On Wed, Jul 21, 2010 at 2:11 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
On Wed, Jul 21, 2010 at 12:56 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
On Tue, Jul 20, 2010 at 4:06 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
On Fri, Jul 2, 2010 at 12:45 PM, Asif Iqbal <vadud3 at gmail.com> wrote:
On Fri, Jul 2, 2010 at 12:38 PM, Clark, Sean <sean.clark at twcable.com> wrote:
Acknowledge.log in the logs directory
Hi Sean,
That is not really what I am asking for. That is only the log if someone acknowledges it.
It is really the alert code that we may or may not ack. Since alerts gets logged in notifications.log file. So would be a logical place to have the alert code in there as well, even if we never ACK it
so looks like I just need to modify the hobbitd/do_alert.c line 148 to 150 to add the cookie if I want it the alert code to show up in notifications.log file. Is there any other places I need to make change as well?
137 if ((alert->color >= 0) && (alert->color < COL_COUNT)) sev = sevtxt[alert->color]; 138 139 switch (alert->state) { 140 case A_PAGING: 141 case A_ACKED: 142 subjfmt = (include_configid ? "Hobbit [%d] %s:%s %s [cfid:%d]" : "Hobbit [%d] %s:%s %s"); 143 snprintf(subj, sizeof(subj)-1, subjfmt, 144 alert->cookie, alert->hostname, alert->testname, sev, recip->cfid); 145 break; 146 147 case A_NOTIFY: 148 subjfmt = (include_configid ? "Hobbit %s:%s NOTICE [cfid:%d]" : "Hobbit %s:%s NOTICE"); 149 snprintf(subj, sizeof(subj)-1, subjfmt, 150 alert->hostname, alert->testname, recip->cfid); 151 break; 152 153 case A_RECOVERED: 154 subjfmt = (include_configid ? "Hobbit %s:%s recovered [cfid:%d]" : "Hobbit %s:%s recovered"); 155 snprintf(subj, sizeof(subj)-1, subjfmt, 156 alert->hostname, alert->testname, recip->cfid); 157 break; 158 159 case A_NORECIP: 160 case A_DEAD: 161 /* Cannot happen */ 162 break; 163 }
I am still playing with the ackcode/alertcode to put into notifications.log. Looks like I actually have to modify the code here
387 if (logfd) { 388 init_timestamp(); 389 fprintf(logfd, "%s %s.%s (%s) %s[%d] %ld %d", 390 timestamp, alert->hostname, alert->testname, 391 alert->ip, recip->recipient, recip->cfid, 392 (long)now, servicecode(alert->testname)); 393 if (alert->state == A_RECOVERED) { 394 fprintf(logfd, " %ld\n", (long)(now - alert->eventstart)); 395 } 396 else { 397 fprintf(logfd, "\n"); 398 } 399 fflush(logfd); 400 }
I have to add alert->cookie in there. Will confirm it that works
ok so I applied this patch.
--- hobbitd/do_alert.c.orig 2010-07-21 13:36:07.000000000 -0400 +++ hobbitd/do_alert.c 2010-07-21 13:36:32.000000000 -0400 @@ -414,8 +414,8 @@ pclose(mailpipe); if (logfd) { init_timestamp(); - fprintf(logfd, "%s %s.%s (%s) %s[%d] %ld %d", - timestamp, alert->hostname, alert->testname, + fprintf(logfd, "%s %d %s.%s (%s) %s[%d] %ld %d", + timestamp, alert->cookie, alert->hostname, alert->testname, alert->ip, recip->recipient, recip->cfid, (long)now, servicecode(alert->testname)); if (alert->state == A_RECOVERED) {
Then make clean; make; make install . But I still do not see the ackcode/alertcode in the notifications.log file.
Any suggestion?
ok, the patch worked. I had to restart hobbitd_alert, doh! Here is the patch as an attachment, if anyone is interested. It puts the same alertcode, that you receive in the subject of your hobbit alert, into the notifications log as well. we feed this log to splunk and it helps with our stat on total number of unique alerts per day -- Asif Iqbal PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?
participants (1)
-
vadud3＠gmail.com