNING|NOTICE|ERROR COLOR=yellow
    IGNORE=relabeling
    ---cut---x------ clients-local.cfg -----x-------cut-----
    [saturn]
    log:/var/log/messages:10240
    ignore MARK

You can test :

log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"

and

ignore RELABELING

Cdl

Olivier

list Olivier Boyaval · Mon, 02 Oct 2006 13:42:41 +0200 ·

▸ quoted from Jerry Yu

Jerry Yu a écrit :

The 'hobbit-clients.cfg' man page give this example:
LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr

This is identical to mine except the actual log file name and strings.

I had the same problem with this synthax. I have resolved it by using 
this synthax :

log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"

-> no use of COLOR= keyword
-> use of quote (") on the ignore keyword and string.

Cdl

Olivier

list Jerry Yu · Mon, 2 Oct 2006 08:57:01 -0400 ·

I'll try it out. Thanks, Oliver. I initially didn't have color
specification. I had added color=yellow since, only to mimic the example in
the man page.

▸ quoted from Olivier Boyaval


On 10/2/06, Olivier Boyaval <user-f56ee5cec7be@xymon.invalid> wrote:

Jerry Yu a écrit :

The 'hobbit-clients.cfg' man page give this example:
LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr

This is identical to mine except the actual log file name and strings.

I had the same problem with this synthax. I have resolved it by using
this synthax :

log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"

-> no use of COLOR= keyword
-> use of quote (") on the ignore keyword and string.

Cdl

Olivier

list Jerry Yu · Mon, 2 Oct 2006 09:41:31 -0400 ·

I believe it worked! I faked a log entry with 'relabeling' and 'warning' in
there.

▸ quoted from Jerry Yu


On 10/2/06, Jerry Yu <user-764c1f364fe0@xymon.invalid> wrote:

I'll try it out. Thanks, Oliver. I initially didn't have color
specification. I had added color=yellow since, only to mimic the example in
the man page.

On 10/2/06, Olivier Boyaval <user-f56ee5cec7be@xymon.invalid> wrote:

Jerry Yu a écrit :

The 'hobbit-clients.cfg' man page give this example:
LOG /var/log/daemon.log %WARNING|NOTICE COLOR=yellow IGNORE=lpr

This is identical to mine except the actual log file name and strings.

I had the same problem with this synthax. I have resolved it by using
this synthax :

log /var/log/messages %WARNING|NOTICE|ERROR yellow "IGNORE=relabeling"

-> no use of COLOR= keyword
-> use of quote (") on the ignore keyword and string.

Cdl

Olivier

LOG test fails to IGNORE ? 🔗 link

LOG test fails to IGNORE ?