[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [hobbit] LOG alert not showing yellow
- To: "'hobbit (at) hswn.dk'" <hobbit (at) hswn.dk>
- Subject: RE: [hobbit] LOG alert not showing yellow
- From: "Manocchia, Robert" <Robert-Manocchia (at) IDEXX.com>
- Date: Wed, 6 Jun 2007 09:00:49 -0400
I tried the following syntax:
LOG /var/log/messages %authentication\sfailure color=yellow
The messages appears as an alert but the color remains green.
Is this syntax correct?
Robert Manocchia
UNIX System Administrator
IDEXX Laboratories
207 556-6860
EMail Robert-Manocchia (at) idexx.com
-----Original Message-----
From: Giovanni - Gestor Redix [mailto:giovanni (at) redix.com.br]
Sent: Wednesday, June 06, 2007 8:48 AM
To: hobbit (at) hswn.dk
Subject: Re: [hobbit] LOG alert not showing yellow
Try using this syntax (changing space with \s + pcre)
LOG /var/log/messages %authentication\sfailure
color=yellow
Giovanni M. Frainer - Gestor
Sello Tlabela (SD) wrote:
Hi Manocchia,
It could be access rights, if you are running hobbit using the init script
it will run as user hobbit and make sure that hobbit user can read
/var/log/messages
Regards
Sello Tlabela
_____
From: Manocchia, Robert [mailto:Robert-Manocchia (at) IDEXX.com
<mailto:Robert-Manocchia (at) IDEXX.com> ]
Sent: 05 June 2007 21:38
To: 'hobbit (at) hswn.dk <mailto:hobbit (at) hswn.dk> '
Subject: [hobbit] LOG alert not showing yellow
I have a small problem. I've set up monitoring of the /var/log/messages
logfile to search for the string "authentication failure" and alert with a
yellow button in the MSG column. I can see the error displayed when I click
on the button below the Msg column header but it does not turn yellow.
Below is the entry in the clients-local.cfg file:
[batman]
log:/var/log/messages:10240
ignore MARK
This is the entry in the hobbit-clients.cfg file:
HOST=batman
LOG /var/log/messages authentication failure color=yellow
Why doesn't this give me a yellow alert.
Thanks
Robert Manocchia
UNIX System Administrator
IDEXX Laboratories
207 556-6860
EMail Robert-Manocchia (at) idexx.com <mailto:Robert-Manocchia (at) idexx.com>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This e-mail and its contents are subject to the Telkom SA Limited
e-mail legal notice available at
http://www.telkom.co.za/TelkomEMailLegalNotice.PDF
<http://www.telkom.co.za/TelkomEMailLegalNotice.PDF>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~