Werk 15307 was adapted. The following is the new Werk, a diff is shown at the end of the
message.
Title: logwatch_ec: tcp remote forwarding: create one spool file per service
Class: fix
Compatible: compat
Component: checks
Date: 1699863833
Edition: cre
Knowledge: doc
Level: 1
Version: 2.1.0p37
This Werk affects you if you have a logwatch_ec check which forwards events to
a remote syslog hosts and if you activated the option "Create a separate check
for each logfile".
In this case all separate services shared one spoolfile. This lead to the
problem, that one event in the spoolfile was displayed as one event for each
separate service (but it was only sent out once, when the remote was reachable
again).
In some conditions events might been unnoticeable dropped, because the
spoolfile was overwritten by another logwatch service.
Now each logwatch service will have their own spoolfile.
The spoolfiles will be automatically assigned to their logwatch service.
After all your logwatch_ec services sent all their spoolfiles out, you may
manually consult the following folder for <tt>spoolfile.*</tt> files:
<tt>./var/check_mk/logwatch_spool/<hostname></tt>
If there are any spoolfiles in this folder, they could not be assigned to a
logwatch service. If you still want them to be forwarded, move them to one of
the folders, otherwise they can be deleted.
<tt>./var/check_mk/logwatch_spool/<hostname>/item_<url_encode(item)></tt>
------------------------------------<diff>-------------------------------------------
Title: logwatch_ec: tcp remote forwarding: create one spool file per service
Class: fix
Compatible: compat
Component: checks
Date: 1699863833
Edition: cre
Knowledge: doc
Level: 1
Version: 2.1.0p37
This Werk affects you if you have a logwatch_ec check which forwards events to
a remote syslog hosts and if you activated the option "Create a separate check
for each logfile".
In this case all separate services shared one spoolfile. This lead to the
problem, that one event in the spoolfile was displayed as one event for each
separate service (but it was only sent out once, when the remote was reachable
again).
In some conditions events might been unnoticeable dropped, because the
spoolfile was overwritten by another logwatch service.
Now each logwatch service will have their own spoolfile.
The spoolfiles will be automatically assigned to their logwatch service.
After all your logwatch_ec services sent all their spoolfiles out, you may
manually consult the following folder for <tt>spoolfile.*</tt> files:
<tt>./var/check_mk/logwatch_spool/<hostname></tt>
If there are any spoolfiles in this folder, they could not be assigned to a
logwatch service. If you still want them to be forwarded, move them to one of
- the hash folders, otherwise they can be deleted.
? -----
+ the folders, otherwise they can be deleted.
-
<tt>./var/check_mk/logwatch_spool/<hostname>/<<sha1_hash_of_item></tt>
? ^ ^^^^ ^^^^^ ^^
+
<tt>./var/check_mk/logwatch_spool/<hostname>/item_<url_encode(item)></tt>
? ^^^^^ ^^^ ^^^ ^^^ +