Recent changes to Configuration File

Configuration File modified by Les Peters

Les Peters — Wed, 17 Dec 2014 03:59:55 -0000

--- v3
+++ v4
@@ -14,7 +14,7 @@
 Mandatory: the directory OmniCheck expects to find the rulefiles.

home: /app
-home: /opt/omnicheck

+home: /var/sfw/omnicheck

name

@@ -33,7 +33,7 @@

file: /usr/adm/syslog/syslog.log

 file: #!/bin/df -k

-file: /oap/logs/.err

+file: /app/logs/.err

 file: @/opt/omnicheck/file.list

oldfile
@@ -66,8 +66,8 @@

Optional: the name used when you want to monitor one file differently than another. The first block is always the "main" block, and the configuration file entries "process", "home", and "tmpdir" in the "main" block are copied into each subsequent block.

block: MAILDB_M01A_SYB

-block: dsl_reg_db

block: WebSrv_A

+block: Tomcat_B

rules

@@ -158,14 +158,14 @@

maint

-Recommended: tells OmniCheck whether the monitored file(s) is under maintenance work or not. See 'production' above for true and false values. When the maint value is true, no notifications will be sent.
+Recommended: tells OmniCheck whether the monitored file(s) is under maintenance work or not. See 'production' above for true and false values. When the 'maint' value is true, no notifications will be sent.

maint: no  # or 0 or off

 maint: yes # or 1 or on

quiet

-Optional: tells OmniCheck when to be 'quiet', and not send any alerts. It follows the structure of crontab to provide values for the minute, hour, day, month, and day-of-week. Any trailing values not assigned are assumed to match all possible values ().
+Optional: tells OmniCheck when to be 'quiet', and not send any alerts. It follows the structure of crontab(5) to provide values for the minute, hour, day, month, and day-of-week. Any trailing values not assigned are assumed to match all possible values ().

quiet: * 15-19 * * *   # no alerts between 3:00pm and 7:59pm

 quiet: * 15-19         # same as above

@@ -194,7 +194,7 @@
admin: jblow

 admin: jblow@here.com

-admin: /oap/omnicheck_admin

+admin: /app/omnicheck_admin

 admin: #!/opt/omnicheck/get_admin.sh


oncall

@@ -203,7 +203,7 @@

oncall: jblow

 oncall: jblow@here.com

-oncall: /oap/omnicheck_oncall

+oncall: /app/omnicheck_oncall

 oncall: #!/opt/omnicheck/get_oncall.sh


organization

Configuration File modified by Les Peters

Les Peters — Sat, 13 Dec 2014 22:44:19 -0000

--- v2
+++ v3
@@ -1,6 +1,6 @@
 ## Configuration File Entries ##

-The configuration file contains all the necessary information to properly run an instance of OmniCheck. Below is a list of the available entries:
+The configuration file contains all the necessary information to properly run an instance of OmniCheck. Below is a list of the available entries, their use, and example values.

 + process

Configuration File modified by Les Peters

Les Peters — Sat, 13 Dec 2014 22:40:46 -0000

--- v1
+++ v2
@@ -1,150 +1,221 @@
-Configuration
+## Configuration File Entries ##

 The configuration file contains all the necessary information to properly run an instance of OmniCheck. Below is a list of the available entries:
-process
+
++ process
+
 Mandatory: the unique name for this instance of OmniCheck. It is used as part of various filenames. Try to be descriptive of what is being monitored.
-process: syslog
-process: sapi-apps
-home
+
+

process: syslog
+process: web-apps

+ ++ home + Mandatory: the directory OmniCheck expects to find the rulefiles. -home: /oap -home: /opt/omnicheck -name + +

home: /app
+home: /opt/omnicheck

+ ++ name + Mandatory: the name used when OmniCheck sends mails and pages. The mnemonic NODE can be used to represent the nodename of the host. -name: foobar -name: NODE -file + +

name: foobar
+name: NODE

+ ++ file + Mandatory: the file(s) that this instance/block of OmniCheck will monitor. This value can be any of the following: a single file a path to an executable program or script (prefaced with #!) a fileglob matching multiple files a filelist containing multiple files (prefaces with @) -file: /usr/adm/syslog/syslog.log + +

file: /usr/adm/syslog/syslog.log
 file: #!/bin/df -k
 file: /oap/logs/*.err
-file: @/opt/omnicheck/file.list
-oldfile
+file: @/opt/omnicheck/file.list

