Re: [hobbit] howto run msgs check ?

[David Gore <David.Gore (at) verizonbusiness.com>]

Nicolas wrote:
> Hi,
>
> Os: FreeBSD 5.1
> Server Hobbit: 4.2-RC-20060712
> Client Hobbit: 4.2-RC-20060712
>
> I m trying to configure trigger on msgs check but don't manage :(
>
> here the configuration on server side, maybe there is a mistake :
>
> Goal: report yellow/red alerts on some keyword in /var/log/messages
>
> 1. hobbit-clients.cfg on server side
>
> HOST=baldo.tou.nu
>        [...]
>        LOG %/var/log/messages kernel COLOR=yellow
>        LOG %/var/log/messages %(I/O|read).error COLOR=red
>        LOG %/var/log/messages diff-bkp-mx-dom COLOR=red
>
> 2. client-local.cfg on server side
>
> [freebsd]
> log:/var/log/maillog:10240
> file:/usr/local/bin/bash:md5
> log:/var/log/messages:10240
>
> [baldo.tou.nu]
> file:/usr/local/bin/bash:md5
> log:/var/log/messages:10240
> trigger diff-bkp-mx-dom
> trigger kernel
> log:/var/log/maillog:10240
> ignore spamd
> trigger deferred
>   

I am not sure you can have multiple triggers?  How about something like this

trigger diff-bkp-mx-dom|kernel

> 3. The [green]  msgs column of the host reports this:
>
> No entries in /var/log/messages
>
> No entries in /var/log/maillog
>
> Full log /var/log/messages
> Jul 25 11:19:36 baldo sudo:   hobbit : TTY=unknown ;
> PWD=/usr/home/hobbit/client ; USER=root ; COMMAND=/usr/bin/netstat -i -b
> -n
> Jul 25 11:19:36 baldo sudo:   hobbit : TTY=unknown ;
> PWD=/usr/home/hobbit/client ; USER=root ; COMMAND=/usr/bin/netstat -s
> Jul 25 11:19:36 baldo sudo:   hobbit : TTY=unknown ;
> PWD=/usr/home/hobbit/client ; USER=root ; COMMAND=/usr/bin/netstat -na -f
> inet
> [...]
> Jul 25 11:49:43 baldo sudo:   hobbit : TTY=unknown ;
> PWD=/usr/home/hobbit/client ; USER=root ; COMMAND=/bin/ps -ax -ww -o
> pid,ppid,user,start,state,pri,pcpu,cputime,pmem,rss,vsz,args
> Jul 25 11:49:43 baldo sudo:   hobbit : TTY=unknown ;
> PWD=/usr/home/hobbit/client ; USER=root ; COMMAND=/usr/bin/top -n 20
>
> Full log /var/log/maillog
> Cannot open logfile /var/log/maillog : Permission denied
>
>
> I know there is a permission problem for maillog but i don 't care at this
> time, i d like to monitore /var/log/messages at first ;-)
>
> Thanks in advance.
>
> Regards,
> Nicolas
>
>
>
> To unsubscribe from the hobbit list, send an e-mail to
> hobbit-unsubscribe (at) hswn.dk
>
>
>