In <09DBBCE3-BD10-4846-B8FE-776FB811EC93 at skurfer.com> Rob McBroom <mailinglist0 at skurfer.com> writes:
I want to check a file for a certain pattern, so the LOG check seemed = like the natural choice. I got it configured and started to see some red = statuses come in for hosts where the pattern matched, but then about 35 = minutes later, they all go green though nothing has changed on the = client.
Yep, that is how the logfile checking is designed. Only logentries made in the past 30 minutes are included in each scan (except when starting from scratch - that's why you saw the entries in the beginning, and then they disappeared after half an hour).
So is there a way to check something like a config file for invalid = patterns? Do I need to write a custom script? Writing and distributing a = custom test is not a big deal to me at all. What I dread is adding yet = another column to the web view, which is why I was looking for a = built-in test to use.
You could 'hack' it by removing that entry from the client's status file in ~xymonclient/tmp/logfetch.HOSTNAME.status (a "grep -v" works since it's a text file). Then it would always scan the entire file.
I have a better idea for how to do this: The client today can do a "linecount" report where it counts the number of lines matching a regex pattern in a file. But on the server side this is only used for a "data" message that can be used to track the size of a file in a graph - it doesn't generate any status, or affect the color of the "msgs" or "files" status. It would be fairly simple to be able to define a rule in hobbit-clients.cfg so the "files" status went red if the linecount exceeded some threshold - "1" in your case. But that needs some new code in the client-handler on the Xymon server.
Regards, Henrik