The configuring xymon to monitor a log file is a 2 step process. First, you need to tell the client which log file it needs to gather data from to send to the server. Then you need to tell the server how to read the data.
In your case, you will put an entry in client-local.cfg to be:
[linux] #or whatever operating system or host name this is for log:/home/user/log/Fail.log:10240
The above entry tell the client to gather the most recent 10240 bytes from Fail.log and send it to the xymon server. You will want to read the client-local.cfg man page to learn more about the option "trigger" and "ignore" tags as these can help you optimize the message with only relevant data from that log file.
Xymon then receives a big chuck of the log file. You now need to configure the server to read that data and analyze it. This is done in analysis.cfg. The LOG entry tells xymon how to do this.
In your case, you will put an entry in analysis.cfg to be:
LOG /home/user/log/Fail.log "Big Failure"
The above entry tells xymon to look through the client message it received that has data from the /home/user/log/Fail.log file then look to see if the string "Big Failure" in it. If it finds it, it will send a red alert to the "msgs" column.
You will also want to read the analysis.cfg man page as the LOG tag has more options.
Michael Beatty Sherwin-Williams IT Analyst/Developer michael.beatty at sherwin.com 216-515-7374
On 02/06/2013 06:06 PM, Nick Pettefar wrote:
Hi Paul,
Could you explain the last part: "Then you use msgs test not the log test." please? Do you mean do something with "msgs" in the alerts.cfg file? if so, what - could you give an example please?
Regards,
Nick Pettefar - Xymon Rookie
On 6 February 2013 20:35, Root, Paul <Paul.Root at centurylink.com> wrote:
Yes, You set the log files to look at in client-local.cfg (on the server) in the proper machine type area.
Then you edit the analysis.cfg file with the LOG command. Then you use msgs test not the log test.-----Original Message----- From: xymon-bounces at xymon.com [mailto:xymon-bounces at xymon.com] On Behalf Of Nick Pettefar Sent: Wednesday, February 06, 2013 11:56 AM To: xymon Subject: [Xymon] Alert on Log Entry
Hi, is it possible to configure the alerts.cfg file to send an e-mail if a server's particular log has a certain entry?
I have
HOST=server-abc-ge1 MAIL NOC at blah.com SERVICE=log COLOR=red
Can I put something like SERVICE=log:Fail.log="Big-Failure"
Regards,
Nick Pettefar - Xymon Rookie
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon