On Fri, May 12, 2006 at 02:21:27AM +0000, David Gore wrote:
Are there plans to support regular expressions in the client-local.cfg
for hostname, log, file, ignore, and trigger?
"hostname" is not used in client-local.cfg
"log" and "file" : No, use the script-method to get those filenames
(more below).
"ignore" and "trigger": The strings you put into the client-local.cfg
are regular expressions.
It is not clear what
support there is for regular expressions, perhaps it is already there
for ignore, and trigger, but not log, file or the hostname?
Exactly.
I am not sure I can do this:
file:"mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.`date +%Y%b%d`"
No, you cannot combine it like that. Use a command to generate the full
filename.
But let's assume I can or even that the whole file name has to be a
command in back ticks. Do you then put the exact same back ticked
string in hobbit-clients.cfg?
FILE "mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.`date
+%Y%b%d`" mtime>900 yellow
No.
The way it works is that the client decides what the actual filenames
are (the Hobbit server cannot do that, because it depends on client-side
data - e.g. what's the output from a command you run on the client).
So the client sends some real filenames back to the server, and those
filenames are then matched against the expressions in hobbit-clients.cfg.
So in your case, client-local.cfg would be
file:`/usr/local/bin/list_snmp_logs`
and hobbit-clients.cfg could be
LOG %mci-nornxdb0[1-6].SNMP_COMMUNITY.public.nxg21:SIG_SNMP.*
Regards,
Henrik