On 5/13/2015 10:43 AM, John Thurston wrote:
In testing 4.3.20, I've noticed that the 'msgs' column (for hosts running the xymon solaris client) contain lines from my logs even when they are reporting 'green'. I don't really want the contents of /var/adm/messages leaked to every viewer of my Xymon web interface.
In client-local.cfg, where your central mode clients get the config that tells them what should be monitored and sent, any lines in your logs that match an "ignore" line will NOT be sent from the client to the server. Just define log filters that filter out anything unimportant or sensitive:
Here's one stanza in my client-local.cfg file, monitoring a gluster host. I ignore all lines at INFO (the " I " filter) and certain error/warning lines that I do not want to even be sent from the client to xymon:
[slc01nas2.REDACTED.com] log:/var/log/glusterfs/etc-glusterfs-glusterd.vol.log:10240 ignore ( I ) log:/var/log/glusterfs/glustershd.log:10240 ignore ( I ) log:/var/log/glusterfs/nfs.log:10240 ignore xlator\/protocol\/client.so\(client_inodelk\+0x96\) \[0x7ffd96db3426\]\)\)\) 0-: Assertion failed: 0 ignore <gfid:00000000-0000-0000-0000-000000000000> failed .Invalid argument ignore ( I ) log:/var/log/messages:10240
Here's the corresponding entry in analysis.cfg that actually produces alarms:
HOST=%slc01(dfs|nas) LOG %gluster "%( E )" COLOR=red PROC glusterd 1 red PROC glusterfs 1 red MEMACT 99 100
Thanks, Shawn