Re: matches=0 still triggers action

[kmatthews]

This also works:

To get mail if more than 2 kjournald processes are running, but take no
other action:

"kjournald"
matches=<2
inform=true

Actually, 9 instances of kjournald are running so I get this mail:
cfengine:myhost01: 9 processes matched kjournald (should be <=2)

If I set it to:
matches=<10

then I get no mail.


Brendan Strejcek wrote:
> Okay, after reading this message I decided to try a few processes
> statements to look for and warn about processes. I don't want cfagent
to
> do anything in response to them, just to warn about them, but I can't
> get it to behave in the way that I want. For example, I want to know
if
> more than 6 ssh-agent processes are running (but I don't want any
mail
> sent if the number is 6 or less). I'm using sleep rather than
ssh-agent
> for ease of testing. This is what I have:
>
>     processes:
>         "sleep" matches=<6 action=warn inform=off
>
> However, this produces output summarizing all the running processes
that
> match the sleep regex even when there is less than six. When there
are
> more than six, I get an additional message like:
>
>     a: 8 processes matched sleep (should be <=6)
>
> so I know I have the logic right. So how do I get cfagent to shut up
> unless the criteria is met?
>
> I've tried this both with inform on and off. And I've tried with a
> define= and an alert (which is much easier to read since it doesn't
> stick the ps header in for every process cited but seems to have the
> same problem).
>
> Should I be using a filter here? It seems like overkill. Or do I want
> action=bymatch ... the ref says: "If the option is set to bymatch,
then
> signals are only sent to the processes if the matches criteria fail"
...
> which sounds like exactly what I want (that is the part about only
doing
> something if "the matches criteria fail") but I only want to warn,
not
> send signals.
>
> Ah, that's the trick. So, if action=bymatch, and no signal is
specified,
> cfagent warns. Though I can't get it to produce the process listing
as
> with action=warn, all I get is the one line like:
>
>     a: 11 processes matched sleep (should be <=6)
>
> So in the process of writing this I (sort of) solved my own problem,
> but it seems like this might be a common thing to want to do and it
is
> not clear in the ref, so I'm going to go ahead and send it anyways.
>
> Oh, and the define= seems to be triggered if any processes are found,
> not respecting the matches= parameter. So using alerts with processes
> does not work very well.
>
> Comments?
>
> Sven Mueller wrote:
>
> > David E. Nelson [u] wrote on 02/11/2004 14:57:
> > >Hi All,
> > >
> > >I've the following stanza in my cfengine-2.1.10 cfagent.conf file:
> > >
> > >solaris.externalnets::
> > >
> > >         "lpsched$" # External systems do not run print services
> > >             matches=0
> > >             action=bymatch
> > >             restart "/etc/init.d/lp stop"
> > >
> > >and even though 'lpsched' is not running, cfengine still attempts
to stop
> > >printing services.
> >
> > That's exactly what you are telling cfengine to do. "restart" is
> > executed whenever the number of processes is either 0 or you sent a

> > sigkill or sigterm to the process(es) via the signal option. Don't
use
> > it to stop a process.
> >
> > What you are trying to do is probably this:
> >
> > solaris.externalnets::
> >     "lpsched$"
> >     matches=0 # warn if a process was found
> >     signal=kill # it shouldn't be running at all,
> >                 # so the "hard" kill is OK.
> >     action=signal # the default, anyway: Send signal
> >                       # action=warn wouldn't send a signal.
> >     # if you list the "restart" option here, cfengine would
> >         # do the following three things on each run:
> >         # 1) warn if at least one process was found running
> >     # 2) kill any running process
> >     # 3) run whichever command you specify in the "restart"
> >     #    option
> >
> > Read the doc about the processes section again ;-)
> >
> > cu,
> > sven
> >
> >
> > _______________________________________________
> > Help-cfengine mailing list
> > Help-cfengine@gnu.org
> > http://lists.gnu.org/mailman/listinfo/help-cfengine
> >