On Wed, February 3, 2016 3:59 am, Neil Simmonds wrote:
Hi, I have an issue with FILE monitoring. I can't seem to get it to alert correctly if the file exists.
This is the relevant line from my client-local.cfg,
file:
ls -l /applogs/mdmpim/dump/*.txt 2>/dev/nulland this is the relevant line from my analysis.cfg,
FILE "%/applogs/mdmpim/dump/*.txt" NOEXIST yellow
I've also tried,
FILE "%/applogs/mdmpim/dump/*.txt" yellow NOEXIST,
FILE "%/applogs/mdmpim/dump/*.txt" yellow noexist
and
FILE "%/applogs/mdmpim/dump/*.txt" yellow
None of them actually flag yellow!
All I get is
Files status at Wed Feb 3 11:57:36 GMT 2016
green -rw-rw-r-- 1 pimwas pimwas 254632 Jan 22 10:01 /applogs/mdmpim/dump/javacore.20160122.100109.30318.0006.txt
So it looks like it's recognising that the file is there but the colour change isn't happening.
Hi Neil,
I actually had a big long debug section here, until I noticed it:
This should just be:
file:
ls /applogs/mdmpim/dump/*.txt 2>/dev/null
logfetch is expecting a regular list of files there, and the "-l" option is confusing it.
After that, everything else should work. The first entry for analysis.cfg looks correct:
FILE "%/applogs/mdmpim/dump/*.txt" NOEXIST yellow
If it doesn't appear, try "%/applogs/mdmpim/dump/.*.txt", since I believe that's a PCRE regex used there, while logfetch uses POSIX regexes to reduce library dependencies on the client.
HTH, -jc