Hi folks,
I'm running collectd 4.9.2.
I'm tailing a log file, looking for a number. My tail config looks like this:
LoadPlugin tail
<Plugin tail>
<File "/opt/splunk/var/log/splunk/scheduler.log">
Instance "splunk-scheduler-log"
<Match>
Regex "monitor_lighty_hosts__splunkalerts.*result_count=(\d+)"
DSType "CounterSet"
Type "counter"
Instance "lighty_hostcount"
</Match>
</File>
</Plugin>
The log file in question contains a lot of entries, but the ones I'm looking
for look like this:
04-25-2010 18:35:14.087 INFO SavedSplunker -
savedsearch_id="nobody;FooSearch;monitor_lighty_hosts__splunkalerts",
user="nobody", app="FooSearch",
savedsearch_name="monitor_lighty_hosts__splunkalerts", status=success,
scheduled_time=1272220500, dispatch_time=1272220504, run_time=8.064,
result_count=31, alert_actions="",
sid="scheduler__nobody__FooSearch_bW9uaXRvcl9saWdodHlfaG9zdHNfX3NwbHVua2FsZXJ0cw_at_1272220500_317731676",
thread_id="AlertNotifierWorker-0"
Every flavor of regular expression I've tried for picking out the result_count
seems to be failing. Variants I've tried, all of which work outside of
collectd, are:
monitor_lighty_hosts__splunkalerts.*result_count=(\d+)
monitor_lighty_hosts__splunkalerts.+result_count=([0-9]+)
monitor_lighty_hosts__splunkalerts.+result_count.([0-9][0-9])
monitor_lighty_hosts__splunkalerts.*result_count.([^,]+),
My threshold for alerts block is set up like this:
<Threshold>
<Plugin "tail">
<Type "counter">
Instance "lighty_hostcount"
WarningMin 31
</Type>
</Plugin>
</Threshold>
I want to get an email when the result_count of the log in question drops below
31. Based on my understanding, this should be working as configured above.
However, I'm getting emails stating:
Message: Host i-ad3d7cc5, plugin tail (instance splunk-scheduler-log) type
counter (instance lighty_hostcount): Data source "value" is currently 0.000000.
That is below the warning threshold of 31.000000.
Why aren't any of my regex flavors matching? I've tested out many different
variants against this log file, and can get '31' as the first subexpression
match every time. Is there something about the regex flavor that <Match> uses
within Tail that I don't understand?
Thanks in advance!
Regards,
Clay
--
Clay Loveless
Founder
w: http://killersoft.com
t: @claylo
_______________________________________________
collectd mailing list
[email protected]
http://mailman.verplant.org/listinfo/collectd
