FILE monitor and mtime<600 troubleshooting

11 messages in this thread

list Denver Osborn · Fri, 18 Jul 2008 07:36:29 -0500 ·

Hi,

I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.

Here's my hobbit-client.cfg entry:

CLASS=classname
         FILE /etc/sudoers yellow mtime<600

The client-local.cfg entry:

[classname]
file:/etc/sudoers


Has anyone else seen this before or have any advice on how to troubleshoot?


Thanks,

Denver Osborn

list Michael Nemeth · Fri, 18 Jul 2008 08:52:21 -0400 ·

What your OS ?
I and some one else have had problems too, me Sol 2.9 they on Sol 10.

Work on a different  hobbit  install under  Sol 2.8

▸ quoted from Denver Osborn

.
Denver Osborn wrote:

Hi,

 
I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the FILE monitor to work. I've added the required file: entry in the client-local.cfg for the host, then put the FILE directive in the hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up the new file and shows it as 'green'. When testing the monitor by changing the mtime of my file, hobbit doesn't alert on the change.

 
Here's my hobbit-client.cfg entry:

 
CLASS=classname

         FILE /etc/sudoers yellow mtime<600

 
The client-local.cfg entry:

 
[classname]

file:/etc/sudoers

 
Has anyone else seen this before or have any advice on how to troubleshoot?

 
Thanks,

 
Denver Osborn

list Greg L Hubbard · Fri, 18 Jul 2008 08:27:31 -0500 ·

Well, I use HOST=hostname in hobbit-client.cfg instead of
CLASS=classname, and then in client-local.cfg I use [hostname] instead
of classname.  And it works on my Solaris 9 systems.
 
One caveat is that the Hobbit agent must be able to read the file -- is
/etc/sudoers readable?
 
Finally, you can look at the client data returned by the agent for this
host and see what is being returned for these files.  This can help you
decide whether the problem is in the client-local.cfg part (which tells
the remote agent what to watch) or the hobbit-client.cfg (which tells
the server what to do with the data returned by the the Hobbit agent).
 
GLH

▸ quoted from Denver Osborn



	From: Denver Osborn [mailto:user-379e8d8cd715@xymon.invalid] 
	Sent: Friday, July 18, 2008 7:36 AM
	To: user-ae9b8668bcde@xymon.invalid
	Subject: [hobbit] FILE monitor and mtime<600 troubleshooting
	
	
	Hi,

	 
	I'm running Hobbit 4.2.0 with the allinone patch on hpux and
can't get the FILE monitor to work. I've added the required file: entry
in the client-local.cfg for the host, then put the FILE directive in the
hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks
up the new file and shows it as 'green'. When testing the monitor by
changing the mtime of my file, hobbit doesn't alert on the change.

	 
	Here's my hobbit-client.cfg entry:

	 
	CLASS=classname

	         FILE /etc/sudoers yellow mtime<600

	 
	The client-local.cfg entry:

	 
	[classname]

	file:/etc/sudoers

	 
	Has anyone else seen this before or have any advice on how to
troubleshoot?

	 
	Thanks,

	 
	Denver Osborn

list Robert P McGraw · Fri, 18 Jul 2008 09:34:22 -0400 ·

I have had problems with the placement of thing in the .cfg files.

 
Try moving the lines to the very top of the before anything else. This will
let you know if any of the other entries are causing problem.

 
At one time I had an empty class name before a hostname of the same class
and nothing worked. When I moved the host name above all the class names it
started working.

 
Robert

▸ quoted from Denver Osborn

From: Denver Osborn [mailto:user-379e8d8cd715@xymon.invalid] 
Sent: Friday, July 18, 2008 8:36 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: [hobbit] FILE monitor and mtime<600 troubleshooting

Hi,

I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get the
FILE monitor to work. I've added the required file: entry in the
client-local.cfg for the host, then put the FILE directive in the
hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks up
the new file and shows it as 'green'. When testing the monitor by changing
the mtime of my file, hobbit doesn't alert on the change.

Here's my hobbit-client.cfg entry:

CLASS=classname

         FILE /etc/sudoers yellow mtime<600

The client-local.cfg entry:

[classname]

file:/etc/sudoers

Has anyone else seen this before or have any advice on how to troubleshoot?

