...
| Code Block |
|---|
'opevents_logs' => {
# parsertype => list of logfiles (or dirs for nmis_json_dir)
# natively supported: tivoli_log, cisco_syslog, nmis_traplog,
# nmis_eventlog, nmis_slavelog and nmis_json_dir
'cisco_syslog' => [ '<nmis_logs>/cisco.log', "/some/other/log.file" ],
'tivoli_log' => [ '<nmis_logs>/tivoli.log' ],
'nmis_traplog' => [ '<nmis_logs>/trap.log' ],
'nmis_slavelog' => [ '<nmis_logs>/slave_event.log' ], ### DEPRECATED - now uses below parser
'nmis_pollerlog' => [ '<nmis_logs>/poller_event.log' ],
'nmis_eventlog' => [ '<nmis_logs>/event.log' ],
# attention: json logs in this directory are REMOVED after consumption
# 'nmis_json_dir' => [ '<nmis_logs>/json' ],
},
|
...
A generic extensible parser rule can invoke one or more parser plugins using the action directive plugin(PluginName).
e.g. JSON example
| Code Block |
|---|
"42" : {
"IF" : "Node Down",
"THEN" : "plugin(PluginName)"
}, |
When such a plugin call directive is encountered for the first time, the opEvents daemon loads (and caches) all available plugins that meet the requirements. To reread modified plugins, opeventsd must be restarted.
...