August 2018 - Xymon - Xymon mailman web

monitoring contents of a logfile with a daily changing filename
by mburger＠bubbanfriends.org 16 Aug '18

16 Aug '18

Hello, Ian. Please note that it's only monitoring the most recent 10240 bytes of the logs in question. This means that unless the text you're looking for is in the last 10240 bytes of the log, it will not flag. On 2018-08-16 10:40, Ian Diddams via Xymon wrote: > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon -- Mike Burger http://www.bubbanfriends.org "It's always suicide-mission this, save-the-planet that. No one ever just stops by to say 'hi' anymore." --Colonel Jack O'Neill, SG1

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

Sorry Andy - I'm not with you? "Convert your rule in analysis.cfg from a glob to a regex :- LOG %/var/log/messages.*.log "DIDDS"| COLOR=yellow" The file name is messages-YYMMDD.log - what you have above seems to be mesages.<something>.log ? and the pipe ie "|" ? sorry to be so thick ! didds

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

well... Ive really no idea what is happenbing now! NOW the GUI page shows No entries in /var/log/messagesNo entries in /var/log/messages-20180816.log No entries in /var/log/maillog No entries in /var/log/secure Full log /var/log/messages Full log /var/log/messages-20180816.log <...CURRENT...>DIDDSFull log /var/log/maillog Full log /var/log/secure i.e. it IS showing the contents of messages-20180816.log. So 1) it knows about the correct log 2) it has the log files contents but 3) it is failing to note that it contains the trigger word. Summary: server side client-local.cfg : log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240server side analysis.cfg : LOG %/var/log/messages*.log "DIDDS" COLOR=yellow servier side must work because it worked for the sijmple test again /var/log/messages didds On Thursday, 16 August 2018, 15:49:07 BST, Ian Diddams <didds3 at yahoo.co.uk> wrote: further to the below... form the analysis.cfg man page: LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern] [OPTIONAL] ... "logfilename" is the name of the logfile. Only logentries from this filename will be matched against this rule. Note that "logfilename" can be a regular expression (if prefixed with a '%' character). as below the entry for the client in analysis.cfg on the server is LOG %/var/log/messages*.log "DIDDS" COLOR=yellow so IS prefixed by a % and the proof thyat this isn;t picking up the contents of the requisite log file is because the GUI page line Full log /var/log/messages-20180816.log does not have <...CURRENT...>DIDDS below it - as my test for plain /var/log/messages does. didds On Thursday, 16 August 2018, 15:40:44 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: Ok - another angle. I feel I am SO close. so I have a cleint with message logs with filename format /var/log/messages-YYYYMMDD.log It contains a trigger word DIDDS client-local.cfg on the xymon SERVER contains [linux]log:/var/log/messages:10240log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240log:/var/log/maillog:10240 log:/var/log/secure:10240ignore MARK The client's msgs GUI page shows No entries in /var/log/messagesNo entries in /var/log/messages-20180816.log No entries in /var/log/maillog No entries in /var/log/secure Full log /var/log/messagesFull log /var/log/messages-20180816.log Full log /var/log/maillog Full log /var/log/secure ie it can find/knows about that respective messages file. However... in analysis.cfg, for the respective client this line LOG %/var/log/messages*.log "DIDDS" COLOR=yellow doesn't flag anything - even if the string DIDDS is in that messages-20180816.log file .. hence the line in the GUI No entries in /var/log/messages-20180816.log SO CLOSE. what am I missing here? Because if I merely use LOG %/var/log/messages "DIDDS" COLOR=yellow with DIDDS within /var/log/messages it goes yellow almost immediately. ??? didds _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 16 Aug '18

16 Aug '18

further to the below... form the analysis.cfg man page: LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern] [OPTIONAL] ... "logfilename" is the name of the logfile. Only logentries from this filename will be matched against this rule. Note that "logfilename" can be a regular expression (if prefixed with a '%' character). as below the entry for the client in analysis.cfg on the server is LOG %/var/log/messages*.log "DIDDS" COLOR=yellow so IS prefixed by a % and the proof thyat this isn;t picking up the contents of the requisite log file is because the GUI page line Full log /var/log/messages-20180816.log does not have <...CURRENT...>DIDDS below it - as my test for plain /var/log/messages does. didds On Thursday, 16 August 2018, 15:40:44 BST, Ian Diddams via Xymon <xymon at xymon.com> wrote: Ok - another angle. I feel I am SO close. so I have a cleint with message logs with filename format /var/log/messages-YYYYMMDD.log It contains a trigger word DIDDS client-local.cfg on the xymon SERVER contains [linux]log:/var/log/messages:10240log:`find /var/log -maxdepth 1 -type f -name messages-\*.log`:10240log:/var/log/maillog:10240 log:/var/log/secure:10240ignore MARK The client's msgs GUI page shows No entries in /var/log/messagesNo entries in /var/log/messages-20180816.log No entries in /var/log/maillog No entries in /var/log/secure Full log /var/log/messagesFull log /var/log/messages-20180816.log Full log /var/log/maillog Full log /var/log/secure ie it can find/knows about that respective messages file. However... in analysis.cfg, for the respective client this line LOG %/var/log/messages*.log "DIDDS" COLOR=yellow doesn't flag anything - even if the string DIDDS is in that messages-20180816.log file .. hence the line in the GUI No entries in /var/log/messages-20180816.log SO CLOSE. what am I missing here? Because if I merely use LOG %/var/log/messages "DIDDS" COLOR=yellow with DIDDS within /var/log/messages it goes yellow almost immediately. ??? didds _______________________________________________ Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon

