On Thu, 18 Oct 2012, Paul Sun wrote:
> Is there any other way?
not really.
You are telling SEC to ignore duplicates that happen within 60 seconds.
Without putting the hostname as part ot the desc field, the two lines are
duplicates in every way that you have told SEC to compare them.
For some situations, this can be exactly what you want to happen (for
example, looking for failed logins across a web cluster, you don't care
what server the various logs are from)
Remember that the desc field isn't anything that a person will ever see
(other than an admin looking at a dump), it's strictly something for SEC
to use to decide what items that match the patters should be kept separate
from each other.
so your desc line of:
desc=diameterBeClient$2 - NOTICE: {$3} Com: Open for application service via
peer '$4'. A connection to a peer has reached the \"Open\" state and is now
available for application usage
is really no better than
desc=connection open $2 $3 $4
David Lang
>
>
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]
> Sent: Thursday, October 18, 2012 3:06 PM
> To: Paul Sun
> Cc: [email protected]
> Subject: Re: [Simple-evcorr-users] Problem on configuration SEC to match the
> pattern
>
> On Thu, 18 Oct 2012, Paul Sun wrote:
>
>> Hi
>>
>> I am using the SEC to work with NAGIOS for matching the pattern of my log
>> messages.
>>
>> type=SingleWithSuppress
>> ptype=RegExp
>> pattern=(\S+) diameterBeClient(\S+) NOTICE: {(\S+)} Com: Open for
>> application service via peer '(\S+)'. A connection to a peer has
>> reached the \"Open\" state and is now available for application usage
>> desc=diameterBeClient$2 - NOTICE: {$3} Com: Open for application
>> service via peer '$4'. A connection to a peer has reached the \"Open\" state
>> and is now available for application usage action=shellcmd
>> /usr/local/nagios/libexec/eventhandlers/submit_check_result $1 snmp_traps
>> MAJOR "%s"
>> window=60
>>
>>
>> And the exact log messages is
>>
>> Thu Oct 18 2012 14:20:43 NCC-V01-mgmt diameterBeClient(11441) NOTICE:
>> {979320} Com: Open for application service via peer 'testing.com'. A
>> connection to a peer has reached the \"Open\" state and is now available for
>> application usage.
>> Thu Oct 18 2012 14:20:43 NCC-V02-mgmt diameterBeClient(11441) NOTICE:
>> {979320} Com: Open for application service via peer 'testing.com'. A
>> connection to a peer has reached the \"Open\" state and is now available for
>> application usage.
>>
>>
>> During my testing, I noticed that the first message from NCC-V01-mgmt can be
>> matched and the shell command is being triggered, however, the 2nd message
>> from NCC-V02-mgmt) didn't. Any idea on how I can configure the SEC in order
>> to match the above pattern for different host?
>
> add the hostname as part of your desc field. Without that all your logs are
> being treated as being the same.
>
> David Lang
>
------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_sfd2d_oct
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
