<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2876" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2>Well, well. A "ghost" is a Hobbit client reporting in
with a name that is not in the bb-hosts file.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2>Two ways to fix it.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2>a) on the client, there is a way to make the client use an
arbitrary name. I think it is the "--client foo.bar.com" option, but I
could be wrong.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=402295501-02112007><FONT face=Arial
color=#0000ff size=2>b) on the server, you can add a "client:wrong.host.name"
entry for the client that is reporting in with a bad name.</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=402295501-02112007></SPAN><FONT face=Arial><FONT
color=#0000ff><FONT size=2>I<SPAN class=402295501-02112007> could be wrong on
both counts about the syntax -- you can check the man
pages.</SPAN></FONT></FONT></FONT><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Josh Luthman
[mailto:josh@imaginenetworksllc.com] <BR><B>Sent:</B> Thursday, November 01,
2007 8:45 PM<BR><B>To:</B> hobbit@hswn.dk<BR><B>Subject:</B> Re: [hobbit] Re:
New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV></DIV>Ghost reports doesn't have <A
href="http://foo.bar.com">foo.bar.com</A> but it does have something else - an
old hostname that I changed a while back, can you tell me how to fix
this?<BR><BR>Greg - making that change didn't fix it. I still have "no
files checked" =( <BR><BR>Josh<BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B class=gmail_sendername>Hubbard,
Greg L</B> <<A
href="mailto:greg.hubbard@eds.com">greg.hubbard@eds.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>check
your ghosts report to see if <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://foo.bar.com" target=_blank>foo.bar.com </A>is reporting in as
foo.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>And when
are you going to change GREEN to "COLOR=green"?</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>G<SPAN>LH</SPAN></FONT></FONT></FONT><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><B>From:</B> Josh Luthman [mailto:<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:josh@imaginenetworksllc.com"
target=_blank>josh@imaginenetworksllc.com</A>] <BR><B>Sent:</B> Thursday,
November 01, 2007 5:13 PM</FONT>
<DIV><SPAN class=e id=q_115fddf439fa23d1_1><FONT face=Tahoma
size=2><BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk" target=_blank>hobbit@hswn.dk
</A><BR><B>Subject:</B> Re: [hobbit] Re: New to Hobbit --- file
monitoring<BR></FONT></SPAN></DIV><BR></DIV>
<DIV><SPAN class=e id=q_115fddf439fa23d1_3>
<DIV></DIV>I'm basing my changes on Greg. These still do not work,
though I believe they're a step towards the right
direction:<BR><BR>#hobbit-clients.cfg<BR>HOST=<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://foo.bar.com" target=_blank>foo.bar.com</A><BR> FILE
"/etc/passwd" GREEN NOEXIST TRACK <BR><BR>#client-local.cfg<BR>[<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://foo.bar.com"
target=_blank>foo.bar.com</A>]<BR>file:/etc/passwd<BR><BR>I do notice that
on my main machine running the server and client that there is Client Data
available if you click on the Files test. There is no client data
from the <A onclick="return top.js.OpenExtLink(window,event,this)"
href="http://foo.bar.com" target=_blank>foo.bar.com</A> files test,
however. I think my problem right now is that I'm not getting the
data from <A onclick="return top.js.OpenExtLink(window,event,this)"
href="http://foo.bar.com" target=_blank>foo.bar.com</A> to BBD. Any
ideas at this point?<BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com"
target=_blank>greg.hubbard@eds.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Here
is something I use that works. This is a "bookend" problem -- both
parts have to be done correctly. Hobbit tends to silently ignore
errors in configuration files.</FONT></SPAN></DIV></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>In
client-local.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>[<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://myserver.mydomain.com"
target=_blank>myserver.mydomain.com</A>]<BR>file:/opt2/log/syslog.log
<BR>file:/opt2/log/security.log<BR>file:/opt2/log/snmptrap.log<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>in
hobbit-clients.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>HOST=<A onclick="return top.js.OpenExtLink(window,event,this)"
href="http://myserver.mydomain.com"
target=_blank>myserver.mydomain.com</A>
<BR> FILE /opt2/log/syslog.log
mtime<600 size<2G
TRACK<BR> FILE
/opt2/log/security.log
TRACK<BR> FILE
/opt2/log/snmptrap.log mtime<600 size<2G
TRACK<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>----------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Some
things to note</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>a)
the host names match exactly, and they are not enclosed in double
quotes.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>b)
the file names match exactly</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>c)
this example is lifted from my running system, with the host name
changed to protect the guilty. I have some other examples that use
color in the "COLOR=color" format, which I believe is required, but I
would have to edit them more before I can post
them.</FONT></SPAN><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN>d) the client-local.cfg
file has some predefined sections in it. Don't use them.