Thanks,

Denver Osborn

list Denver Osborn · Fri, 18 Jul 2008 08:58:06 -0500 ·

▸ quoted from Robert P McGraw

I have had problems with the placement of thing in the .cfg files.

Try moving the lines to the very top of the before anything else. This will let you know
if any of the other entries are causing problem.

At one time I had an empty class name before a hostname of the same class and nothing worked.
When I moved the host name above all the class names it started working.

Robert

I'm going to move my hobbit-clients.cfg and client-local.cfg entries for the monitor and test.

My OS is HP-UX 11.31 on the server and 11.11 on the client. The sudoers file permissions are 440 bin:bin, but the file monitor does have stats available on the bbdisplay. Regardless, I'm testing with a world readable file too.

Here's what gets reported to the server from the client.

[file:/opt/iexpress/sudo/etc/sudoers]
type:100000 (file)
mode:440 (-r--r-----)
linkcount:1
owner:2 (bin)
group:2 (bin)
size:7076
clock:1216388957 (2008/07/18-08:49:17)
atime:1216388812 (2008/07/18-08:46:52)
ctime:1216388812 (2008/07/18-08:46:52)
mtime:1216388812 (2008/07/18-08:46:52)


[file:/etc/sudoers.test]
type:100000 (file)
mode:444 (-r--r--r--)
linkcount:1
owner:2 (bin)
group:2 (bin)
size:7066
clock:1216388957 (2008/07/18-08:49:17)
atime:1216385983 (2008/07/18-07:59:43)
ctime:1216385990 (2008/07/18-07:59:50)
mtime:1216385990 (2008/07/18-07:59:50)

list Denver Osborn · Mon, 21 Jul 2008 16:03:23 -0500 ·

▸ quoted from Robert P McGraw

I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get
the FILE monitor to work. I've added the required file: entry in the
client-local.cfg for the host, then put the FILE directive in the
hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks
up the new file and shows it as 'green'. When testing the monitor by
changing the mtime of my file, hobbit doesn't alert on the change.

Here's my hobbit-client.cfg entry:

CLASS=classname
         FILE /etc/sudoers yellow mtime<600

I was able to solve this one by changing "CLASS=" to "HOSTCLASS=" in the hobbit-clients.cfg. Once I did that everything worked as expected.

list Denver Osborn · Mon, 21 Jul 2008 17:09:54 -0500 ·

▸ quoted from Denver Osborn

I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get
the FILE monitor to work. I've added the required file: entry in the
client-local.cfg for the host, then put the FILE directive in the
hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks
up the new file and shows it as 'green'. When testing the monitor by
changing the mtime of my file, hobbit doesn't alert on the change.

Here's my hobbit-client.cfg entry:

CLASS=classname
         FILE /etc/sudoers yellow mtime<600

I was able to solve this one by changing "CLASS=" to "HOSTCLASS="
in the hobbit-clients.cfg. Once I did that everything worked as expected.

Sorry, spoke too soon. I didn't wait long enough between hobbit-clients.cfg changes. HOSTCLASS= did nothing and isn't valid syntax. A change prior to HOSTCLASS= was HOST=hostname and that's what solved it. Not sure why, but I can't get it to pick up with the CLASS=classname entry.

list Robert P McGraw · Tue, 22 Jul 2008 08:48:22 -0400 ·

Sorry if this is obvious but have you tried this using just the
HOST=hostname to make sure it is working?

Robert

▸ quoted from Denver Osborn

-----Original Message-----
From: Denver Osborn [mailto:user-379e8d8cd715@xymon.invalid]
Sent: Monday, July 21, 2008 6:10 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting

I'm running Hobbit 4.2.0 with the allinone patch on hpux and can't get
the FILE monitor to work. I've added the required file: entry in the
client-local.cfg for the host, then put the FILE directive in the
hobbit-clients.cfg file. After adding the monitor, the BBDISPLAY picks
up the new file and shows it as 'green'. When testing the monitor by
changing the mtime of my file, hobbit doesn't alert on the change.

Here's my hobbit-client.cfg entry:

CLASS=classname
         FILE /etc/sudoers yellow mtime<600

I was able to solve this one by changing "CLASS=" to "HOSTCLASS="
in the hobbit-clients.cfg. Once I did that everything worked as expected.

