CaMM (Cacti Message Management) plugin v1.6.7 2010-08-26

[pthaynes]

I just noticed. Each time I look at the syslog tab in CAMM it now shows the left pane as being too wide (I have to scroll across to the right a couple of times to find the divider between the two panes and resize). Just to make it a bit clearer below is a picture of what I am seeing.

Not a high priority (I'll take a look through the code a little later and see if I can find the issue).

Regards,

Peter

[gthe]

Thanks for bug report.

It is IE (f**k) bug only. Will try fix it.

[mcutting]

Email is now broken in new version of CAMM (see screenshot). As I can no longer suffix the last address with ";" the email fails. Using a single address works fine.

I also can't use "," either ?

[mcutting]

Looks like this is a bug in the JSON code. If I change the mail recipients via phpmyadmin to a@b.com,b@b.com,c@b.com it works.

If I leave them as a@b.com;b@b.com;c@b.com it doesn't work. I also cannot use "," in the JSON window, but CAN use ";".

Can we get this fixed ?

Thanks

[gthe]

mcutting, Try this and press CTRL+F5 to update FF cache

[mcutting]

mcutting, Try this and press CTRL+F5 to update FF cache

Works great - thanks

[gthe]

New version in first post

CAMM --- 1.6.2 ---2009-07-23

• - Added new config in startup settings - [Startup tree menu width];
  - Added possibility of creating of the menu on the basis of markers in rule. For use - check new config option in - Settings tab - [Create tree menu for Markers ?]

See screenshots..

I just noticed. Each time I look at the syslog tab in CAMM it now shows the left pane as being too wide (I have to scroll across to the right a couple of times to find the divider between the two panes and resize). Just to make it a bit clearer below is a picture of what I am seeing.

Not a high priority (I'll take a look through the code a little later and see if I can find the issue).

Regards,

Peter

Fixed.

When I put in a number and run a rule that does match something in syslog I don't notice any difference in what is shown in syslog. What is this function intended for?

I was assuming that the Mark would either create a new folder under that host on the Syslogs with that Mark OR would change something in the description or message tab.

Thanks again for a great plugin.

Done.

[pthaynes]

GTHE

The column with looks fine to me in the new version. The marking is excellent too. Am I right in guessing that a star in the "Alert" column means that the syslog entry has not yet been processed by a rule?

I also noticed an evelope icon in the alert column for one of the entries in syslog. I have not yet created any email rules on the machine I am testing the new version on, so I was just wondering what that icon represents.

Thanks again for all your work on CAMM. It has turned into a very powerful tool.

Regards,

Peter

[gthe]

GTHE

The column with looks fine to me in the new version. The marking is excellent too. Am I right in guessing that a star in the "Alert" column means that the syslog entry has not yet been processed by a rule?

You are right.

I also noticed an evelope icon in the alert column for one of the entries in syslog. I have not yet created any email rules on the machine I am testing the new version on, so I was just wondering what that icon represents.

Thanks again for all your work on CAMM. It has turned into a very powerful tool.

Regards,

Peter

Marker maximum value = 100. Rule id (auto increment) starts from 100. So if alert field in record has value > 100 - it is not marked, but been processed by rule (email or function). Possibly just bad picture - it was installed when the functions of the rules was just e-mai

[L0gRuS]

Hi.
Today try create rule for e-mail notification and have problem

When i try write to e-mail login any e-mail i see warning icon and cant create rule


CAMM ver 1.6.0

[mcutting]

This has been resolved in the latest version.

[pthaynes]

Thanks again for the latest version - all the features I use work as advertised. I do have one question - is there an easy way to create some sort of rule processing order?

I have rules that send emails for all err crit warning and emerg syslog messages. I have some rules to delete purely cosmetic errors with those priority types. There are some syslog entries with those priorities that I would like to keep in my database, but not receive emails for. One example is the link-3-updown messages from my Cisco switches. Is there a way that I can create a rule that will flag the syslog to be ignored? I tried using a "Mark" type rule, but the syslog entry still gets processed by the email rule. There are a few different types of syslog entries that I want to be ignored by the email rules, so I would prefer to have a separate rule to flag the syslog entry as ignored rather than have a "not" type entry on the main email rule.

My initial thought was that maybe we could get an entry added to the filter parameter of a rule so that we could select entries that were not marked by another rule and then run the "Mark" rules first.

Does that sound logical?

I would also like to be able to filter on the "template type" of the host if that is possible. We are using the template type to make the CAMM tree structure more logical (ie we have different templates for the different functions of switches - "core switch" "access switch" "test switch" etc). If we could filter on the template type then we could easily make sure that we only email for syslog messages on switches that are important.

Thanks in advance for any help. I really appreciate your work on this plugin.

Regards,

Peter

[gthe]

pthaynes,
I hardly understand your proposal. If you want to ignore some of the recording, so you can create a request with the conditions for their selection. If it is possible to create such a request, then you can create a query that will select all the conflicting entries.
Ie:
ingore "A" == not "A" in query.
Maybe I just need to see a few lines of records and set an example - which lines to ignore, and which must be processed.

