Custom Notifies

[Sagi Brody]

Jeremy,
	Great suggestion, I've used this system and its working
perfectly!


Another question - Can I use any of the argus CLI tools to validate a
service?

I have an interface that allows me to add/remove/modify service
definitions, which then builds the argus config file. Instead of having to
reload argus to verify all the services are defined/working properly, is
there anyway I can pass a config snippet to argus and see if it detects
the service is up/down?


Thanks,

----------------------------------------
Sagi Brody
Webair Internet Development, Inc.
Phone: 1 866 WEBAIR 1
Fax: 516.938.5100
http://www.webair.com
sagi at webair.com
AIM: webairsagi
ICQ: 146240554
----------------------------------------
We are interested in any feedback you might have about the service
you received. Please contact our technical support consumer care manager
directly 1.866.WEBAIR1 or e-mail customercare at webair.com
----------------------------------------


On Fri, 18 Jul 2008, Jeremy Kister wrote:

> On 7/15/2008 3:49 PM, Sagi Brody wrote:
> > However, I'll probably be using 1 generic "service Prog{.." type service
> > to execute a script to contact the server to check if sees anything is
> > down. I'd like the unack page to actually display details obtained from
> > the program. How can I do this?
>
> not tested:
>
> ### on server being monitored:
> echo "anotify	6969/tcp # for argus notifications" >> /etc/services
> echo "anotify stream tcp nowait nobody /usr/bin/cat /usr/bin/cat
> /tmp/notify.argus" >> /etc/inetd.conf
> kill -HUP `ps -ef | awk '/inetd/ { print $2 }'
>
>
> ### in argus config:
>     Service TCP {
>      hostname: remote_server_name_or_ip_address
>      label: local_notifies
>      port:  6969
>      uname: local_notifies
>      nexpect: ALARM:
>      pluck:   ALARM:(.+)
>      messagedn: %o{ip::hostname} says: [%v]
>     }
>
> argusctl hup
>
>
> # after argus has reloaded, on the client machine, do something like
>
> echo "ALARM: my head hurts" >> /tmp/notify.argus
>
> # this should make argus send you a page that looks like
> 10000 1/Jul 00:00 - machine says: [my head hurts]
>
>
> # and a few minutes later
>
> rm /tmp/notify.argus
>
> --
>
> Jeremy Kister
> http://jeremy.kister.net./
>
> _______________________________________________
> http://argus.tcp4me.com/
> Arguslist at tcp4me.com
> http://www.tcp4me.com/mailman/listinfo/arguslist
>