Sorry, spoke too soon. I didn't wait long enough between hobbit-
clients.cfg changes. HOSTCLASS= did nothing and isn't valid syntax. A

▸ quoted from Denver Osborn

change prior to HOSTCLASS= was HOST=hostname and that's what solved it.
Not sure why, but I can't get it to pick up with the CLASS=classname
entry.

list Denver Osborn · Tue, 22 Jul 2008 08:08:06 -0500 ·

▸ quoted from Robert P McGraw

Sorry if this is obvious but have you tried this using just the
HOST=hostname to make sure it is working?

Thanks, I did that and all works well with HOST=hostname. The one thing I couldn't get working is CLASS=classname. Using the CLASS=classname entry makes more sense for file monitoring as the same file in different platforms vary in permissions and location. If I can't make it work with CLASS I'll stick with what works by maintaining multiple HOST entries.

The configs once again are

# hobbit-clients.cfg:
CLASS=hpux11iv1
        FILE /etc/sudoers mtime>600

# client-local.cfg:
[hpux11iv1]
file:/etc/sudoers

# bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1


-denver

list Robert P McGraw · Tue, 22 Jul 2008 13:36:39 -0400 ·

Have you tried placing the lines at the very top of the file or at the very
bottom?

I had a problem with the client-local.cfg file where I had put the hostname
of the same class after the class name which was empty. Nothing worked. Once
there is a hit, hostname or class, it stops processing. So it seems that you
cannot expect hostname commands and class name commands to both execute;
which ever it finds first it executes those commands and then stops. At
least that is what I have found.

▸ quoted from Denver Osborn


Robert

-----Original Message-----
From: Denver Osborn [mailto:user-379e8d8cd715@xymon.invalid]
Sent: Tuesday, July 22, 2008 9:08 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting

Sorry if this is obvious but have you tried this using just the
HOST=hostname to make sure it is working?

Thanks, I did that and all works well with HOST=hostname. The one thing I
couldn't get working is CLASS=classname. Using the CLASS=classname entry
makes more sense for file monitoring as the same file in different
platforms vary in permissions and location. If I can't make it work with
CLASS I'll stick with what works by maintaining multiple HOST entries.

The configs once again are

# hobbit-clients.cfg:
CLASS=hpux11iv1
        FILE /etc/sudoers mtime>600

# client-local.cfg:
[hpux11iv1]
file:/etc/sudoers

# bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1


-denver

list Greg L Hubbard · Tue, 22 Jul 2008 13:02:46 -0500 ·

I think that is what I found as well, so I bagged the class stuff
altogether and went with only host names.  And I refreshed my memory on
how to cut and paste in my text editor...

GLH

▸ quoted from Robert P McGraw

-----Original Message-----
From: McGraw, Robert P [mailto:user-33cf07af04dd@xymon.invalid] Sent: Tuesday, July 22, 2008 12:37 PM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting

Have you tried placing the lines at the very top of the file or at the
very bottom?

I had a problem with the client-local.cfg file where I had put the
hostname of the same class after the class name which was empty. Nothing
worked. Once there is a hit, hostname or class, it stops processing. So
it seems that you cannot expect hostname commands and class name
commands to both execute; which ever it finds first it executes those
commands and then stops. At least that is what I have found.

Robert

-----Original Message-----
From: Denver Osborn [mailto:user-379e8d8cd715@xymon.invalid]
Sent: Tuesday, July 22, 2008 9:08 AM
To: user-ae9b8668bcde@xymon.invalid
Subject: RE: [hobbit] FILE monitor and mtime<600 troubleshooting

Sorry if this is obvious but have you tried this using just the > HOST=hostname to make sure it is working?

Thanks, I did that and all works well with HOST=hostname. The one thing I couldn't get working is CLASS=classname. Using the CLASS=classname entry makes more sense for file monitoring as the same

file in different platforms vary in permissions and location. If I can't make it work with CLASS I'll stick with what works by
maintaining multiple HOST entries.

The configs once again are

# hobbit-clients.cfg:
CLASS=hpux11iv1
        FILE /etc/sudoers mtime>600

# client-local.cfg:
[hpux11iv1]
file:/etc/sudoers

# bb-hosts
0.0.0.0 hpux_host # CLASS:hpux11iv1


-denver

FILE monitor and mtime<600 troubleshooting 🔗 link

FILE monitor and mtime<600 troubleshooting