<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Steve,<br>
<br>
Yes, I am also using short hostnames in the bb-hosts file as well...<br>
<br>
Steve Holmes wrote:
<blockquote
cite="mid43be87180707251559q2f6e21e4x49db8496ed1fc37e@mail.gmail.com"
type="cite">Ken,<br>
<br>
I notice you have short host names in the config as well as in the log
files. Do you have short host names in the bb-hosts file as well?<br>
<br>
Steve Holmes<br>
<br>
<div><span class="gmail_quote">On 7/25/07, <b
class="gmail_sendername">
Kenneth Bourn</b> <<a href="mailto:kbourn@adpt-tech.com">kbourn@adpt-tech.com</a>>
wrote:</span>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000"><font
face="Helvetica, Arial, sans-serif">I am having issues with
getting Hobbit to report log entries from client log files. The server
is getting the log data but, despite a valid string entry in the log
file, no alerts are generated.<br>
<br>
Here is an excerpt from my client-local.cfg file:<br>
<br>
<font face="Courier New, Courier, monospace">[hosta-z1]<br>
log:/var/adm/messages:10240</font><br>
<br>
And a corresponding entry from the hobbit-clients.cfg file:<br>
<font face="Courier New, Courier, monospace"><br>
HOST=hosta-z1<br>
LOG /var/adm/messages sshd COLOR=red</font><br>
<br>
The status never changes for this host despite sshd entries existing in
the /var/adm/messages file. I used "sshd" because I KNOW that there
are current entries in /var/adm/messages since everytime hobbit runs an
ssh check on the server an sshd message is generated. I have chosen
this string just to troubleshoot this problem...<br>
<br>
Clicking on "msgs" for this host, there is a message "No entries in
/var/adm/messages". But if I click on the "/var/adm/messages" link it
shows recent entries with the sshd string in the log file as the
following shows:<br>
<br>
</font>
<pre><font face="Helvetica, Arial, sans-serif"><font
face="Courier New, Courier, monospace">[msgs:/var/adm/messages]
Jul 25 16:59:34 hosta-z1 sshd[4164]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
auth.info</a>] Connection closed by <a href="http://10.0.0.68"
target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">10.0.0.68</a>
Jul 25 17:04:37 hosta-z1 sshd[4507]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a>
Jul 25 17:09:39 hosta-z1 sshd[4857]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a>
Jul 25 17:14:41 hosta-z1 sshd[5192]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a>
Jul 25 17:19:41 hosta-z1 sshd[5534]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a>
Jul 25 17:24:40 hosta-z1 sshd[5884]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a>
Jul 25 17:29:45 hosta-z1 sshd[6222]: [ID 800047 <a
href="http://auth.info" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">auth.info</a>] Connection closed by <a
href="http://10.0.0.68" target="_blank"
onclick="return top.js.OpenExtLink(window,event,this)">
10.0.0.68</a></font>
</font></pre>
<font face="Helvetica, Arial, sans-serif">Does anyone know what the
problem may be? Is there possibly any known issues with Hobbit logging
under Solaris 10 Update 3 for SPARC? I have tried almost everything I
can think of to get this to work and I am getting no where.<br>
<br>
Thanks in advance for any help.<br>
<br>
-Ken</font><br>
<br>
<br>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
Nonviolence means avoiding not only external physical violence but also<br>
internal violence of spirit. You not only refuse to shoot a man, but you<br>
refuse to hate him. -Martin Luther King, Jr., civil-rights leader
<br>
(1929-1968)<br>
The great thing about getting older is that you don't lose all the other<br>
ages you've been. -Madeleine L'Engle, writer (1918- )
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Kenneth Bourn
Adaption Technologies
<a class="moz-txt-link-abbreviated" href="mailto:kbourn@adpt-tech.com">kbourn@adpt-tech.com</a>
281-465-3328
</pre>
</body>
</html>