I've got logwatch configured from what I can tell. I am getting a notice in the agent log that the event I want is being created, but I never see it on the server.
Here's the logwatch xml:
<parser>
<processAll>0</processAll>
<file>/etc/nxagentd.logwatch.zpool</file>
<rules>
<rule>
<match>DEGRADED</match>
<event>10014</event>
</rule>
<rule>
<match>ONLINE</match>
<event>10015</event>
</rule>
</rules>
</parser>
Here's the event that is created in the agent log:
[23-Aug-2015 18:53:20.845] [DEBUG] SendTrap(): event_code=10014, event_name=(null), num_args=0, arg[0]="(null)" arg[1]="(null)" arg[2]="(null)"
Here are two more of the other event:
[23-Aug-2015 18:55:05.848] [DEBUG] SendTrap(): event_code=10015, event_name=(null), num_args=0, arg[0]="(null)" arg[1]="(null)" arg[2]="(null)"
[23-Aug-2015 18:55:05.848] [DEBUG] SendTrap(): event_code=10015, event_name=(null), num_args=0, arg[0]="(null)" arg[1]="(null)" arg[2]="(null)"
Nothing shows up on the NetXMS server under the node I'm monitoring or in the Event Log.
Any help much appreciated...
pace
[EDITED to clarify NetXMS Server and Node difference]
Hi,
can you please show your nxagentd.conf file?
Best regards,
Victor
nxagentd.conf from unit that has the logwatch on it:
Servers = xx.xx.xx.xx
ControlServers = xx.xx.xx.xx
MasterServers = xx.xx.xx.xx
ListenPort = 4700
LogFile = /var/log/netxms-agent.log
RequireEncryption = yes
EnabledCiphers = 1
MaxSessions = 32
SessionIdleTimeout = 60
FileStore = /var/nxagentd
TimeOut = 5
StartupDelay = 0
PlatformSuffix = dbg
EnableSubagentAutoload = yes
EnableProxy = no
EnableSNMPProxy = no
SubAgent = portcheck.nsm
SubAgent = netsvc.nsm
SubAgent = logwatch.nsm
# log watch parser definitions
*LOGWATCH
Parser = /etc/nxagentd.logwatch.zpool.xml
pace
Try to remove Servers and ControlServers and leave only MasterServers. There is a known bug (will be fixed in 2.0-RC2) that incorrectly set access level for server if it is listed in multiple categories.
Best regards,
Victor
Hey there. Tried setting only MasterServers, didn't make any difference.
pace
Nevermind. That actually did make it happy, I just needed to define the event on the server side.
Thank you!
pace