+ ++ oldfile + Recommended: the filename of the previous rotation of a single file listed in the file configuration file entry. OmniCheck will parse and data that was written to this file after the last run, but before the file was rotated. This feature only works when a single file is being monitored in the block. -oldfile: /usr/adm/oSYSLOG -oldfile: /oap/logs/.old/process-a.err -oldfile: #!/oap/calc_oldfile_name.sh + +

oldfile: /usr/adm/oSYSLOG
+oldfile: /app/omnicheck/logs/.old/process-a.err
+oldfile: #!/app/omnicheck/bin/calc_oldfile_name.sh

+ See here for documentation on specifying oldfiles for files within a filelist. -gzip ++ gzip + Mandatory if using GNU ZIP to compress 'oldfiles': the full pathname of the binary for the GNU ZIP utility. This value will be used when 'oldfiles' compressed with gzip are used. -gzip: /usr/bin/gzip -tmpdir + +

gzip: /usr/bin/gzip

+ ++ tmpdir + Optional: the directory OmniCheck uses to store working files, such as the tellfile, spoolfile and lockfile. If "tmpdir" is not set in the configuration file, the most OS-appropriate directory will be used. + NOTE: Do not set 'tmpdir' to /tmp on Solaris systems, as that filesystem is cleared on reboot, erasing your tellfiles. -tmpdir: /usr/tmp -tmpdir: /oap -block +

tmpdir: /usr/tmp
+tmpdir: /var/tmp
+tmpdir: /app/omnicheck/tmp

+ ++ block + Optional: the name used when you want to monitor one file differently than another. The first block is always the "main" block, and the configuration file entries "process", "home", and "tmpdir" in the "main" block are copied into each subsequent block. -block: MAILDB_M01A_SYB -block: dsl_reg_db -rules + +

block: MAILDB_M01A_SYB
+block: dsl_reg_db

+ ++ rules + Mandatory: the filename for the patterns and associated actions (rules). There can be one or more rulefiles listed on the 'rules' entry, or each rulefile can be listed on their own line: regardless, the files are read in the order they are listed in the configuration file, and the rules therein are processed in the same order. The rulefiles can either be references relative to the home directory or via an absolute path: -# relative to the 'home' directory - -rules: rules.local rules.group rules.global -rules: rules.process_1 rules.process_group rules.all_processes - -# absolute - -rules: /opt/omnicheck/special/rules.special -logs + +Relative to the 'home' directory + +

rules: rules.local rules.group rules.global
+rules: rules.process_1 rules.process_group rules.all_processes

+ +Absolute path + +

rules: /opt/omnicheck/special/rules.special

+ ++ logs + Optional: the directory to which OmniCheck will write its omnicheck.err and omnicheck.out log files. If not defined, the home directory will be used. -logs: /oap/logs -logs: /usr/local/omnicheck/logs -out + +

logs: /oap/logs
+logs: /usr/local/omnicheck/logs

+ ++ out + Optional: the filename to use for STDOUT of OmniCheck. Unix date(1)-style mnemonics can be added to provide an auto-rotation feature. The default value is omnicheck.out -out: omnicheck_%Y%m%d.out -out: omnicheck_%H:%M:%S.out -err + +

out: omnicheck_%Y%m%d.out
+out: omnicheck_%H:%M:%S.out

+ ++ err + Optional: the filename to use for STDERR of OmniCheck. Unix date(1)-style mnemonics can be added to provide an auto-rotation feature. The default value is omnicheck.err -err: omnicheck_%Y-%m-%d.err -err: omnicheck_%H:%M:%S.err -debug -Optional: the level of messages to generate in the omnicheck.err file. Messages at lower levels will be written, i.e., 'crit' includes 'alert' and 'emer', et cetera -# highest level = most log entries - -debug: debug + +

err: omnicheck_%Y-%m-%d.err
+err: omnicheck_%H:%M:%S.err

+ ++ debug + +Optional: the level of messages to generate in the omnicheck.err file. Messages at lower levels will be written, i.e., 'crit' includes 'alert' and 'emer', et cetera. The higher the level, the more log entries generated. + +

debug: debug 
 debug: info
-
-# notice is default production level
-
-debug: notice 
+debug: notice # default level 
 debug: warn
 debug: err 
 debug: crit
 debug: alert
-debug: emer
-interval
+debug: emer