But I agree that the creation of an additional field - the order of rules - a good idea.

[pthaynes]

pthaynes,
I hardly understand your proposal. If you want to ignore some of the recording, so you can create a request with the conditions for their selection. If it is possible to create such a request, then you can create a query that will select all the conflicting entries.
Ie:
ingore "A" == not "A" in query.
Maybe I just need to see a few lines of records and set an example - which lines to ignore, and which must be processed.

But I agree that the creation of an additional field - the order of rules - a good idea.

Sorry about my explaination (and the long post below). What I am trying to acheive is to filter out a number of different syslog entries, so there are two different alternatives -
1) I could create one complex rule that sends an email for syslogs except when they contain any of a list of text strings.

2) I could create a number of separate rules, each with a separate match criteria that would mark some syslog entries so that they could be ignored by the email rule that I would put at the end.

I figured option 2 would make my CAMM rules a bit clearer (I'm tasked with setting the system up, but someone else will end up maintaining it). It would also mean that I could create a single rule with an email address in it so that there is only one place that email addresses need to be updated.

Below is an example of some rules I would use:

Code: Select all

Rule 1
Name: MARK Access switch 1 Link-3-updown
Action: MARK (Marker number 1 and Marker name ignore)
SQL Query: (((facility='local7' AND priority='err') AND message like '%LINK-3-UPDOWN%' ) AND host='192.168.1.1')

Rule 2
Name: MARK Access switch 2 Link-3-updown
Action: MARK (Marker number 1 and Marker name ignore)
SQL Query: (((facility='local7' AND priority='err') AND message like '%LINK-3-UPDOWN%' ) AND host='192.168.1.2')

Last Rule
Name: EMAIL err syslogs
Action: EMAIL
SQL Query: (priority='err' AND mark<>'ignore')

Below is an example of the database record for a message I would like to ignore if it is from an access switch (I'd like to get a syslog if that same syslog message was sent from a different type of switch):

Code: Select all

mysql> select facility,priority,message from plugin_camm_syslog where message like '%LINK-3-UPDOWN%' limit 1;
+----------+----------+----------------------------------------------------------------------------------------------+
| facility | priority | message                                                                                      |
+----------+----------+----------------------------------------------------------------------------------------------+
| local7   | err      | 17: Jul 24 14:22:44.633 AEST: %LINK-3-UPDOWN: Interface FastEthernet0/2, changed state to up |
+----------+----------+----------------------------------------------------------------------------------------------+
1 row in set (0.01 sec)

Now the second part of my request is related to the first. I have a large number of access switches, routers and core switches. I'd like to be able to ignore certain syslogs (like the one above) but only if they come from certain types of device. I already "group" the devices using the template type (I have a template called "Core switch", one called "Access switch", one called "Distribution switch" one called "WAN Router" etc etc).

What I would like is to be able to make my rules select hosts based on their template. Something like this:

Code: Select all

Name: MARK Access switch Link-3-updown
Action: MARK (Marker number 1 and Marker Name ignore)
(((facility='local7' AND priority='err') AND message like '%LINK-3-UPDOWN%' ) AND hosttemplate='Access switch')

So in summary the changes that would need to be made to make this all work are:
1. Allow changing the order that rules are processed in
2. Add in another criteria in the rules that allow you to select records based on their "Mark" attribute.
3. Allow rules to select hosts based on their template.

I am guessing that this work is non-trivial, and I am greatful for any work you do on it. I am quite willing to do some or all of the coding, but please bare in mind that I am not a read coder.

I figure I'll take a look at your code and do a little work on the third item in the list above. Let me know if you would like me to work on the code or not (I know that sometimes it is a lot easier to code it right the first time rather than debug someone else's work).

Once again thanks for all your work.

Regards,

Peter

[gthe]

So in summary the changes that would need to be made to make this all work are:
1. Allow changing the order that rules are processed in

this is already planned

2. Add in another criteria in the rules that allow you to select records based on their "Mark" attribute.

technically it is also possible, although the markers were designed not to do so may have to impose additional, similar setting - ie, need to analyze

3. Allow rules to select hosts based on their template.

This will add pressure on the database. But I recheck.

Below is an example of some rules I would use:

Code: Select all

Rule 1
Name: MARK Access switch 1 Link-3-updown
Action: MARK (Marker number 1 and Marker name ignore)
SQL Query: (((facility='local7' AND priority='err') AND message like '%LINK-3-UPDOWN%' ) AND host='192.168.1.1')

Rule 2
Name: MARK Access switch 2 Link-3-updown
Action: MARK (Marker number 1 and Marker name ignore)
SQL Query: (((facility='local7' AND priority='err') AND message like '%LINK-3-UPDOWN%' ) AND host='192.168.1.2')

Last Rule
Name: EMAIL err syslogs
Action: EMAIL
SQL Query: (priority='err' AND mark<>'ignore')

Perhaps that the problem can already be solved in this way:

In any case - thank you for your interest in my plugin - You help make it better