How to disable log check

[wouterve]

Hi,

How can I disable certain log checks? For one host I always get these CRIT warnings:

I’d like to disable these warnings to make my log clutter free (FYI: the host is a meeting room PC so not critical).
I already checked the parameters settings but cannot find this kind of warning.

kr

Wouter

[Kruzgoth]

Hi wouterve,

i have some questions:

• Do you mean to disable the checks itself? If yes, there is a rule “Disabled checks/services”.
• Do you not want to get this information at all? Then you can disable the agent section which provides these information “Disable agent sections”
• Do you just want to ignore those specific log-errors? Then “Logwatch Patterns” could help you.

If your requested answer isn’t in there, please be more specific with what you want.

Sincerely Kruzgoth

[wouterve]

Thanks for your answer.

Well I’ll explain what I want to achieve:

We have some meeting room PC’s for which we want to monitor the used hard disk space. So I’ve created a rule which creates an alert when Filesystem c: is >90% full.
We don’t want to see any other alerts (host is down + log warnings from my first post) for these hosts.
Maybe with this addition information you can make a suggestion? I’ve checked your 1st & 3rd option but it seems to me you have to create a rule for each unwanted alert.

Can you also explain where I can find the 2nd option (ie Disable agent sections)?

kr

Wouter

[rprengel (Ralf Prengel)]

Hallo,
hope this helps.
We are using tags to mange which logfiles should be monitored.
Ralf

[Kruzgoth]

Hey wouterve,

if you only want to monitor the filesystems at these hosts, you can use the “Disabled services” rule with a negated “Service”-filter, so that each service beside ‘filesystem’ gets disabled.
That way you should only be able to see the filesystem-services at these hosts and there only get those notification.

[wouterve]

Hi,
thanks for your suggestion. I’ve created a disabled service rule and now these warnings are gone.

But I still have one CRIT warning regarding ping left:

Do I disable this for ping specific or can I also apply a similar method like disabled service rule?

kr

Wouter

[Kruzgoth]

Hi wouterve,

i think you made a mistake in your “Disabled services” rule, because you set a check name as a service filter. “df”-Checks always start with “Filesystem”, so i would recommend “^Filesystem.*” instead of “check_mk-df”

Currently because of your rule, you completly disabled any service at this host and because of that, you got a ping service instead, because each host needs at least one service.

If you have fixed that, you can use the rule “Host Check Command” to “Always assume host to be up”, so that you won’t get any notification related to the host. I don’t know why you want that, but that would work.

Sincerely Kruzgoth

[wouterve]

Hello,

OK thx for your correction. I’ve changed it accordingly:

How can I find the correct name of the service, is there a list available?

I’ve created a host check command also:

The point of this last rule is to eliminate warnings when the computer is shut down. After all, it isn’t a critical server but only a PC in the meeting room.

kr

Wouter

[Kruzgoth]

@wouterve

How can I find the correct name of the service, is there a list available?

Take a look in “WATO Configuration” → “Check Plugins” → Search for “df” and click on “Used space and inodes in filesystems”. This is the man-page of the filesystem (df) check. For every check, there is such a man page (normaly), where everything is explained including “Service name”.
Like this; the blank is a space holder for the name of the filesystem check_mk found

[wouterve]

OK I’ve found it. I’m new to check_mk, still learning the basics of it

So to set a filter (like ^Filesystem.*) you use a regex?

kr
wouter

[Kruzgoth]

Correct. You can use the help at the top right to get helps for many elements in the check_mk gui.

But you don’t need to use the “.*” at the end, because Check_MK does that automaticly here.

[wouterve]

OK thanks a lot for your explanation, I’ve learned a lot more about check_mk !

kr
Wouter