<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=US-ASCII">
<meta name=Generator content="Microsoft Word 10 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";
color:black;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.emailstyle17
{font-family:Arial;
color:windowtext;}
span.EmailStyle19
{font-family:Arial;
color:navy;}
span.EmailStyle20
{font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I tried the following syntax:</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> LOG /var/log/messages %authentication\sfailure
color=yellow</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>The messages appears as an alert but the
color remains green.</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> Is this syntax correct?</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<div>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>Robert Manocchia</span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>UNIX System Administrator</span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>IDEXX Laboratories</span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>207 556-6860</span></font></p>
<p class=MsoNormal><font size=2 color=black face=Arial><span style='font-size:
10.0pt;font-family:Arial'>EMail Robert-Manocchia@idexx.com</span></font></p>
</div>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;color:windowtext'>-----Original
Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Giovanni - Gestor Redix
[mailto:giovanni@redix.com.br] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, June 06, 2007
8:48 AM<br>
<b><span style='font-weight:bold'>To:</span></b> </span></font><font size=2
color=black face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;
color:windowtext'>hobbit@hswn.dk</span></font><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;color:windowtext'><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [hobbit] LOG alert
not showing yellow</span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'> </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'>Try using this syntax
(changing space with \s + pcre)<br>
</span></font><font size=2 face=Arial><span style='font-size:10.0pt;font-family:
Arial'> LOG
/var/log/messages
%authentication\sfailure color=yellow</span></font><br>
<br>
</p>
<pre style='margin-left:.5in'><font size=2 color=black face="Courier New"><span
style='font-size:10.0pt'>Giovanni M. Frainer - Gestor</span></font></pre>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'><br>
<br>
Sello Tlabela (SD) wrote: </span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'><u1:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"></u1:SmartTagType>Hi </span></font><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>Manocchia,<u1:p></u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'><u1:p> </u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>It could be
access rights, if you are running hobbit using the init script it will run as
user hobbit and make sure that hobbit user can read /var/log/messages<u1:p></u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'><u1:p> </u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>Regards<u1:p></u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'><u1:p> </u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><st1:PersonName u4:st="on"><font
size=2 color=black face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>Sello
Tlabela</span></font></st1:PersonName></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'><u1:p> </u1:p></span></font></p>
<div>
<div class=MsoNormal align=center style='margin-left:.5in;text-align:center'><font
size=3 color=black face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='margin-left:.5in'><b><font size=2 color=black
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
Manocchia, Robert [<a href="mailto:Robert-Manocchia@IDEXX.com">mailto:Robert-Manocchia@IDEXX.com</a>]
<br>
<b><span style='font-weight:bold'>Sent:</span></b> 05 June 2007 21:38<br>
<b><span style='font-weight:bold'>To:</span></b> '<st1:PersonName u4:st="on"><a
href="mailto:hobbit@hswn.dk">hobbit@hswn.dk</a></st1:PersonName>'<br>
<b><span style='font-weight:bold'>Subject:</span></b> [hobbit] LOG alert not
showing yellow</span></font></p>
</div>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'><u1:p> </u1:p></span></font></p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>I have a small
problem. I’ve set up monitoring of the /var/log/messages logfile to
search for the string “authentication failure” and alert with a
yellow button in the MSG column. I can see the error displayed when I click on
the button below the Msg column header but it does not turn yellow.</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Below is the
entry in the clients-local.cfg file:</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>[batman]</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>log:/var/log/messages:10240</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>ignore MARK</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>This is the entry
in the hobbit-clients.cfg file:</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>HOST=batman</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>
LOG
/var/log/messages authentication
failure color=yellow</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>Why doesn’t
this give me a yellow alert.</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Thanks</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>Robert Manocchia</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>UNIX System Administrator</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>IDEXX Laboratories</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>207 556-6860</span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=2 color=black
face=Arial><span style='font-size:10.0pt;font-family:Arial'>EMail <a
href="mailto:Robert-Manocchia@idexx.com">Robert-Manocchia@idexx.com</a></span></font></p>
<u1:p></u1:p>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'> <u1:p></u1:p></span></font></p>
<table class=MsoNormalTable border=0 cellpadding=0 width=577 style='width:433.0pt;
margin-left:.5in'>
<tr>
<td bgcolor=white style='background:white;padding:.75pt .75pt .75pt .75pt'>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt'>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
This e-mail and its contents are subject to the Telkom SA Limited<br>
e-mail legal notice available at <br>
<a href="http://www.telkom.co.za/TelkomEMailLegalNotice.PDF">http://www.telkom.co.za/TelkomEMailLegalNotice.PDF</a><br>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span></font></p>
</td>
</tr>
</table>
<p class=MsoNormal style='margin-left:.5in'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt;color:windowtext'> </span></font></p>
</div>
</body>
</html>