port rule evaluation in hobbit-clients.cfg

Jay Brislin brislin at bc.edu
Thu Sep 13 15:20:08 CEST 2007


I set up a PORT rule to alert for SENDMAIL logins in the DEFAULT section of my hobbit-clients.cfg file. I wanted
to override that rule for certain hosts to allow SENDMAIL logins. My hobbit-clients.cfg looks like this:
------------
HOST=luxuria
        PORT "LOCAL=%([.:]25)$" state=ESTABLISHED min=0 max=9 color=green "TEXT=SENDMAIL logins"
DEFAULT
        # These are the built-in defaults.
        UP      1h
        LOAD    5.0 10.0
        DISK    * 90 95
        MEMPHYS 100 101
        MEMSWAP 70 85
        MEMACT  90 97
        PROC cron
        PROC ntpd
        PORT "LOCAL=%([.:]23)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=TELNET logins"
        PORT "LOCAL=%([.:]25)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=SENDMAIL logins"
        PORT "LOCAL=%([.:]20)$" state=ESTABLISHED min=0 max=0 color=red "TEXT=FTP logins"

 But I see this on the hobbit server display:

green SENDMAIL logins (found 1, req. at most 9)
green TELNET logins (found 0, req. at most 0)
red SENDMAIL logins (found 1, req. at most 0)
green FTP logins (found 0, req. at most 0)

Does anybody know why both rules for the SENDMAIL port are being evaluated? The man page for hobbit-clients.cfg
says:
The  entire  file is evaluated from the top to bottom, and the first match found is used. So you should put
       the specific settings first, and the generic ones last.


-- 
Jay



More information about the Xymon mailing list