Re: [Bigsister-general] "Ignore" rules in eventlog and syslog

["Peter Varlien" <suppressed>]

On Wed, 05 Apr 2006 18:23:08 +0200, Douglas Valkenaar  
<suppressed> wrote:

> Ah - I see how you're reading this.  I don't want to ignore *rules* -
> I want to ignore *events* in the logs on the machine.
>
> For example, I've added a line to my 'eventlog' file:
>    # Ignore Terminal Service license
>    Source=TermService.*license.server              green   0
> System looks fine

How about setting severity to white (or blue or black) instead of green?

Peter
> because I don't care about Terminal Service errors on the machine.
> The problem is this doesn't just ignore, it actually proclaims the
> machine "System looks fine" even if it's not because of another error.
>
> Does that help?
>
> On 4/5/06, Kai Schaetzl <suppressed> wrote:
> > Douglas Valkenaar wrote on Tue, 4 Apr 2006 22:13:41 -0700:
> >
> > > I hope you understood that my point was that there are "default"
> > > events that you want flagged, and specific others that can be handled
> > > specially.  But, what about those that I'd rather ignore?  I don't
> > > want a special status or anything reported - I just want those lines
> > > ignored from the logs.
> >
> > That is what commenting them out does. I was looking at your first  
> > message
> > and wondering if I should reply or not or if I misunderstood your  
> > question
> > since the answer is so obvious. Lines that don't get matched by syslog  
> > are
> > not reported at all, not green, not purple, not anything. Remove that  
> > line
> > completely and if you still get a status about it, one of the other  
> > regexp
> > matches it. F.i., first thing I do on a news setup is change the "loop"
> > line to "looping" because "loop" delivers false positives.
> >
> > Does this example from one of my machines help?
> >
> > /var/log/mail:
> >
> > default             green   0   mail looks fine
> > stat=Sent           green   10  mail transmitted
> > looping             yellow  10  mail: MX problem
> > #ERROR\sSTATE       red     30  mail: corral crash
> > init failed to open yellow  10  mail: corral crash
> > stat=Please         yellow  10  mail: corral problem (Virus!)
> > #######################################################################
> > /var/log/warn:
> >
> > default             green   0   warn looks fine
> > kernel paging request   red 10  warn: Kernel Oops
> > EIP                 red 10  warn: Kernel Oops
> > assertion           yellow  30  warn: Kernel Assertion
> >
> > #######################################################################
> > #/var/log/kernel-warning.log:
> >
> > #default                green   0   kernel looks fine
> > #EIP                    red 60  kernel: Kernel Oops
> > #assertion          red 60  kernel: Kernel Assertion
> >
> >
> > Kai
> >
> > --
> > Kai Schätzl, Berlin, Germany
> > Get your web at Conactive Internet Services: http://www.conactive.com
> >
> >
> >
> >
> >
> > -------------------------------------------------------
> > This SF.Net email is sponsored by xPML, a groundbreaking scripting  
> > language
> > that extends applications into web and mobile media. Attend the live  
> > webcast
> > and join the prime developer group breaking into this new coding  
> > territory!
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> > _______________________________________________
> > Bigsister-general mailing list
> > suppressed
> > https://lists.sourceforge.net/lists/listinfo/bigsister-general
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting  
> language
> that extends applications into web and mobile media. Attend the live  
> webcast
> and join the prime developer group breaking into this new coding  
> territory!
> http://sel.as-us.falkag.net/sel?cmd_______________________________________________
> Bigsister-general mailing list
> suppressed
> https://lists.sourceforge.net/lists/listinfo/bigsister-general



--
Peter Værlien
Fritz Aabakkens vei 17, 7072 Heimdal, Norway
Telephone: 917 69 384, E-Mail: suppressed,  
http://varlien.home.online.no
It always takes a Clinton to clean up after a Bush - Hillary 2008



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Bigsister-general mailing list
suppressed
https://lists.sourceforge.net/lists/listinfo/bigsister-general