Thanks for the hint. I'm still having a little trouble getting it to do what I want, but at least no I know about pcretest, which I didn't before.

Thanks, Steve.

On 5/14/07, John G <jg2727 at gmail.com> wrote:

On 5/14/07, Steve Holmes <sholmes42 at mac.com> wrote:

...

I may still not be understanding how the pattern matching is done for the LOG keyword.

I have:

    LOG /var/adm/messages %(?-i)auth.error COLOR=yellow

IGNORE="%(?-i)sshd|flavor_basic: (null)"

Which I think should mean: look for the string "auth.error" in /var/adm/messages and then ignore lines with "sshd" OR "flavor_basic: (null)" in them.

If I *only* have IGNORE=sshd that seems to work, but I really need to ignore both (at least for my testing), but when I do it as above, I get yellow screens for auth.error lines even if they have the string "sshd" in them.

Am I missing something?

BTW, in BB I have a very long list of strings to ignore. Is there an easier way to do that in hobbit other than to put each string into an IGNORE clause?

Thanks, Steve Holmes

Try adding back slashes. IGNORE="%(?-i)sshd|flavor_basic: \(null\)"

$ pcretest PCRE version 6.7 04-Jul-2006

re> /(?-i)sshd|flavor_basic: (null)/ data> flavor_basic: (null) No match $ pcretest PCRE version 6.7 04-Jul-2006

re> /(?-i)sshd|flavor_basic: \(null\)/ data> flavor_basic: (null) 0: flavor_basic: (null) data> sshd 0: sshd

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

-- I believe I found the missing link between animal and civilized man. It is us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by the majority who participate. -Thomas Jefferson, third US president, architect and author (1743-1826)

I can only answer your second question, and that only with a theory. We used to get this in bb all the time as well as hobbit now. We only get it with custom scripts and we thought it might be tests that get added to the display because of an alert, but have no corresponding test listed in bb-hosts, so the bb/hobbit daemon doesn't generate a test for something it's not even keeping track of.

That would make sense to me, since you may not WANT it to do so in a custom script, but again it's only a theory. We haven't tested it. Just noticed patterns.

One of these days I'm going to get time and just dive into the code.

Tod Hansmann Network Engineer

-----Original Message----- From: Sean R. Clark [mailto:sclark at nyroc.rr.com] Sent: Monday, May 14, 2007 9:26 PM To: hobbit at hswn.dk Subject: [hobbit] two ack questions

First - what does a -1 mean for acktime,disabletime, and cookie mean when I run hobbitdboard?

I see that they(-1) are valid from the man page, but I can't seem to find what they mean...

Second - what would cause an alert to go out the hobbitdalert channel but not have a valid ack code?

I got this today:

Subject: Hobbit [0] hostname-swt09a-02.domain.com:if_stat CRITICAL (RED) (body) red Mon May 14 13:15:18 2007 results of test bleh bleh

Is that normal not to have an ackcode? And if not, how can I track down why it is ?

-Sean

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

On Mon, May 14, 2007 at 11:26:23PM -0400, Sean R. Clark wrote:

First - what does a -1 mean for acktime,disabletime, and cookie mean when I run hobbitdboard?

A green status cannot be ack'ed and doesn't have a cookie - so "acktime" and "cookie" are reported as "-1".

"disabletime" is set to -1 when the test is "disabled until OK".

Second - what would cause an alert to go out the hobbitdalert channel but not have a valid ack code?

When the status goes back to a non-critical state, hobbitd sends a recovery message on the "alert" channel, so the alerting module can send a "recovered" notice (if this has been configured).

Regards, Henrik

When the status goes back to a non-critical state, hobbitd sends a recovery message on the "alert" channel, so the alerting module can send a "recovered" notice (if this has been configured).

No I understand this part - I have it configured and working

But when I enabled the bbpage module in hobbitlaunch, I got a bunch of messages that said RED CRITICAL but the ACK code passed to it was 0

Subject: Hobbit [0] hostname-swt09a-02.domain.com:if_stat CRITICAL (RED) (body) red Mon May 14 13:15:18 2007 results of test bleh bleh

This wasn't a recovery - it was red when I started bbpage

It hasn't happened since yesterday, something with having the paging module DISABLED and then restarting hobbit? I dunno

More info on this crazy page bomb

Looking at notifications.log

grep hostname-swt09a-02.domain.com notifications.log | wc -l 664

All 664 here have the same timestamp

Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0 Wed May 16 10:57:17 2007 hostname-swt09a-02.domain.com:if_stat (0.0.0.0) whatever at com[819] 1179327437 0

So it's sending them, it's not something with the mailserver/mailqueue

It's happening about 2-3 times a day where it will send 300-700 alerts for 1 host

The infopage for this host/test combination shows:

Service Recipient 1st Delay Stop after Repeat Time of Day Colors if_stat whatever at com (U) - - 2h - red

The ack code send on the page is clearly 0, but the hobbitdboard lists a valid ack code

Any ideas where I go next? I can't have hobbit sending 300-700 alerts for a host/test combination

-----Original Message----- From: Sean R. Clark [mailto:sclark at nyroc.rr.com] Sent: Tuesday, May 15, 2007 12:54 PM To: hobbit at hswn.dk Subject: RE: [hobbit] two ack questions

When the status goes back to a non-critical state, hobbitd sends a recovery message on the "alert" channel, so the alerting module can send a "recovered" notice (if this has been configured).

No I understand this part - I have it configured and working

But when I enabled the bbpage module in hobbitlaunch, I got a bunch of messages that said RED CRITICAL but the ACK code passed to it was 0

Subject: Hobbit [0] hostname-swt09a-02.domain.com:if_stat CRITICAL (RED) (body) red Mon May 14 13:15:18 2007 results of test bleh bleh

This wasn't a recovery - it was red when I started bbpage

It hasn't happened since yesterday, something with having the paging module DISABLED and then restarting hobbit? I dunno

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk