Not getting alerts for log entries on Solaris 10 Update 3 (SPARC)

Kenneth Bourn wrote:

I am having issues with getting Hobbit to report log entries from client log files.  The server is getting the log data but, despite a valid string entry in the log file, no alerts are generated.

Here is an excerpt from my client-local.cfg file:

[hosta-z1]
log:/var/adm/messages:10240

And a corresponding entry from the hobbit-clients.cfg file:

HOST=hosta-z1
    LOG /var/adm/messages sshd COLOR=red

Have you tried this (turn off case insensitive matching):

	LOG /var/adm/messages %(?-i)sshd COLOR=red


Dominique
UNIL - University of Lausanne