Generic command in user_alert.conf

Hi Romain,

 

 

I don't think syslog-ng provides a mechanism to run a shell command like that. I could be wrong though.

 

 

Mike Lowell added a handy Perl script to the Codeshare which watches a log file and can call a script if a specific string is found.

 

 

Action on Log

 

http://devcentral.f5.com/Wiki/default.aspx/AdvDesignConfig/ActionOnLog.html (Click here)

 

 

 

Perl script that runs as a daemon to watch a log file (like tail in the background), and runs a command when a certain message is found. Smart enough to keep working when log files get rotated, etc. Very handy when you need to run a command to start gathering debugging data or recover from failure that is indicated by a log message.

 

 

 

 

Aaron

Hi Aaron,

 

 

Thanks for your answer, i don't think user_alert.conf is used by syslog-ng, i think it's the part of the alertd daemon, but i don't find any documentation about it.

 

 

Romain

Of course you you're correct... sorry about the mis-statement. I still don't think you can call a shell script from the alert.conf/user_alert.conf though. But I think Mike's script should provide the functionality you're looking for.

 

 

Aaron

It's possible to call a shell script from alert.conf or user_alert.conf but the problem is to pass the log line in argument. I'm trying with the support.

 

Thanks

 

Romain

Sorry for the misinformation. That's a nice surprise. SOL9469 (Click here) describes the ability to run a shell script from the alert.conf or user_alert.conf files. I couldn't figure out a way to pass the original log message as an argument to the script though. If you don't get any suggestions here, you might try opening a case with F5 Support on this.

 

 

Aaron

 

 

Hi Romain,

 

 

Did you ever figure out how to pass details on the log message to the script?

 

 

Thanks,

 

Aaron

Did anyone ever determine whether it was possible to pass the log content on to the executed script?

Nope. Could you try opening a case with F5 Support to see if they have any recommendations? If you find out anything, could you reply back here for future reference?

 

 

Thanks, Aaron

You cannot pass anything from the message (at least I never found one after looking for quite a while). While you can have glob expressions for the pattern match, you can not alter the execution based on the pattern matched. Worse yet, you can only match the variable text of the message, so for those systems with multiple CPUs and the message is issued once for each CPU, the match will occur many times (12 times on a 11050 10.2.1 HF2 system). That means you have to deal with collision/race conditions on your own. Very sad!

 

 

This is a seriously needed utility and it should be able to 1) match the entire text string as an option, and 2) fork/exec commands passing the matched message as a parameter. Why it was so limited is beyond me - author didn't think far enough ahead. If I had access to the source code I'd have it fixed in no time ...

 

 

I wrote my own alertd-like Perl script because of such restrictions, but it was wandering a bit far from the "out of the box" configuration and was too confusing for others to grok. In my case, I was trying to take an action to alter a class when a pool had no members left. As such, hard coding the pool name in /config/user_alert.conf wasn't a big deal. (But the called code did need to deal with the collision/race conditions which opens a serious potential for error if things start flapping rapidly. :-()

 

 

Note that user_alert.conf is stat'ed every 10 seconds so there is no need to bounce alterd when changing the file, but by the same token, if you mess it up, alertd will go into a crash/restart loop, so be careful.

 

 

Also note that the F5 Support Center seems not to like alertd per SOL3727 - even more sad!!!

 

 

See:

 

http://support.f5.com/kb/en-us/solutions/public/3000/600/sol3667.html

 

http://support.f5.com/kb/en-us/solutions/public/3000/700/sol3727.html

 

http://support.f5.com/kb/en-us/solutions/public/12000/400/sol12428.html

 

 

Hi Ed,

 

 

I think this is all very good, useful feedback. I suggest you open a case with F5 Support to see if they'll create a few Request For Enhancements for these suggestions.

 

 

Aaron