On Tue, Feb 13, 2007 at 11:50:48AM -0600, Bill Hart wrote:
HOST=hobbit
PROC arpwatch 1
LOG /var/log/messages "arpwatch" COLOR=yellow
The PROC line works fine, but the LOG seems to be ignored.
My immediate thought is that this ought to work, but testing it I can
see that it doesn't - there might be a bug there with the simple string
matching.
However, using a regular expression does work. So your LOG entry could
be written as
LOG /var/log/messages %arpwatch COLOR=yellow
and you'll get the result you want.
Regards,
Henrik