NetXMS Support Forum

I found a solution myself. I'm using following filter script in events to filter the message text with wildcards:

if($event->message ~= "(.*)ERP Basis System(.*)") return false;
else return true;

Greets
Marco

Thanks for the reply. I understand this.

But i think that the code from above is false. Can i use "*" als wildcard in filtering code? Is the script above functional in NetXMS?

Hello @all,

i'd like to implement a filtering script in event processing:

-----
if ($event->message like "*ERP Basis System*"){
  return false; // Match rule
}
return true;
-----

Event processing should only throw a alarm, if there is NOT the text "ERP Basis System" in the message text of the event. How can/must i use wildcards in filtering scripts?

Thanks for helping me...

Greets
Marco

Hi Victor,

works perfect... thanks for the hint...

Greets
Marco

Hi Victor,

thanks for the fast reply... i will try it tomorrow...

Greets
Marco

Hello,

i'm using hier NetXMS V1.2.7 in a windows environment (NetXMS server is a Win7 machine, NetXMS Agent runs on a Win2008R2 Server). I'm having here a problem with the monitoring from the Windows server. The NetXMS Agent don't send any events to the NetXMS syslog server (syslog server is up an running...)



My agent config looks like this:
--------------------------------------------
MasterServers = 10.10.9.40
ConfigIncludeDir = C:\NetXMS\etc\nxagentd.conf.d
#LogFile = {syslog}
LogFile = c:\netxms\var\netxms.log
FileStore = C:\NetXMS\var
SubAgent = logwatch.nsm
SubAgent = winperf.nsm
DebugLevel = 9

*LOGWATCH
Parser = c:\netxms\etc\eventlog_system_parser.xml
--------------------------------------------



Logwatch Parser File:
--------------------------------------------
<parser trace="9">
  <file>*System</file>
  <rules>
    <rule>
      <match>(.*)</match>
    </rule>
  </rules>
</parser>
--------------------------------------------



With these configs i can see the following in the NetXMS Agent Log:

--------------------------------------------
[28-Apr-2015 15:45:27.877] [DEBUG] [session:0] Sending message CMD_REQUEST_COMPLETED (size 48)
[28-Apr-2015 15:45:43.492] [DEBUG] LogWatch: publisher name is Service Control Manager
[28-Apr-2015 15:45:43.492] [DEBUG] Match event: source="Service Control Manager" id=7036 level=4 text="Dienst "Software Protection" befindet sich jetzt im Status "Beendet"."
[28-Apr-2015 15:45:43.492] [DEBUG] checking rule 1 ""
[28-Apr-2015 15:45:43.492] [DEBUG]   rule has no context
[28-Apr-2015 15:45:43.492] [DEBUG]   matching against regexp (.*)
[28-Apr-2015 15:45:43.492] [DEBUG]   matched
[28-Apr-2015 15:45:43.492] [DEBUG] rule 1 "" matched
[28-Apr-2015 15:45:43.492] [DEBUG] processing stopped at rule 1 ""; result = true
[28-Apr-2015 15:45:48.250] [DEBUG] [session:0] Message dump:
--------------------------------------------

By searching for infos on Google i can take a look at other NetXMS Agent Dumps with logwatch active. At all other Dumps i can see an

SendTrap(): event ....

after the line "processing stopped at...". Where is my fault? Can anyone help me, please?


Greets
Marco

PS: By the way, thanx for this great piece of software