+ ++ interval + Mandatory for running in persistent (daemon) mode: provides OmniCheck the minimum length of time (in seconds) to spend in each iteration of its event loop. If an event loop takes longer than interval seconds, the next event loop will start immediately after the last. -interval: 300 -IRS + +

interval: 300

+ ++ IRS + Optional: defines an input record separator (IRS) for logs that consist of multiple lines. When this configuration entry is used, it should contain a regex matching the beginning of a new multiple-line log entry. OmniCheck will match each line of the new content for this pattern, and if found, will begin a new record with this line. Note: the multiple-line records will contain newlines. -IRS: ^\d\d\d\d-\d\d-\d\d-\d\d\.\d\d\.\d\d\.\d+ -IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d + +

IRS: ^\d\d\d\d-\d\d-\d\d-\d\d\.\d\d\.\d\d\.\d+
+IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d

+ There is an optional :trim tag you can associate with the IRS entry to match a set of lines, trim off the matching part, like a date/time stamp, then concatenate the remainders into one line. -IRS: ^\d\d\d\d-\d\d-\d\d-\d\d\.\d\d\.\d\d\.\d+ :trim -IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d :trim +

IRS: ^\d\d\d\d-\d\d-\d\d-\d\d\.\d\d\.\d\d\.\d+ :trim
+IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d :trim

+ NOTE: may not be used in persistent mode. -Flags to control OmniCheck's function: - -production -Recommended: tells OmniCheck whether the monitored file(s) is 'in production' or not. A true value would be 'on', 'yes', or '1', whereas a false value would be 'off', 'no', or '0' (zero). When the production value is false, pages are downgraded to mails, and actions that would contact the oncall now contact the admin. -production: no # or 0 or off -production: yes # or 1 or on -farm +### Flags to control OmniCheck's function ### + ++ production + +Recommended: tells OmniCheck whether the monitored file(s) is 'in production' or not. A true +value would be 'on', 'yes', or '1', whereas a false value would be 'off', 'no', or '0' (zero). When the production value is false, pages are downgraded to mails, and actions that would contact the oncall now contact the admin. + +

production: no  # or 0 or off
+production: yes # or 1 or on

+ ++ farm + Recommended: tells OmniCheck whether the monitored file(s) is part of a redundant set of objects or not. The theory goes that a single component of a farm can endure an failure without causing adverse impact to the farm as a whole. See 'production' above for true and false values. When the farm value is true, the effect is the same as if the production value is false. -farm: no # or 0 or off -farm: yes # or 1 or on -maint +

farm: no  # or 0 or off
+farm: yes # or 1 or on

+ ++ maint + Recommended: tells OmniCheck whether the monitored file(s) is under maintenance work or not. See 'production' above for true and false values. When the maint value is true, no notifications will be sent. -maint: no # or 0 or off -maint: yes # or 1 or on - -quiet + +

maint: no  # or 0 or off
+maint: yes # or 1 or on

+ ++ quiet + Optional: tells OmniCheck when to be 'quiet', and not send any alerts. It follows the structure of crontab to provide values for the minute, hour, day, month, and day-of-week. Any trailing values not assigned are assumed to match all possible values (*). -quiet: * 15-19 * * * # no alerts between 3:00pm and 7:59pm + +

quiet: * 15-19 * * *   # no alerts between 3:00pm and 7:59pm
 quiet: * 15-19         # same as above
-quiet: * * * * 0,6     # no alerts on Saturday or Sunday
-Required Entries for sending mail or pages
-
-smtphost
+quiet: * * * * 0,6     # no alerts on Saturday or Sunday

+ +### Required Entries for sending mail or pages ### + ++ smtphost + the name of the host handling SMTP traffic for your site, or the path to a SMTP-capable binary on your system. Any necessary options for the binary must be provided. -smtphost: localhost + +

smtphost: localhost
 smtphost: relay.mail.here.com
-smtphost: /usr/lib/sendmail -t
-pagerhost
-the name of the host that will translate an email into a pager message.
-pagerhost: pager.foo.com
-pagerhost: page.mail.here.com
-admin
+smtphost: /usr/lib/sendmail -t

+ ++ pagerhost + +The name of the host that will translate an email into a pager message. + +

pagerhost: pager.foo.com
+pagerhost: page.mail.here.com

+ ++ admin + the name of the administrator for the file/system being monitored. Valid values are bare Unix username, a fully-formed email address, a simple file containing either a username or email address, or an executable script/program whose output is either a username or email address. The value of this entry replaces action references to 'admin'. -admin: jblow + +

admin: jblow
 admin: jblow@here.com
 admin: /oap/omnicheck_admin
-admin: #!/opt/omnicheck/get_admin.sh
-oncall
+admin: #!/opt/omnicheck/get_admin.sh

