Due to the nature of the LOG entries in client-local.cfg I keep getting red dots evey now and then.
[linux] log:/var/log/messages:10240 ignore MARK
The number 10240 is the MAXDATA in bytes that will be cheked. The problem is that this results in uncomplete lines, and hence my IGNORE patterns does not always apply.
For instance, on certain machines I log named queries, however I want Hobbit to ignore query errors, so I have a this in hobbit-client.cfg "IGNORE=%(named.*query|floppy|interrupt)" which mostly works.
However, every now and then the msgs page for this host shows a "Full log" starting with
"med[1327]: client xxx.xxx.xxx.xxx#1057: query: www.errorsafe.com IN A"
where "med" is the end of "named" - this ofcourse sneaks past my IGNORE.
Would it be possible for the clients to not report on uncomplete lines?
I'm tempted to name this a bug, I'm just sorry I didnt catch this before 4.2.0 release, it's just that they pass along quite briefly.
Btw.. funny host and domain names with "error" and "warn" and "critical".. :)
-- Kolbjørn Barmen UNINETT Driftsenter