Alerting on number of times a keyword appers in a logfile?
After searching the Hobbit mailing list, I believe the answer to this question is "no". All I found is mention of how Henrik first created the linecount functionality (http://www.hswn.dk/hobbiton/2006/06/msg00084.html).
So it looks like I will have to implement this myself. I'm thinking this would be easiest to do as a *server* side ext script, rather than client, since I am using the linecount option, the hobbit client is already sending the number of times the keyword appears in the /client data/. Here's a snippet of my client data message for a particular host:
[linecount:/apps/apache/logs/access_main_log] SessionTimeouts: 1683
*So I guess my question is now, how can I access client data for a host from a server side ext script?* I tried doing a recursive grep for "Session" in the data and tmp directories, and found nothing?
-Charles
Charles Jones wrote:
Is this possible without an ext script?
-Charles
Use CLIENT side. Much easier. Don't try to leverage what the client is already doing.
From: Charles Jones [mailto:jonescr at cisco.com]
Sent: Monday, December 11, 2006 1:09 PM
To: hobbit at hswn.dk
Subject: [hobbit] Accessing "client data" from a server side extscript? (Re: [hobbit] Alerting on number of times a keyword appers in a logfile?)
After searching the Hobbit mailing list, I believe the answer tothis question is "no". All I found is mention of how Henrik first created the linecount functionality (http://www.hswn.dk/hobbiton/2006/06/msg00084.html).
So it looks like I will have to implement this myself. I'mthinking this would be easiest to do as a server side ext script, rather than client, since I am using the linecount option, the hobbit client is already sending the number of times the keyword appears in the client data. Here's a snippet of my client data message for a particular host:
[linecount:/apps/apache/logs/access_main_log]
SessionTimeouts: 1683
So I guess my question is now, how can I access client data fora host from a server side ext script? I tried doing a recursive grep for "Session" in the data and tmp directories, and found nothing?
-Charles
Charles Jones wrote:
Is this possible without an ext script?
-Charles
Writing client-side scripts is difficult in my environment because I have dozens of servers whose hobbit directories are on a shared SAN, so for any client-side script that needs to only run on a few hosts, I have to put checks in to make sure that $HOSTNAME is equal to the hosts I want it to run on. Also, the builtin linecount function is already sending the counts for the keywords to the hobbit server, so why run another process on the client to do the same thing when the server already has the data.
Since my last email I have figured out how to access the client data from the server. In my case this is:
./bb 127.0.0.1 "clientlog prod-web-12 section=linecount:/apps/apache/logs/access_main_log" Which returns: [linecount:/apps/apache/logs/access_main_log] SessionTimeouts: 1756
So now I can make a server side ext script which processes the latest
linecounts and sends alerts if they exceed a certain threshold.
Hopefully Henrik will add a more graceful solution for this in a future
version of Hobbit.
-Charles
Hubbard, Greg L wrote:
Use CLIENT side. Much easier. Don't try to leverage what the client is already doing.
------------------------------------------------------------------------ *From:* Charles Jones [mailto:jonescr at cisco.com] *Sent:* Monday, December 11, 2006 1:09 PM *To:* hobbit at hswn.dk *Subject:* [hobbit] Accessing "client data" from a server side ext script? (Re: [hobbit] Alerting on number of times a keyword appers in a logfile?) After searching the Hobbit mailing list, I believe the answer to this question is "no". All I found is mention of how Henrik first created the linecount functionality (http://www.hswn.dk/hobbiton/2006/06/msg00084.html). So it looks like I will have to implement this myself. I'm thinking this would be easiest to do as a *server* side ext script, rather than client, since I am using the linecount option, the hobbit client is already sending the number of times the keyword appears in the /client data/. Here's a snippet of my client data message for a particular host: [linecount:/apps/apache/logs/access_main_log] SessionTimeouts: 1683 *So I guess my question is now, how can I access client data for a host from a server side ext script?* I tried doing a recursive grep for "Session" in the data and tmp directories, and found nothing? -Charles Charles Jones wrote:Is this possible without an ext script? -Charles
Charles Jones wrote :
*So I guess my question is now, how can I access client data for a host from a server side ext script?* I tried doing a recursive grep for "Session" in the data and tmp directories, and found nothing?
Try with :
bb 127.0.0.1 "hobbitdboard host=youclientname test=msgs fields=msg"
you then get the status message. You can now send another status message (under another column name).
-- Charles Goyard - cgoyard at cvf.fr - (+33) 1 45 38 01 31
On Mon, Dec 11, 2006 at 12:08:55PM -0700, Charles Jones wrote:
*So I guess my question is now, how can I access client data for a host from a server side ext script?*
bb 127.0.0.1 "clientlog MYHOST section=logfile:/var/log/messages"
The "section" is optional; if omitted, you'll get the entire client message.
It's in the bb(1) man-page ...
Regards, Henrik
participants (4)
-
cgoyard＠cvf.fr
-
greg.hubbard＠eds.com
-
henrik＠hswn.dk
-
jonescr＠cisco.com