LOG alert not showing yellow

Try using this syntax (changing space with \s + pcre)
        LOG     /var/log/messages       %authentication\sfailure  color=yellow

Giovanni M. Frainer - Gestor


Sello Tlabela (SD) wrote:

Hi Manocchia,

 
It could be access rights, if you are running hobbit using the init script it will run as user hobbit and make sure that hobbit user can read /var/log/messages

 
Regards

 
Sello Tlabela

 
*From:* Manocchia, Robert [mailto:user-615a9b935f98@xymon.invalid]
*Sent:* 05 June 2007 21:38
*To:* 'user-ae9b8668bcde@xymon.invalid'
*Subject:* [hobbit] LOG alert not showing yellow

 
I have a small problem. I've set up monitoring of the /var/log/messages logfile to search for the string "authentication failure" and alert with a yellow button in the MSG column. I can see the error displayed when I click on the button below the Msg column header but it does not turn yellow.

 
 Below is the entry in the clients-local.cfg file:

 
[batman]

log:/var/log/messages:10240

ignore MARK

 
This is the entry in the hobbit-clients.cfg file:

 
HOST=batman

        LOG     /var/log/messages       authentication failure  color=yellow

 
Why doesn't this give me a yellow alert.

 
 Thanks

 
Robert Manocchia

UNIX System Administrator

IDEXX Laboratories

XXX XXX-XXXX

EMail user-615a9b935f98@xymon.invalid

 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~