Probe to run a command in AIX and act on the output

[tcolich]

I was wondering if anyone has written a probe that runs a command on a Unix based OS and throws an alarm if a certain string is in the output.  I am a .NET developer and have ZERO experience with anything Unix, so any help would be VERY much appreciated.

[Anon Anon]

The logmon probe does just what you are asking about.

Create a profile, set mode to "command" and put the command you want to run in there. Then set up watcher rules for the different strings you are looking for using regular expressions. I think one of the samples in logmon is for the errpt command that AIX has to parse a binary log they use (though that could be only on AIX machines I can't remember).

Best regards,
Stian

[tcolich]

Thanks Stian.  I see now that this can be done, however I am having a terrible time getting it set up.



I set up a new profile with the mode set to 'Command'.  I put /usr/sbin/lspath in the Command field, but when I press the 'View' button, i get the contents of the executable file and not the output of the command.  Am I doing something wrong here?

[Anon Anon]

No, you are not doing anything wrong. However the GUI does not ask the probe to execute anything when you click 'View', it just tries to give you the file pointed to in the text box! The View button should be disabled when Command mode is set (and it will be in the next release if I have anything to say about it...and I do ).

The "workaround" if you can call it that is to run the command on the box once, redirecting the output to a text file, selecting 'cat' mode and testing out your watchers until you are happy that they do what you want. The 'cat' mode will simply give you the entire contents of the file pointed to and feed it to your watchers. When you are getting what you want/expect you change back to 'Command' mode and point it to your binary and hit 'Apply'.

Cheers,
Stian

[tcolich]

Alright, I've got it so it throws alarms when 'Enabled' shows up on a line.  Does anyone have any idea how to write a regex that will match when the first word ISN'T 'Enabled'?

I really don't want to have to build a watcher for every other possible state.

[Anon Anon]

Please note that this is just off the top of my head, I haven't tried these yet!

You can try either of the following:

1) Using variable expected state
Set match rule to be /.*/ (anything)
Create a variable "state", set the contents to column 1 and set the expected state = ENABLED
If the variable has any other value then the probe will send an alarm.

2) Two different match rules.
Set match rule of the first watcher to be /Enabled .*/
Go to the Advanced tab and select the Abort on match. This should skip that line in the output.
Set match rule of the second watcher to be /.*/
Anything that gets to this watcher will match, and should be sent as an alarm.

If you need to move watchers up/down in the list (they are run in the order found!) you can right-click the watcher and Move Up or Move Down...

Cheers,
Stian

[Anon Anon]

Did you ever get this working the way you wanted?

(Of the suggestions offered, my personal preference would be #2.  I have used logic like that in NimBUS probe configs before but probably not logmon yet.  I am curious about whether it addressed your need.)

Thanks,
Keith

[tcolich]

Keith,

I have it set up, but I am still waiting for the customer to get a window for testing.  I will update this post when I find out if this worked.



-Tony