In message <[email protected]>,
Honia A writes:
>No, I am running SEC in regular mode (-nodetach) and yes, i'm using SEC log
>as well which just shows the rule was found and the send-event.pl command wa
>s executed successfully... Here's an update:
>
>
>
>I replaced the pattern in my.conf with a much more simpler one:
>
>my.conf
>
># Example my.conf
># Recognize a pattern and execute send-event.pl
>type=Single
>ptype=RegExp
>pattern=foobar
>desc=$0
>action=shellcmd ./honia.sh
>
>honia.sh
>
>#!/bin/sh
>
># Shell command for sending events to OpenNMS via send-event.pl
>
>#
>./send-event.pl uei.mycompany.net/generic/collectd/inconsistentconfig -i
>192.168.1.1
>
>Now, when I run SEC, if I leave the input as input=- and type the word foobar
>at the runtime, it workes and the send-event would be called and will send
>the event to ONMS successfully. (See output 1)
>
>
>But if I save the word foobar into a file and name it monitor.me or something
>else, SEC will not match anything and therefore send-event will not be called
>(See output 1). Here are the outputs I get for each cases:
Are you sending the word foobar to monitor.me before or after you
start SEC.
By default SEC starts reading at the end of file and looks for (and
acts on) new lines only. When you send the input on stdin, it is a new
line added to stdin. If you already have the word foobar in monitor
.me when SEC starts up it won't act on it. Try
echo foobar >> monitor.me
in another window AFTER SEC is started.
[...]
>1) Why SEC can read the input from terminal and not from the input file?
See above and read the man page about notail and some other flag that
is escaping me at the moment.
>2) What would be the simplest pattern that matches only the log lines with
> the word CONFIG in them and doesn't match the ones with the word NOCONFIG?
I would use two rules. Have the first match (and ignore) NOCONFIG and
have the second just match CONFIG. Otherwise I think youh ave to use
a negative lookbehind in your regular expression. Google for examples.
--
-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.
------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Simple-evcorr-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
