Package: logcheck-database
Version: 1.2.69
Severity: wishlist
Tags: patch
hi,
please update the ignore rules for nagios:
nagios (at least nagios3) will write two lines for each passive
service check that it resives through nsca:
.... nagios3: EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;...
.... nagios3: PASSIVE SERVICE CHECK: ...
the first one is already ignored, but the last one triggers an email
every time logcheck runs if there were any passive service check results.
at least in my enviroment that makes it unusable because in my enviroment it
is normal that i recive serveral passive service results
(it would be more alarming if they are not there actually...)
so i wrote a simple rule to ignore them (see patch)
thx
albert
-- System Information:
Debian Release: 5.0.5
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
-- no debconf information
diff --git a/logcheck/ignore.d.server/nagios b/logcheck/ignore.d.server/nagios
index 9034c53..9a57d55 100644
--- a/logcheck/ignore.d.server/nagios
+++ b/logcheck/ignore.d.server/nagios
@@ -10,6 +10,7 @@
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: HOST DOWNTIME ALERT: [._[:alnum:]-]+;(STARTED|STOPPED);.*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: HOST EVENT HANDLER: [._[:alnum:]-]+;(UP|DOWN);(SOFT|HARD);[0-9]+;.*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;[._[:alnum:]-]+;[^;]+;[0-9]+;.*$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: PASSIVE SERVICE CHECK: [._[:alnum:]-]+;.*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: EXTERNAL COMMAND: (ENABLE|DISABLE)_(HOST_|HOST_SVC_|SVC_)?NOTIFICATIONS;[._[:alnum:]-]+(;[^;]+)?$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: EXTERNAL COMMAND: (ADD_SVC_COMMENT|ACKNOWLEDGE_SVC_PROBLEM);[._[:alnum:]-]+;[[:alnum:]]+;[0-9]+;([[:alnum:]]+;)?.*$
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ nagios(2|3)?: EXTERNAL COMMAND: SCHEDULE_HOST_DOWNTIME;[._[:alnum:]-]+;[0-9;]+;[[:alnum:]]+;.*$
