MTIME - File Monitoring 🔗 link

Hi,

I am trying to monitor files which should NOT be modified.

If have the MTIME parameter setup as follows:

FILE    /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>86400 red

This basically means that if the file is modified within the last 24 hours,
it should go red...

It never goes to any other status other than green.

I also have the /etc/passwd entry in the clients-local.cfg file as well\

Any Ideas?

So Ive solved my own problem...

For some reason, the order in whchi you specify tags in the
hobbit-client.cfg matters....

My original line was as follows:

FILE    /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 MTIME>360 red

The one that works is

FILE    /etc/passwd TYPE=file MODE=644 MTIME>360 OWNER=0 GROUP=0 red

The only change was putting the OWNER and GROUP attributes at the
end...once there it worked like a charm..

Can anybody explain this?

Hi,

maybe  you want to add MD5 to your file section?
FILE /etc/passwd MD5=<value from md5 /etc/passwd>
This covers every change

greetings
Rolf Schrittenlocher

-- 

Mit freundlichen Gruessen
Rolf Schrittenlocher

Bitte beachten Sie die neue Emailadresse!

HeBIS-IT, Senckenberganlage 31, 60054 Frankfurt
Tel: (XX) XX - XXX XXXXX   Fax: (XX) XX XXX XXXXX
LBS: user-1e39a1813094@xymon.invalid
Persoenlich: user-ea9d95bffcf0@xymon.invalid

Yes but that would require me to change the MD5 hash everytime the file
changes...This would take alot of effort across 100 servers....

THe MTIME is ok because i can reset the alert and still get notified...

Michael S. Fisher
ISD | Active Directory Support
user-ab09d151b26b@xymon.invalid
+X XXX XXX XXXX