No, this is an issue for me too. It would be better for me if the chunk that is processed were a set of lines instead of a set of bytes. I get parse errors from incomplete lines, too.
GLH
-----Original Message----- From: Kolbjørn Barmen [mailto:kolbjorn.barmen at uninett.no] Sent: Wednesday, August 23, 2006 1:05 PM To: hobbit at hswn.dk Subject: Re: [hobbit] a tiny logfile problem
I havent seen any respons on this.. am I the only one experiencing this as a problem? :)
On Mon, 21 Aug 2006, Kolbjørn Barmen wrote:
Due to the nature of the LOG entries in client-local.cfg I keep getting red dots evey now and then.
[linux] log:/var/log/messages:10240 ignore MARK
The number 10240 is the MAXDATA in bytes that will be cheked. The problem is that this results in uncomplete lines, and hence my IGNORE patterns does not always apply.
For instance, on certain machines I log named queries, however I want Hobbit to ignore query errors, so I have a this in hobbit-client.cfg "IGNORE=%(named.*query|floppy|interrupt)" which mostly works.
However, every now and then the msgs page for this host shows a "Full log" starting with
"med[1327]: client xxx.xxx.xxx.xxx#1057: query: www.errorsafe.com IN A"
where "med" is the end of "named" - this ofcourse sneaks past my IGNORE.
Would it be possible for the clients to not report on uncomplete lines?
I'm tempted to name this a bug, I'm just sorry I didnt catch this before 4.2.0 release, it's just that they pass along quite briefly.
-- Kolbjørn Barmen UNINETT Driftsenter
To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk