dump cacti alert into a log file

[Gatorz]

is there anyone knows how to create a log from cacti alert ?

[TheWitness]

You need to be more specific. The answer is a qualified yes.

[Gatorz]

every time cacti create an alert . i want a log from that.

[TheWitness]

What type of alert and from what? Like I said, the question is too general. I'm assuming you know little of Cacti.

[Gatorz]

All alert that come from threshold violation.
like High CPU, High memory.
currently the cacti only send email, i want it also every alert cacti create the log for it.

[Gatorz]

i mean cacti create the eventlog

[TheWitness]

You mean 'Windows' eventlog? It's automatic, you simply enable the syslog component and check the checkbox to do the logging that way Console->Settings->Thresholds

TheWitness

[Gatorz]

no

i had cacti.
every violation on Cacti threshold it will be create an event then escalate trough the email. instead email escalation i want Cacti to forward the event trap into another server.

i want to run a script to forward that event into another system. the easy way to do is to read from Cacti event log.
or i run another batch file like

send " others server " EVENT, Event_Message, Timestamp, Severity

is it possible to do that ?

[noname]

i want to run a script to forward that event into another system. the easy way to do is to read from Cacti event log.
or i run another batch file like

send " others server " EVENT, Event_Message, Timestamp, Severity

is it possible to do that ?

Thold plugin can't send the alert via other than mail. (yet?)
But (as TheWitness said) it can record its behavior to cacti.log or syslog.

So you may create a script which is invoked periodically (e.g. crontab) so that can read these log files and send alert to another server.

Otherwise, some syslog daemons (e.g. syslog-ng) can forward its records to another syslog server, and also can execute a script when its record has strings with specific pattern.

For example:
% cat /usr/local/etc/syslog-ng.conf

Code: Select all

...
source s_all {
	internal();
	unix-stream("/dev/log");
};

filter f_check {
	match("some pattern");
};

destination d_check {
	program("/usr/local/bin/check.sh");
};

log {
	source(s_all);
	filter(f_check);
	destination(d_check);
};
...

% cat /usr/local/bin/check.sh

Code: Select all

#!/bin/sh

while read MSG; do
	echo $MSG >> /var/log/check.log
	echo $MSG | /usr/bin/mailx -s "pattern found" somebody
	/usr/local/bin/snmptrap -v1 community host trap-parameters
done

exit 0

[TheWitness]

As I attempted to articulate and noname reduced to the absurd ('reducio ad absurdum'), you simply log the events to syslog and then forward Cacti's Syslog to your remote system. This has been supported in thold for years.

TheWitness