Ken,

My *guess* is that "no entries in <log file>" means that no entries were matched using your rules. If you have no rules (no LOG definitions) then nothing will match. Just below you should see a link to the full log file, and it should contain about 30 minutes of data in it.

This is a bit tricky to set up since you cannot set it up in one place. If I remember it correctly, you have to do this:

1. on each server that you want to enable the msg function, do whatever it takes to enable the Hobbit client to read each log file that you want to watch.

2. on the Hobbit server, you need to enable the client to monitor each log file. You do this in the client-local.cfg file. This file can be tricky because it is set up to let you assign actions to "classes", but I find it easier to configure each host one by one, even if it means some copy-paste.

3. on the Hobbit server, you need to define alerts for log file messages. You do this in the hobbit-clients.cfg file, using the LOG directive. Once again, I create a group for each host. What you are doing is telling Xymon that host--logfile--stringmatch = color.

4. on the Hobbit server, you need to define alert notification rules (if you want them) for the host, or the test (msg), or the color. Note that ANY match in a 30 minute slice of a log file will trigger a color change, and that the overall color will match the most severe match (e.g. one red trumps 20 yellows, etc.).

It takes a couple of poll cycles before the Hobbit client will pick up any changes that you make in the client-local.cfg file.

Setting up the LOG alerts requires some fiddling -- it is good to study the man page for the file, and to pick a single host that you can use for experimentation.

You might search the archive -- particulary for any messages from Henrik about this feature, since he has had to set us all straight a few times. Many people have had trouble creating PCRE expressions that would do what they wanted.

Good luck!

GLH

-----Original Message----- From: ken.schweiker at faa.gov [mailto:ken.schweiker at faa.gov] Sent: Friday, March 06, 2009 9:46 AM To: hobbit at hswn.dk Subject: RE: [hobbit] Limited amount of log data

Thanks for the reply. I did read it. Took me all over trying to find that little gem. Is there a Hobbit for Dummies book yet? But, without going through all that again where can I find the settings to change this? Also, about the screen shot below about no log entries in var/log/messages. Is that normal? Will that go away if I filter log messages? Thanks again.

         "Hubbard, Greg L"

         <greg.hubbard at eds

         .com>

To <hobbit at hswn.dk>

         03/05/2009 05:36

cc PM

Subject RE: [hobbit] Limited amount of log
Please respond to data

          hobbit at hswn.dk

The design of the log watching system is to scan a subset of a log for "bad" things and update the status dot. If it did not have a rolling "time window" then the status dot would never change after something ugly got put in the log file. And then the process of reading the log file (and pumping it to the server) would get slower and slower as the log file grows. This feature is not designed for log management, but for helping you watch for things that might appear in the logs on each host that might require your attention.

You might want to read the documentation -- you have to configure the rules that define what "bad" means.

GLH

-----Original Message----- From: ken.schweiker at faa.gov [mailto:ken.schweiker at faa.gov] Sent: Thursday, March 05, 2009 4:07 PM To: hobbit at hswn.dk Subject: [hobbit] Limited amount of log data

Hi, Trying to set up xymon to capture log data. Once I changed the permission on the var/log/message file, I got -some- data. I am taking the defaults with xymon 4.2.3. I might appear that I only get to see the last 30 minutes of log data. Can this be increased?

Second, why does it say No entries in /var/log/messages. Thanks. System logs at Thu Mar 5 17:03:20 EST 2009

No entries in /var/log/messages

Full log /var/log/messages Mar 5 16:56:00 tcdcpega syslog-ng[1494]: STATS: dropped 0

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk

To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk