Can't you just set up iptables to drop the traffic so it never actually reaches the server? Something like
iptables -A INPUT -s 12.34.56.78 -p tcp --destination-port 1984 -j DROP
=G=
From: Xymon <xymon-bounces at xymon.com> on behalf of John Thurston <john.thurston at alaska.gov> Sent: Monday, November 2, 2015 7:59 PM To: xymon at xymon.com Subject: [Xymon] server-side message pre-processor?
Is there a mechanism through which I can dump certain host+test combinations to /dev/null ?
By way of example, let's hypothetically say I had a set of hosts whose owner steadfastly refused to clean up their data streams. They might be sending thousands of garbage test results to my server. The xymon server might be defined to not propagate the test results to the non-green screen, and there may be no alerts defined for the host+test combinations. But the xymon server is still passing thousands of garbage messages through its parsing, evaluating, graphing, and alerting handlers. Xymongen is still including these ignored messages in the list of "events received" at the bottom of the non-green page.
It would be cool if there were a way to create a flush-list for which: This host+test message combination will always be flushed. It will never get past the parsing handler. It won't be recorded. It wont be reported. It will not pass "go". It will not collect $200. It will just disappear.
Alternatively, the ability to prevent a host+test combination appearing on the "events received int the past x minutes" portion of the non-green page would be a big help. In the hypothetical situation outlined above, the thousands of messages from those hosts would push every other meaningful message off the bottom of that list of events.
-- Do things because you should, not just because you can.
John Thurston 907-465-8591 John.Thurston at alaska.gov Enterprise Technology Services Department of Administration State of Alaska
Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon