Charles, I had read the man page, honest. I read the following:

"logfilename" is the name of the logfile. Only logentries from this filename will be matched against this rule. Note that "logfilename" can be a regular expression (if prefixed with a '%' character).

to mean that %.* would match all logfilenames. Guest not, huh?

Thanks, I'll try that.

Steve.

On 5/9/07, Charles Jones <jonescr at cisco.com> wrote:

Your syntax is wrong. For logfile monitoring you must have the following in hobbit-clients.cfg: *LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

So, using one of your examples below, it should be:

LOG /var/adm/messages WARNING COLOR=yellow

If you need a reference just check the man pages, either on your Hobbit instance, or at: http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html

http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html

-Charles

Steve Holmes wrote:

Hi all,

I may not be understanding how the LOG match-pattern works.

In my hobbit-clients.cfg file I have under the DEFAULT section the following:

    LOG %.* NOTICE
    LOG %.* ERROR
    LOG %.* WARNING COLOR=yellow
    LOG %.* notice COLOR=yellow
    LOG %.* error COLOR=yellow
    LOG %.* daemon.error COLOR=yellow
    LOG %.* warning COLOR=yellow
    LOG %.* warn COLOR=yellow

At the moment on my hobbit server I have a green status for the host mentor and the following messages in /var/adm/messages:

[msgs:/var/adm/messages] <...SKIPPED...> purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1): May 9 11:07:36 mentor.ics.purdue.edu Error for Command: read(10) Error Level: Retryable May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Requested Block: 33383911 Error Block: 33383911 May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 0317A1JGAZ May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Sense Key: Media Error May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1): May 9 11:07:36 mentor.ics.purdue.edu Error for Command: write(10) Error Level: Retryable May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Requested Block: 33982299 Error Block: 33982299 May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 0317A1JGAZ May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Sense Key: Unit Attention

The above is copied from the hobbit display reached by clicking on the [/var/adm/messages] link on the msgs page for this host.

In the client-local.cfg I have:

[sunos] log:/var/adm/messages:10240

So why is the page green? There are at least 3 strings that should match to turn it yellow, right? And incidentally, the BB server I'm running on another host *does* show yellow. I'm trying to validate my hobbit configuration by making sure it matches the running BB server. And it doesn't for msgs, ever.

Thanks, Steve.

-- I believe I found the missing link between animal and civilized man. It is us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by the majority who participate. -Thomas Jefferson, third US president, architect and author (1743-1826)

Charles, thanks for your help. Just changing the filename regexp to a constant didn't work, but doing that *and* changing the matching string *to* a regexp did work. I have also found that the IGNORE string has to be a regexp to work. I'm pretty sure the manual pages will need to be updated.

Thanks, Steve.

On 5/9/07, Charles Jones <jonescr at cisco.com> wrote:

Hmm actually you are right about the regex, it *should* work. I'd try making it work without the regex first, if that works, then I would try putting quotes around the logfilename regex, ie LOG "%.*" WARNING COLOR=yellow

You aren't supposed to need the quotes, but I've had to use it for PROC regex entries in hobbit-clients.cfg before.

-Charles

Steve Holmes wrote:

Charles, I had read the man page, honest. I read the following:

"logfilename" is the name of the logfile. Only logentries from this filename will be matched against this rule. Note that "logfilename" can be a regular expression (if prefixed with a '%' character).

to mean that %.* would match all logfilenames. Guest not, huh?

Thanks, I'll try that.

Steve.

On 5/9/07, Charles Jones <jonescr at cisco.com> wrote:

...

Your syntax is wrong. For logfile monitoring you must have the following in hobbit-clients.cfg: *LOG logfilename pattern [COLOR=color] [IGNORE=excludepattern]*

So, using one of your examples below, it should be:

LOG /var/adm/messages WARNING COLOR=yellow

If you need a reference just check the man pages, either on your Hobbit instance, or at: http://www.hobbitmon.com/hobbit/help/manpages/man5/client-local.cfg.5.html

http://www.hobbitmon.com/hobbit/help/manpages/man5/hobbit-clients.cfg.5.html

-Charles

Steve Holmes wrote:

Hi all,

I may not be understanding how the LOG match-pattern works.

In my hobbit-clients.cfg file I have under the DEFAULT section the following:

    LOG %.* NOTICE
    LOG %.* ERROR
    LOG %.* WARNING COLOR=yellow
    LOG %.* notice COLOR=yellow
    LOG %.* error COLOR=yellow
    LOG %.* daemon.error COLOR=yellow
    LOG %.* warning COLOR=yellow
    LOG %.* warn COLOR=yellow

At the moment on my hobbit server I have a green status for the host mentor and the following messages in /var/adm/messages:

[msgs:/var/adm/messages] <...SKIPPED...> purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1): May 9 11:07:36 mentor.ics.purdue.edu Error for Command: read(10) Error Level: Retryable May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Requested Block: 33383911 Error Block: 33383911 May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 0317A1JGAZ May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Sense Key: Media Error May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] ASC: 0x11 (unrecovered read error), ASCQ: 0x0, FRU: 0xf May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.warning] WARNING: /pci at 9,600000/SUNW, qlc at 2/fp at 0,0/ssd at w21000004cffa6698,0 (ssd1): May 9 11:07:36 mentor.ics.purdue.edu Error for Command: write(10) Error Level: Retryable May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Requested Block: 33982299 Error Block: 33982299 May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Vendor: SEAGATE Serial Number: 0317A1JGAZ May 9 11:07:36 mentor.ics.purdue.edu scsi: [ID 107833 kern.notice] Sense Key: Unit Attention

The above is copied from the hobbit display reached by clicking on the [/var/adm/messages] link on the msgs page for this host.

In the client-local.cfg I have:

[sunos] log:/var/adm/messages:10240

So why is the page green? There are at least 3 strings that should match to turn it yellow, right? And incidentally, the BB server I'm running on another host *does* show yellow. I'm trying to validate my hobbit configuration by making sure it matches the running BB server. And it doesn't for msgs, ever.

Thanks, Steve.

-- I believe I found the missing link between animal and civilized man. It is us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by the majority who participate. -Thomas Jefferson, third US president, architect and author (1743-1826)

-- I believe I found the missing link between animal and civilized man. It is us. -Konrad Lorenz, ethologist, Nobel laureate (1903-1989)

We in America do not have government by the majority. We have government by the majority who participate. -Thomas Jefferson, third US president, architect and author (1743-1826)