1 0

monitoring contents of a logfile with a daily changing filename
by damien＠makelofine.org 16 Aug '18

16 Aug '18

Hi Ian, My suggestion (not tested): -On your client, edit ~xymon/client/etc/client-local.cfg file -In your host definition, add a this line: log:/var/log/external/$REPLACE_WITH_CLIENT_NAME/messages-$(date +%Y%m%d).log -If previous does not work, this one should do the job log:$(find /var/log/external/$REPLACE_WITH_CLIENT_NAME/ -name messages-$(date +%Y%m%d).log) Regards, Damien Martins Le 15/08/2018 à 16:37, Ian Diddams via Xymon a écrit : > _______________________________________________ > Xymon mailing list > Xymon at xymon.com > http://lists.xymon.com/mailman/listinfo/xymon >

2 1

monitoring contents of a logfile with a daily changing filename
by didds3＠yahoo.co.uk 15 Aug '18

15 Aug '18

xymon 4.3.17 / 4.3.28 / 4.3.15 / 4.3.12 / (multiple servers) centos 6 & 7 For a client Ive been asked to set up a reasonably simple LOG file check in their various xymon installations. Each client to be checked has daily changing messages filenames (via rsyslog.conf). The filename for today is for example /var/log/external/<client hostname>/messages-20180815.log i.e. it is always in /var/log/external/<client hostname>/ with the formaltted filename of messages-<YYYYMMDD>.log so presumably via the xymon server's analysis.cfg and client-local.cfg I have to be able to tell xymon server to use the logfile with naming convention of /var/log/external/<client hostname>/messages-<YYYYMMDD>.log any ideas how to manage thiis? the only other way I can think to do it is to have a cron that automagically resets a softlink of eg /var/log/messages to the daily log, run at midnight on every client - but that's just another level of cludginess.that requires some overseeing to ensure every client "works". This really needs to be done centrally. Summary: logfile paths have two quasi-random elements - the client hostname in the path, and the date in the logfile name didds

1 0

monitoring ssl over different port
by enzo＠arroyof.com 13 Aug '18

13 Aug '18

Hello everybody, Is possible monitoring the SSL certificate of a host that run https over different port than 443? Thank you, best regards.

2 2

skip http check
by enzo＠arroyof.com 13 Aug '18

13 Aug '18

Hello all, Have a little issue, look, have a host list that my intention is just monitor the SSL expire, this is my file: 0.0.0.0 server.lan # noconn https://server.lan 0.0.0.0 server1.lan # noconn https://server1.lan But this create 2 checks, http and sslcert, I need just sslcert, I fix it temporary using NOCOLUMNS:http, but this just hidden the col, how can I do for skip this check and check just the sslcert? Thank you, best regards,

3 2

Client rpm - systemctl enable error
by john.horne＠plymouth.ac.uk 09 Aug '18

09 Aug '18

Hello, I installed the Terabithia xymon-client (version 4.3.28) rpm onto a test server (running CentOS 7). No problems with that, or running it. However, as we usually do, once a service has been installed we enable it to start at boot time using 'systemctl'. This gave an error: ===== # systemctl enable xymon-client Failed to execute operation: Too many levels of symbolic links ===== As far as I can tell the xymon-client package is installed 'enabled' by default, but even so re-enabling it should not give an error. John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 1

Ubuntu 18.04 libs test from hobbit-plugins
by r.oliver＠web.de 08 Aug '18

08 Aug '18

Dear all, I'm running xymon client 4.3.28 from ubuntu 18.04 repositories and I've installed the package hobbit-plugins, which provides additional features. One of it is called libs, which prints processes with libraries linked to already upgraded ones. Usually this means that the process or the whole computer should be restarted, so that the new libraries will be used. Unfortunately this seems not to be the case for the following three processes: /usr/bin/gnome-shell /usr/bin/pulseaudio /usr/lib/gnome-settings-daemon/gsd-media-keys I' struggling diving into the code of the libs-script (writte in perl). Can someone help me finding the root cause of this problem? In xymonclient.log I can see many lines with "dpkg: no packages found matching *:i386". I think this might be related somehow. Thank you in advance! Regards Oliver

1 0