Spinning up the learning curve

[wyoder]

We are in the process of trying to sell Nagios Logserver to upper management and want to provide a whiz-bang demo in early April. Having watched the helpful YouTube Webinar 3 times from Shamas, having studied the Analyzing-Logs-With-Nagios-Log-Server.pdf document, and having deployed and used the trial copy, we still have some newbie questions.

For starters:

• Is there a configurable way to page through the events table? I see left/right arrows to page 50 at a time (out of 250), but when that table gets really LARGE, is there a quicker way to navigate the table?
• Is there a way to specify a 'FIELD=VALUE" filter? I know about "Must and "Must not", but would like to be able to specify filters like "hostname = sys-05" and "timestamp < March 14".

Thanks much,
--Bill

[hsmith]

Hi Bill,

If you have not yet had one, I think signing up for a Quickstart may be ideal for you guys. This is a session where you spend one hour with one of our technicians, and ask any questions, and go over any issues that you may be having. This could better prepare you for presenting the product to management.

Is there a configurable way to page through the events table? I see left/right arrows to page 50 at a time (out of 250), but when that table gets really LARGE, is there a quicker way to navigate the table?

I think the solution here is to query for the information you're looking for, or filter out the information you are not interested in.

Is there a way to specify a 'FIELD=VALUE" filter? I know about "Must and "Must not", but would like to be able to specify filters like "hostname = sys-05" and "timestamp < March 14".

Can't you do this with Must and Must not? Maybe I'm not understanding the question correctly, but something like this:

field: must
field: program
query: "sshd"

Shows me only results from the sshd program. Let me know if I'm not understanding your question correctly.

[wyoder]

Hi, hsmith:

Thanks for your helpful response. The good news is that due our enthusiastic cheerleading, management has approved a license, at least for a single node instance.

We'll definitely sign up for a Quickstart session, assembling our newbie questions beforehand. Looking forward to working with your team.

Please close this support case at your convenience.

Bill Yoder
Clinipace Worldwide.