Re: [hobbit] Re: New to Hobbit --- file monitoring

["Josh Luthman" <josh (at) imaginenetworksllc.com>]

I'm basing my changes on Greg.  These still do not work, though I believe
they're a step towards the right direction:

#hobbit-clients.cfg
HOST=foo.bar.com
  FILE "/etc/passwd" GREEN NOEXIST TRACK

#client-local.cfg
[foo.bar.com]
file:/etc/passwd

I do notice that on my main machine running the server and client that there
is Client Data available if you click on the Files test.  There is no client
data from the foo.bar.com files test, however.  I think my problem right now
is that I'm not getting the data from foo.bar.com to BBD.  Any ideas at this
point?

On 11/1/07, Hubbard, Greg L <greg.hubbard (at) eds.com> wrote:
>
>  Here is something I use that works.  This is a "bookend" problem -- both
> parts have to be done correctly.  Hobbit tends to silently ignore errors in
> configuration files.
>
> ---------------------------------------------------
>
> In client-local.cfg
>
> [myserver.mydomain.com]
> file:/opt2/log/syslog.log
> file:/opt2/log/security.log
> file:/opt2/log/snmptrap.log
> ---------------------------------------------------
>
> in hobbit-clients.cfg
>
> HOST=myserver.mydomain.com
>         FILE /opt2/log/syslog.log mtime<600 size<2G TRACK
>         FILE /opt2/log/security.log TRACK
>         FILE /opt2/log/snmptrap.log mtime<600 size<2G TRACK
> ----------------------------------------------------
>
> Some things to note
>
> a) the host names match exactly, and they are not enclosed in double
> quotes.
>
> b) the file names match exactly
>
> c) this example is lifted from my running system, with the host name
> changed to protect the guilty.  I have some other examples that use color in
> the "COLOR=color" format, which I believe is required, but I would have to
> edit them more before I can post them.
>
> d) the client-local.cfg file has some predefined sections in it.  Don't
> use them.  Make new ones.  Only one section can be applied to a host, so cut
> and paste will
> be your friend.
>
>
>  ------------------------------
> *From:* Scott Mohnkern [mailto:mohnkern (at) gmail.com]
> *Sent:* Thursday, November 01, 2007 4:00 PM
> *To:* hobbit (at) hswn.dk
> *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
>
> Nope, no joy there either.  the man page seems to think it should be:
>
> FILE <full path to file><color> <condition>
>
> and that's pretty consistent with the other things I've put into the same
> file, which come up.
>
> I also tried:
>
> FILE "/etc/passwd" green noexist TRACK
>
> and
>
> FILE "/etc/passwd" green noexist
>
>
> Scott
>
>
>
> On 11/1/07, Hubbard, Greg L <greg.hubbard (at) eds.com> wrote:
> >
> >  Try this
> >
> > FILE /etc/passwd noexist COLOR=green TRACK
> >
> >  ------------------------------
> > *From:* Scott Mohnkern [mailto:mohnkern (at) gmail.com]
> > *Sent:* Thursday, November 01, 2007 3:39 PM
> > *To:* hobbit (at) hswn.dk
> > *Subject:* Re: [hobbit] Re: New to Hobbit --- file monitoring
> >
> >  Well, at least its replicatable.
> >
> >
> > Scott
> >
> >
> > On 11/1/07, Scott Mohnkern < mohnkern (at) gmail.com> wrote:
> > >
> > > Thanks for the help.  I edited /etc/hobbit/hobbit-clients.cfg so the
> > > line reads:
> > >
> > > FILE /etc/passwd GREEN noexist
> > >
> > > still no joy.
> > >
> > > Is there anyone on the list that has an example of a FILE line in
> > > their hobbit-clients.cfg file?
> > >
> > > On 11/1/07, Hubbard, Greg L < greg.hubbard (at) eds.com> wrote:
> > > >
> > > >
> > > > Try removing the TRACK keyword, and then change NOEXIST to lower case.  I think Henrik has reported that there are a few bugs in this code,
> > > > and it is not always clear when case matters and when it doesn't, or
> > > > when the order of the arguments matters.
> > > >
> > > >
> > > >  ------------------------------
> > > >  *From:* Scott Mohnkern [mailto:mohnkern (at) gmail.com]
> > > > *Sent:* Thursday, November 01, 2007 3:10 PM
> > > > *To:* hobbit (at) hswn.dk
> > > > *Subject:* [hobbit] Re: New to Hobbit --- file monitoring
> > > >
> > > >  When all else fails, nuke it and start over.  I did an apt-get
> > > > remove hobbit, and then a dpkg -- purge.  Then I removed any files I could
> > > > find.  Then I downloaded the Ubuntu deb file and installed it.  It put the
> > > > configuration files in /etc/hobbit and it started fine
> > > >
> > > > I edited /etc/hobbit/hobbit-clients.cfg and added the following
> > > > line:
> > > >
> > > > PROC ntpd 1 99 green "TEXT=NTPD is up"
> > > >
> > > >
> > > > Restarted hobbit, and in a few minutes, it started reporting as
> > > > expected.
> > > >
> > > > Then I added:
> > > >
> > > > PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
> > > >
> > > > To the same file, (/etc/hobbit/hobbit-clients.cfg) and restared
> > > > hobbit.
> > > >
> > > > A few minutes later, the ports section started reporting, as
> > > > expected.
> > > >
> > > > (Though I realize that its a bit off, which I need to fix)
> > > >
> > > >
> > > > Then I added:
> > > >
> > > > FILE /etc/passwd GREEN NOEXIST track
> > > >
> > > > Reading the documentation inside hobbit-clients.cfg I edited
> > > > /etc/hobbit/client- local.cfg and added the following line:
> > > > file:/etc/passwd
> > > >
> > > > restarted hobbit, waited 5 minutes.  No luck.
> > > >
> > > >
> > > > I'm pretty convinced that either:
> > > >
> > > > 1. the format of the line  in /etc/hobbit/client-local.cfg or
> > > > /etc/hobbit/hobbit-clients.cfg is incorrect, or
> > > > 2. There's something else I need to edit.
> > > >
> > > >
> > >
> >
>


-- 
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373

Those who don't understand UNIX are condemned to reinvent it, poorly.
--- Henry Spencer