Kenneth Bourn wrote:
Dominique,
I tried this and am now getting alerts! Is there a known issue where I can't just specify the string I want and expect it to be searched exactly as I have it entered in the hobbit-clients.cfg file? Turning off case insensitive matching works...
Thanks!
-Ken
Dominique Frise wrote:
Kenneth Bourn wrote:
I am having issues with getting Hobbit to report log entries from client log files. The server is getting the log data but, despite a valid string entry in the log file, no alerts are generated.
Here is an excerpt from my client-local.cfg file:
[hosta-z1]
log:/var/adm/messages:10240
And a corresponding entry from the hobbit-clients.cfg file:
HOST=hosta-z1
LOG /var/adm/messages sshd COLOR=red
Have you tried this (turn off case insensitive matching):
LOG /var/adm/messages %(?-i)sshd COLOR=red
Dominique
UNIL - University of Lausanne
Hobbit defaults to case insensitive pattern matching.
See man hobbit-clients.cfg(5) for details.
Dominique
UNIL - University of Lausanne