> From: uwe.ri...@ruv.de <uwe.ri...@ruv.de>
> Subject: [Simple-evcorr-users] SEC for use with monitoring
> To: simple-evcorr-users@lists.sourceforge.net
> Date: Thursday, June 4, 2009, 5:41 PM
> Hello,
>
> I am trying to use sec.pl to handle the monitoring
>
> -run the monitoring script every minute, but not at startup
> of sec
> Working: this is done in rule 1 and
> 2 ( thanks to Risto )
>
> -if the output of the monitoring script does not contain
> the string "OK"
> Send an alert with
> /opt/local/eventscripts/%{mon}.event 0 '$0'
> -if the monitoring script is called again after 1
> min containing no "OK", don't send another alert
>
> -if the output of the monitoring script contains the string
> "OK"
> Send a clearing alert with
> /opt/local/eventscripts/%{mon}.event 1 '$0'
> -if the monitoring script is called again after 1
> min containing "OK", don't send another clearing alert
In my opinion, it's best to address this issue with the Pair rule -- it was
designed exactly for the case you have described. Also, you can't use %<alnum>
variables outside action lists (e.g., in 'context' field of the rule
definition). However, with the Pair rule you don't have to set up the contexts
for duplicate error/OK message suppression anyway.
hth,
risto
>
> I tried the following code in monitor.conf:
>
> type=Single
> ptype=SubStr
> pattern=SEC_STARTUP
> context=SEC_INTERNAL_EVENT
> desc=create a context for indicating that application
> startup takes 60 seconds
> action=create APPLICATION_STARTUP_IN_PROGRESS 60
>
> # call monitorscript
> type=Calendar
> time=* * * * *
> context=!APPLICATION_STARTUP_IN_PROGRESS
> desc=TESTMON
> action=assign %mon %s;spawn
> /opt/local/eventscripts/TESTMON.cmd
>
> # send event
> type=Single
> continue=goto common_rules
> ptype=regexp
> pattern=.*?[^OK]
> context=[!SENT_%{mon}]
> desc=$0
> action=shellcmd /opt/local/eventscripts/%{mon}.event 0
> '$0';create SENT_%{mon}
>
> # send clearing event
> type=Single
> continue=goto common_rules
> ptype=regexp
> pattern=(OK)
> desc=$0
> action=shellcmd /opt/local/eventscripts/%{mon}.event 1
> '$0'
>
> # entry point for common rules
> label=common_rules
>
> running: /home/xv18202/sec/sec.pl
> -conf=/home/xv18202/sec/monitor.conf
> -input=/home/xv18202/sec/emptyfile -log
> /home/xv18202/tmp/sec.log
>
> gives an output:
>
> SEC (Simple Event Correlator) 2.5.1
> Reading configuration from /home/xv18202/sec/monitor.conf
> Rule in /home/xv18202/sec/monitor.conf at line 16: Warning
> - could not find '/opt/local/eventscripts/%{mon}.event'
> 4 rules loaded from /home/xv18202/sec/monitor.conf
> Stdin connected to terminal, SIGINT can't be used for
> changing the logging level
> Assigning 'TESTMON' to variable '%mon'
> Spawning shell command
> '/opt/local/eventscripts/TESTMON.cmd'
> Child 372874 created for command
> '/opt/local/eventscripts/TESTMON.cmd'
> Creating event 'Int32=0 String="Es ist keine Instanz des
> Prozesses gestartet."' (received from child 372874)
> Executing shell command
> '/opt/local/eventscripts/TESTMON.event 0 'Int32=0 String="Es
> ist keine Instanz des Prozesses gestartet."''
> Child 372876 created for command
> '/opt/local/eventscripts/TESTMON.event 0 'Int32=0 String="Es
> ist keine Instanz des Prozesses gestartet."''
> Creating context 'SENT_TESTMON'
> Assigning 'TESTMON' to variable '%mon'
> Spawning shell command
> '/opt/local/eventscripts/TESTMON.cmd'
> Child 495846 created for command
> '/opt/local/eventscripts/TESTMON.cmd'
> Creating event 'Int32=0 String="Es ist keine Instanz des
> Prozesses gestartet."' (received from child 495846)
> Executing shell command
> '/opt/local/eventscripts/TESTMON.event 0 'Int32=0 String="Es
> ist keine Instanz des Prozesses gestartet."''
> Child 495848 created for command
> '/opt/local/eventscripts/TESTMON.event 0 'Int32=0 String="Es
> ist keine Instanz des Prozesses gestartet."''
>
>
> It looks to me that %mon does not have the value "TESTMON"
> in rules.3 and 4.
>
> Is there a solution to that?
>
>
> Best regards
>
> Dr. Uwe Rieke
> R+V Allgemeine Versicherung AG
> John-F.-Kennedy Str. 1
> 65189 Wiesbaden
>
> Tel.: 0611 533 2515
> Fax: 0611 533 77 2515
> E-Mail: uwe.ri...@ruv.de
> <mailto:alfred.musterm...@ruv.de>
>
> Internet: www.ruv.de
>
> R+V Allgemeine Versicherung AG, Taunusstraße 1, 65193
> Wiesbaden
> Vorsitzender des Aufsichtsrates: Generaldirektor Dr.
> Friedrich Caspers, Vorstand: Bernhard Meyer, Vorsitzender,
> Hans-Christian Marschler, Rainer Neumann, Rainer Sauerwein,
> Hans-Dieter Schnorrenberg, Peter Weiler.
> Sitz: Wiesbaden, Handelsregister Nr.: HRB 2188, Amtsgericht
> Wiesbaden, USt-Id. Nr.: DE 811198334
>
>
>
> ------------------------------------------------------------------------------
> OpenSolaris 2009.06 is a cutting edge operating system for
> enterprises
> looking to deploy the next generation of Solaris that
> includes the latest
> innovations from Sun and the OpenSource community. Download
> a copy and
> enjoy capabilities such as Networking, Storage and
> Virtualization.
> Go to: http://p.sf.net/sfu/opensolaris-get
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensing option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