+ ++ oncall + the name of the oncall personnel for the file/system being monitored. Valid values are bare Unix username, a fully-formed email address, a simple file containing either a username or email address, or an executable script/program whose output is either a username or email address. The value of this entry replaces action references to 'oncall'. -oncall: jblow + +

oncall: jblow
 oncall: jblow@here.com
 oncall: /oap/omnicheck_oncall
-oncall: #!/opt/omnicheck/get_oncall.sh
-organization
+oncall: #!/opt/omnicheck/get_oncall.sh

+ ++ organization + Optional: This field can be used to identify to which group that an instance of OmniCheck belongs, as well as invoke different actions within a single rule: see here for more information. -organization: QA_Team + +

organization: QA_Team
 organization: NorthAm.Prod
-organization: Foobar
-fqdn
+organization: Foobar

+ ++ fqdn + May be mandatory: Certain Unix-based architectures do not provide proper hostname identification (you know who you are). For those systems, you can provide a name to use for mail and page events. -fqdn: foobar.db.foo.com + +

fqdn: foobar.db.foo.com

Configuration File modified by Les Peters

Les Peters — Sat, 13 Dec 2014 21:38:19 -0000

Configuration

The configuration file contains all the necessary information to properly run an instance of OmniCheck. Below is a list of the available entries:
process
Mandatory: the unique name for this instance of OmniCheck. It is used as part of various filenames. Try to be descriptive of what is being monitored.
process: syslog
process: sapi-apps
home
Mandatory: the directory OmniCheck expects to find the rulefiles.
home: /oap
home: /opt/omnicheck
name
Mandatory: the name used when OmniCheck sends mails and pages. The mnemonic NODE can be used to represent the nodename of the host.
name: foobar
name: NODE
file
Mandatory: the file(s) that this instance/block of OmniCheck will monitor. This value can be any of the following:
a single file
a path to an executable program or script (prefaced with #!)
a fileglob matching multiple files
a filelist containing multiple files (prefaces with @)
file: /usr/adm/syslog/syslog.log
file: #!/bin/df -k
file: /oap/logs/*.err
file: @/opt/omnicheck/file.list
oldfile
Recommended: the filename of the previous rotation of a single file listed in the file configuration file entry. OmniCheck will parse and data that was written to this file after the last run, but before the file was rotated. This feature only works when a single file is being monitored in the block.
oldfile: /usr/adm/oSYSLOG
oldfile: /oap/logs/.old/process-a.err
oldfile: #!/oap/calc_oldfile_name.sh
See here for documentation on specifying oldfiles for files within a filelist.

gzip
Mandatory if using GNU ZIP to compress 'oldfiles': the full pathname of the binary for the GNU ZIP utility. This value will be used when 'oldfiles' compressed with gzip are used.
gzip: /usr/bin/gzip
tmpdir
Optional: the directory OmniCheck uses to store working files, such as the tellfile, spoolfile and lockfile. If "tmpdir" is not set in the configuration file, the most OS-appropriate directory will be used.
NOTE: Do not set 'tmpdir' to /tmp on Solaris systems, as that filesystem is cleared on reboot, erasing your tellfiles.

tmpdir: /usr/tmp
tmpdir: /oap
block
Optional: the name used when you want to monitor one file differently than another. The first block is always the "main" block, and the configuration file entries "process", "home", and "tmpdir" in the "main" block are copied into each subsequent block.
block: MAILDB_M01A_SYB
block: dsl_reg_db
rules
Mandatory: the filename for the patterns and associated actions (rules). There can be one or more rulefiles listed on the 'rules' entry, or each rulefile can be listed on their own line: regardless, the files are read in the order they are listed in the configuration file, and the rules therein are processed in the same order. The rulefiles can either be references relative to the home directory or via an absolute path:

relative to the 'home' directory

rules: rules.local rules.group rules.global
rules: rules.process_1 rules.process_group rules.all_processes

absolute

rules: /opt/omnicheck/special/rules.special
logs
Optional: the directory to which OmniCheck will write its omnicheck.err and omnicheck.out log files. If not defined, the home directory will be used.
logs: /oap/logs
logs: /usr/local/omnicheck/logs
out
Optional: the filename to use for STDOUT of OmniCheck. Unix date(1)-style mnemonics can be added to provide an auto-rotation feature. The default value is omnicheck.out
out: omnicheck_%Y%m%d.out
out: omnicheck_%H:%M:%S.out
err
Optional: the filename to use for STDERR of OmniCheck. Unix date(1)-style mnemonics can be added to provide an auto-rotation feature. The default value is omnicheck.err
err: omnicheck_%Y-%m-%d.err
err: omnicheck_%H:%M:%S.err
debug
Optional: the level of messages to generate in the omnicheck.err file. Messages at lower levels will be written, i.e., 'crit' includes 'alert' and 'emer', et cetera

