In <84AE996EE1457F4DB43A05348E32C33F080E2F at ac-hq-exch.corp.americashloans.net> "Rafal Roginela" <Rafal.Roginela at AmeriCashLoans.net> writes:
I have a PIX that sends syslog to my hobbit server I also have cron job that runs a script that analyses that log file and gives me a nice looking results that are piped out to a text file:
196 MB XX.XX.XX.XX 100 MB XX.XX.XX.XX 18 MB XX.XX.XX.XX 12 MB XX.XX.XX.XX 7 MB XX.XX.XX.XX 6 MB XX.XX.XX.XX 4 MB XX.XX.XX.XX 2 MB XX.XX.XX.XX Ran at Fri Dec 19 11:40:36 2008
What I would like to do is generate a custom test that would be able to, at the very least, display this output so I can easily look at it by clicking on the green dot for this custom test.
That's easy. This script will do it, just add a section to hobbitlaunch.cfg to run this every 5 minutes or so.
#!/bin/sh
PIXLOGFILE=/var/log/pixlog.txt PIXHOSTNAME=pix.foo.com PIXCOLUMNNAME=talkers
$BB $BBDISP "status $PIXHOSTNAME.$PIXCOLUMNNAME green date
cat $PIXLOGFILE
"
exit 0
Modify the PIXLOGFILE / PIXHOSTNAME / PIXCOLUMNNAME to suit your setup.
But it would be cool if I could graph it
That's a bit more tricky. I guess those "XX.XX.XX.XX" are IP's ? And if they are IP-adresses of remote hosts talking to your site, then perhaps they change a lot ? In that case graphing it is pretty un-interesting, because one IP will not show up for very long in your data.
On the other hand, if your PIX only gets traffic from a limited number of IP's, then it would make sense to create an RRD (graph database file) for each IP. It would probably be easier if your output would list the IP first and then the MB-value; then you could use the SPLITNCV handler that is built into Xymon 4.2.2 to parse the data and generate the RRD files. See the hobbitd_rrd man-page and "Custom graphs" section in the on-line help on your Hobbit server.
PS If anyone has ever ran into this also: My pix is sysloging to the hobbit box good; I even have it going to a separate file for easy sorting but I'm finding that it clogs up my messages file with duplicate entries no mater which facility I try (right now I have used local4 through local6 changing the appropriate commands in the pix).
See your syslog.conf man-page. It depends on the exact flavor of syslogd your system has, but on my Linux box one can filter out certain facility.priority items from a logfile by using the "!" operator, or by specifying "none" as the priority. So on your "messages" syslog.conf entry, adding "log4,log5,log6.none" to the set of selectors should weed out your PIX logs from going to the messages file.
Regards, Henrik