Make new ones. Only one section can be applied to a host, so cut
and paste will</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN>be your
friend.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><SPAN><B>From:</B> Scott Mohnkern [mailto:<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>mohnkern@gmail.com</A>]
<BR></SPAN><B>Sent:</B> Thursday, November 01, 2007 4:00 PM</FONT>
<DIV><SPAN><FONT face=Tahoma size=2><BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk" target=_blank>hobbit@hswn.dk</A>
<BR><B>Subject:</B> Re: [hobbit] Re: New to Hobbit --- file
monitoring<BR></FONT></SPAN></DIV><BR></DIV>
<DIV><SPAN>
<DIV></DIV>Nope, no joy there either. the man page seems to
think it should be:<BR><BR>FILE <full path to file><color>
<condition><BR><BR>and that's pretty consistent with the other
things I've put into the same file, which come up. <BR><BR>I also
tried:<BR><BR>FILE "/etc/passwd" green noexist TRACK<BR><BR>and
<BR><BR>FILE "/etc/passwd" green
noexist<BR><BR><BR>Scott<BR><BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com" target=_blank>greg.hubbard@eds.com
</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>Try this</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>FILE /etc/passwd noexist COLOR=green
TRACK</FONT></SPAN></DIV><BR>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><SPAN><B>From:</B> Scott Mohnkern
[mailto:<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com"
target=_blank>mohnkern@gmail.com</A>] <BR></SPAN><B>Sent:</B>
Thursday, November 01, 2007 3:39 PM<BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> Re: [hobbit]
Re: New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN>
<DIV></DIV>Well, at least its
replicatable.<BR><BR><BR>Scott<BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Scott Mohnkern</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>
mohnkern@gmail.com</A>> wrote: </SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Thanks
for the help. I edited /etc/hobbit/hobbit-clients.cfg so
the line reads:<BR><BR>FILE /etc/passwd GREEN
noexist<BR><BR>still no joy. <BR><BR>Is there anyone on
the list that has an example of a FILE line in their
hobbit-clients.cfg file?<BR><BR>
<DIV><SPAN><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com" target=_blank>
greg.hubbard@eds.com</A>> wrote:</SPAN></SPAN>
<DIV><SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code,
</FONT></FONT></FONT></DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>a<SPAN>nd it is not always clear when case matters and
when it doesn't, or when the order of the arguments
matters.</SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT><SPAN><FONT
face=Arial color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV>
<HR>
</DIV>
<DIV><FONT face=Tahoma size=2><SPAN><B>From:</B> Scott
Mohnkern [mailto:<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com"
target=_blank>mohnkern@gmail.com</A>] <BR></SPAN><B>Sent:</B>
Thursday, November 01, 2007 3:10 PM<BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> [hobbit]
Re: New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>When all else fails, nuke it and start
over. I did an apt-get remove hobbit, and then a dpkg
-- purge. Then I removed any files I could find.
Then I downloaded the Ubuntu deb file and installed
it. It put the configuration files in /etc/hobbit and
it started fine <BR><BR>I edited
/etc/hobbit/hobbit-clients.cfg and added the following
line:<BR><BR>PROC ntpd 1 99 green "TEXT=NTPD is
up"<BR><BR><BR>Restarted hobbit, and in a few minutes, it
started reporting as expected.<BR><BR>Then I
added:<BR><BR>PORT "LOCAL=%(:8888)" TEXT="Gnump is
up"<BR><BR>To the same file,
(/etc/hobbit/hobbit-clients.cfg) and restared
hobbit.<BR><BR>A few minutes later, the ports section
started reporting, as expected. <BR><BR>(Though I realize
that its a bit off, which I need to fix)<BR><BR><BR>Then I
added:<BR><BR>FILE /etc/passwd GREEN NOEXIST
track<BR><BR>Reading the documentation inside
hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg
and added the following
line:<BR>file:/etc/passwd<BR><BR>restarted hobbit, waited 5
minutes. No luck.<BR><BR><BR>I'm pretty convinced that
either:<BR><BR>1. the format of the line in
/etc/hobbit/client-local.cfg or
/etc/hobbit/hobbit-clients.cfg is incorrect, or<BR>2.
There's something else I need to
edit.<BR><BR></BLOCKQUOTE></SPAN></DIV></DIV></BLOCKQUOTE></SPAN></DIV></DIV><BR></BLOCKQUOTE></DIV><BR></SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR></SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR><BR
clear=all><BR>-- <BR>Josh Luthman<BR>Office: 937-552-2340<BR>Direct:
937-552-2343<BR>1100 Wayne St<BR>Suite 1337<BR>Troy, OH 45373<BR><BR>Those
who don't understand UNIX are condemned to reinvent it, poorly. <BR>---
Henry Spencer </SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR><BR
clear=all><BR>-- <BR>Josh Luthman<BR>Office: 937-552-2340<BR>Direct:
937-552-2343<BR>1100 Wayne St<BR>Suite 1337<BR>Troy, OH 45373<BR><BR>Those who
don't understand UNIX are condemned to reinvent it, poorly. <BR>--- Henry
Spencer </BLOCKQUOTE></BODY></HTML>