Probably should rename this thread as we are talking the xymon remote client here.
I did get log fetch to work with your script, sorta. I added the file in the script to collect and it collects it and posts it to the message column
Good.
This is with your xymon remote client.
but of course it is not processed for alerts, Just collected.
So it just needs an entry in analysis.cfg?
I might try it but doubt it will work right, as you explain below.
I added this to the xymonclient-linux.sh that I use for the hosts I use your script for. Hmmm If I get this other log fetch working I might be able to smash your script with this and make that work. Ok better stick to one thing at a time.
Always.
echo "[msgs:/var/log/messages]"
tail -c 10240 /var/log/messages | egrep -v MARK
echo "[msgs:/var/TKLC/log/syscheck/fail_log]"
tail -c 10240 /var/TKLC/log/syscheck/fail_log
Well this works, in as much as you'll get message lines in your client data, but you'll end up with repeated and skipped messages. So if you alert on the text "WARNING" and it appears in the log, sure you'll get an alert. But if the log gets less than 10k of data appended throughout the day, Xymon will repeat the alert all day. Or if, between one sample and the next, the "WARNING" message and then 10k of log data is added, the second sample won't see the matching message because it always gets the last 10k.
These issues are dealt with by the logfetch utility. It keeps state so that it (generally) gives out each log message line exactly once - none is missed and none is repeated.
You can handle this yourself, by keeping state of the size of the log file you're watching, and always tailing what's after that size. You also have to detect and handle log rotation. Doable, but lots of trouble. If you can get logfetch to work, then why not use it. Especially as it can give you your (its) config file from client-local.cfg to boot.
I remember a nice log utility we had in Big brother. I want to say message.sh and message2.sh or something like that. I remember a config file where you could create alert text triggers, it even took care of multi-line messages. It made sure it kept track of the lines processed. Sean are you lurking?
-Kevin