haloe and removal rules

renen · Joined: 09 Feb 2006 Posts: 5

I' m using cacti v0.8.6i and haloe v0.4

Syslog is working fine, but the removal rules are only executed on creation.
One of the removal rules is:
poller.php Message Contains /usr/sbin/cron[%]:%/poller.php.
When I create the rule all messages containing /usr/sbin/cron[%]:%/poller.php. are deleted, but new messages containing this text not !
Also when creating a new dummy rule the messages get deleted.

Thanks

egarnel · Posted: Wed Nov 15, 2006 8:22 am Post subject:

try eliminating the special characters from the "Contains" filter

just use poller.php as the regex

renen · Joined: 09 Feb 2006 Posts: 5

Even when i delete all special characters the removal doesn't work.
Only when I add or delete a removal rule, all removals work.

How is the removal tool being scheduled ?

cigamit · Posted: Mon Nov 20, 2006 9:43 pm Post subject:

The removal rules are processed when it moves the messages from the syslog_incoming to the syslog table (its faster to run it on the small amount of data, then on the entire massive syslog table again). Certain people have setup it to log directly to the syslog table, which negates the alerts and removal rules completely.