Hello,
I'm having an issue with getting the "abort on match" to work as expected. First of all, a few questions regarding the "abort on match":
1. Is it considered a "match" if only the match expression is true? Or do variables also go into account here? I know that for an alarm to be triggered, not only does the match expression have to be true but also one of the defined variables cannot be as expected.
2. Does using a url as the mode change the behavior of the "abort on match"?
Basically, I have a profile using url mode. I have 3 watcher rules defined in this profile. The first looks for a specific xml tag and result. If found, we know that everything is "UP" and sends a clear alarm. The second is looking for the same xml tag with a different result and then is grabbing the rest of the text as a regex variable. Within that, I set 3 variables that are looking for specific services. I am "expecting" to see each one. If I don't see one of them, that will cause the watcher to send a critical alarm saying it is "DOWN". I have set the Advanced setting of "abort on match" for this particular watcher rule. That is because the final watcher rule is actually looking for the same xml tag and result as the "down" but is not looking for any variables. So, as long as it sees the xml tag, it sends a warning alarm saying it is "DEGRADED". The issue is, I cannot get the logmon to abort on the second watcher rule. It says in the log that it should be aborting, but it continues evaluating the next watcher rule. Here is the logmon.cfg for clarification. Also, an excerpt from the log is below.
<e2e>
active = yes
interval = 1 min
scanfile = http://***/endtoendtest.txt
scanmode = url
alarm = yes
qos = no
message = no
max_alarms =
max_alarm_msg =
password =
timeout = 15
retries = 2
url_alarm_sev = 5
urluser = ***
urlpass = ***
challengeresponse = yes
proxyhost =
proxyport =
proxyuser =
SslSettings = 0
subject =
user =
<watchers>
<UP>
active = yes
match = /<GotAllExpectedResponses>yes<\/GotAllExpectedResponses>/
level = clear
subsystemid =
message = e2e is UP - TEST
i18n_token =
restrict =
expect = no
abort = no
sendclear = no
count = no
separator =
suppid = logmon/e2e
source = e2e
target =
qos =
runcommandonmatch = no
commandexecutable =
commandarguments =
expect_message =
expect_level =
</UP>
<DOWN>
active = yes
match = /<GotAllExpectedResponses>no<\/GotAllExpectedResponses>(.*)/
level = minor
subsystemid =
message = e2e is DOWN - TEST
i18n_token =
restrict =
expect = no
abort = yes
sendclear = no
count = no
separator =
suppid = logmon/e2e
source = e2e
target =
qos =
runcommandonmatch = no
commandexecutable =
commandarguments =
expect_message =
expect_level =
<variables>
<Parser>
definition = $1
operator = re
threshold = /<Service>Parser<\/Service>/
qosactive =
qosname =
qostarget =
</Parser>
<EServices>
definition = $1
operator = re
threshold = /<Service>EServices<\/Service>/
qosactive =
qosname =
qostarget =
</EServices>
<Inserter>
definition = $1
operator = re
threshold = /<Service>Inserter<\/Service>/
qosactive =
qosname =
qostarget =
</Inserter>
</variables>
</DOWN>
<DEGRADED>
active = yes
match = /<GotAllExpectedResponses>no<\/GotAllExpectedResponses>/
level = warning
subsystemid =
message = e2e is DEGRADED - TEST
i18n_token =
restrict =
expect = no
abort = no
sendclear = no
count = no
separator =
suppid = logmon/e2e
source = e2e
target =
qos =
runcommandonmatch = no
commandexecutable =
commandarguments =
expect_message =
expect_level =
</DEGRADED>
</watchers>
</e2e>
Logfile:
Apr 23 10:42:51:647 [2404] logmon: [e2e] FORMAT START [default] - matches
Apr 23 10:42:51:647 [2404] logmon: [e2e] FORMAT LINES [default] - matches
Apr 23 10:42:51:647 [2404] logmon: [e2e] NO MATCH [UP] offset now -1
Apr 23 10:42:51:647 [2404] logmon: [e2e] MATCH [DOWN] on line 0
Apr 23 10:42:51:647 [2404] logmon: [e2e] e2e.DOWN: Alarm Message, severity=3, sid=1.1, msg='e2e is DOWN - TEST'
Apr 23 10:42:51:647 [2404] logmon: abort [DOWN] on match!!
Apr 23 10:42:51:647 [2404] logmon: [e2e] MATCH [DEGRADED] on line 0
Apr 23 10:42:51:647 [2404] logmon: [e2e] sldmbe2e.DEGRADED: Alarm Message, severity=2, sid=1.1, msg='e2e is DEGRADED - TEST'
Apr 23 10:42:51:647 [2404] logmon: [e2e] NO MATCH [DEGRADED] offset now -1
Apr 23 10:42:51:647 [2404] logmon: [e2e] used 40 ms scanning 1792 bytes
Any help is appreciated. Thanks!
Karen