highest level = most log entries

debug: debug
debug: info

notice is default production level

debug: notice
debug: warn
debug: err
debug: crit
debug: alert
debug: emer
interval
Mandatory for running in persistent (daemon) mode: provides OmniCheck the minimum length of time (in seconds) to spend in each iteration of its event loop. If an event loop takes longer than interval seconds, the next event loop will start immediately after the last.
interval: 300
IRS
Optional: defines an input record separator (IRS) for logs that consist of multiple lines. When this configuration entry is used, it should contain a regex matching the beginning of a new multiple-line log entry. OmniCheck will match each line of the new content for this pattern, and if found, will begin a new record with this line. Note: the multiple-line records will contain newlines.
IRS: ^\d\d\d\d-\d\d-\d\d-\d\d.\d\d.\d\d.\d+
IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d
There is an optional :trim tag you can associate with the IRS entry to match a set of lines, trim off the matching part, like a date/time stamp, then concatenate the remainders into one line.

IRS: ^\d\d\d\d-\d\d-\d\d-\d\d.\d\d.\d\d.\d+ :trim
IRS: ^[A-Z] [A-Z][a-z][a-z] [ \d]\d \d\d:\d\d:\d\d \d\d\d\d :trim
NOTE: may not be used in persistent mode.

Flags to control OmniCheck's function:

production
Recommended: tells OmniCheck whether the monitored file(s) is 'in production' or not. A true value would be 'on', 'yes', or '1', whereas a false value would be 'off', 'no', or '0' (zero). When the production value is false, pages are downgraded to mails, and actions that would contact the oncall now contact the admin.
production: no # or 0 or off
production: yes # or 1 or on
farm
Recommended: tells OmniCheck whether the monitored file(s) is part of a redundant set of objects or not.
The theory goes that a single component of a farm can endure an failure without causing adverse impact to the farm as a whole.

See 'production' above for true and false values. When the farm value is true, the effect is the same as if the production value is false.

farm: no # or 0 or off
farm: yes # or 1 or on
maint
Recommended: tells OmniCheck whether the monitored file(s) is under maintenance work or not. See 'production' above for true and false values. When the maint value is true, no notifications will be sent.
maint: no # or 0 or off
maint: yes # or 1 or on

quiet
Optional: tells OmniCheck when to be 'quiet', and not send any alerts. It follows the structure of crontab to provide values for the minute, hour, day, month, and day-of-week. Any trailing values not assigned are assumed to match all possible values ().
quiet: * 15-19 * * # no alerts between 3:00pm and 7:59pm
quiet: * 15-19 # same as above
quiet: * * 0,6 # no alerts on Saturday or Sunday
Required Entries for sending mail or pages

smtphost
the name of the host handling SMTP traffic for your site, or the path to a SMTP-capable binary on your system. Any necessary options for the binary must be provided.
smtphost: localhost
smtphost: relay.mail.here.com
smtphost: /usr/lib/sendmail -t
pagerhost
the name of the host that will translate an email into a pager message.
pagerhost: pager.foo.com
pagerhost: page.mail.here.com
admin
the name of the administrator for the file/system being monitored. Valid values are bare Unix username, a fully-formed email address, a simple file containing either a username or email address, or an executable script/program whose output is either a username or email address. The value of this entry replaces action references to 'admin'.
admin: jblow
admin: jblow@here.com
admin: /oap/omnicheck_admin
admin: #!/opt/omnicheck/get_admin.sh
oncall
the name of the oncall personnel for the file/system being monitored. Valid values are bare Unix username, a fully-formed email address, a simple file containing either a username or email address, or an executable script/program whose output is either a username or email address. The value of this entry replaces action references to 'oncall'.
oncall: jblow
oncall: jblow@here.com
oncall: /oap/omnicheck_oncall
oncall: #!/opt/omnicheck/get_oncall.sh
organization
Optional: This field can be used to identify to which group that an instance of OmniCheck belongs, as well as invoke different actions within a single rule: see here for more information.
organization: QA_Team
organization: NorthAm.Prod
organization: Foobar
fqdn
May be mandatory: Certain Unix-based architectures do not provide proper hostname identification (you know who you are). For those systems, you can provide a name to use for mail and page events.
fqdn: foobar.db.foo.com