<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=Content-Type content=text/html;charset=ISO-8859-1>
<META content="MSHTML 6.00.2800.1170" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY text=#000000 bgColor=#ffffff>
<DIV><FONT face=Arial size=2>The text string we are testing for is always there
unless an application, service, server</FONT></DIV>
<DIV><FONT face=Arial size=2>or network error occurs and </FONT><FONT
face=Arial size=2>I have verified that no error is not occuring. The only
difference</FONT></DIV>
<DIV><FONT face=Arial size=2>is now that the string is embeded in a very long
text line rather than a short line</FONT><FONT face=Arial size=2>. The
parser</FONT></DIV>
<DIV><FONT face=Arial size=2>seems to choke on the long line periodically.
</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>J.T.</FONT></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Jack@InnovativeInternet.com
href="mailto:Jack@InnovativeInternet.com">Jack Sasportas</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=jtmoore@international-auto.com
href="mailto:jtmoore@international-auto.com">J.T. Moore</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Cc:</B> <A title=sysmon-help@puck.nether.net
href="mailto:sysmon-help@puck.nether.net">sysmon-help@puck.nether.net</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, July 07, 2003 10:38
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [sysmon-help] Symon www
object response parser</DIV>
<DIV><BR></DIV>I would provide hidden text, meaning if your web page has a
white background put in something that WON'T change on that page in a white
font. I use things like server names to make sure apache is running on
that server etc. Also make sure it's not a series of words that may get
broken up by browser per say, try something like TEST-WORD. <BR><BR>Not sure
if that really solves the problem, but that text will always be
there.<BR><BR>Jack<BR><BR>J.T. Moore wrote:<BR>
<BLOCKQUOTE
cite=mid004101c34173$1f62d0c0$1500a8c0@domain.internationalauto.com
type="cite"><PRE wrap="">I have a question regarding how sysmon parses the response to
a www probe. We recently added some code to strip unnecessary
tabs and crlf's from the dynamic content generated on our web site.
Since then sysmon has been periodically reporting false positive
failures for the www probe monitoring the site.
What is odd is that the failures are intermittent rather than persistent.
The text that was being searched for is towards the end of the document,
but not at the very end. I have verifyed that the text string is present in
the document as it is in the sysmon.conf file and the web logs indicates
response status 200 for all of the hits from sysmon which occur approximately
once per minute which is the sysmon poll interval.
I changed the text the probe was searching for to "</body></html>"
which is at the very end of the document which seems to have fixed
the problem.
We are currently using sysmon v0.91.12
Any ideas/insights are appreciated.
Thanks,
J.T.
</PRE><PRE wrap=""><HR width="90%" SIZE=4>
_______________________________________________
Sysmon-help mailing list
<A class=moz-txt-link-abbreviated href="mailto:Sysmon-help@puck.nether.net">Sysmon-help@puck.nether.net</A>
<A class=moz-txt-link-freetext href="http://puck.nether.net/mailman/listinfo/sysmon-help">http://puck.nether.net/mailman/listinfo/sysmon-help</A>
</PRE></BLOCKQUOTE><PRE class=moz-signature cols="80"> </PRE></BLOCKQUOTE></BODY></HTML>