<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2876" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>Here is something I use that works. This is a
"bookend" problem -- both parts have to be done correctly. Hobbit tends to
silently ignore errors in configuration
files.</FONT></SPAN></DIV></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>In client-local.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff
size=2>[myserver.mydomain.com]<BR>file:/opt2/log/syslog.log<BR>file:/opt2/log/security.log<BR>file:/opt2/log/snmptrap.log<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2> </DIV></FONT></SPAN>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>in hobbit-clients.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2> </DIV></FONT></SPAN>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff
size=2>HOST=myserver.mydomain.com<BR>
FILE /opt2/log/syslog.log mtime<600 size<2G
TRACK<BR> FILE /opt2/log/security.log
TRACK<BR> FILE /opt2/log/snmptrap.log
mtime<600 size<2G TRACK<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff
size=2>----------------------------------------------------</DIV></FONT></SPAN>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>Some things to note</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>a) the host names match exactly, and they are not enclosed
in double quotes.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>b) the file names match exactly</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=316000721-01112007><FONT face=Arial
color=#0000ff size=2>c) this example is lifted from my running system, with the
host name changed to protect the guilty. I have some other examples that
use color in the "COLOR=color" format, which I believe is required, but I would
have to edit them more before I can post them.</FONT></SPAN><SPAN
class=316000721-01112007><FONT face=Arial color=#0000ff size=2></DIV>
<DIV></FONT></SPAN><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=316000721-01112007>d) the
client-local.cfg file has some predefined sections in it. Don't use
them. Make new ones. Only one section can be applied to a host, so
cut and paste will</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN class=316000721-01112007>be
your friend.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Scott Mohnkern
[mailto:mohnkern@gmail.com] <BR><B>Sent:</B> Thursday, November 01, 2007 4:00
PM<BR><B>To:</B> hobbit@hswn.dk<BR><B>Subject:</B> Re: [hobbit] Re: New to
Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV></DIV>Nope, no joy there either. the man page seems to think it
should be:<BR><BR>FILE <full path to file><color>
<condition><BR><BR>and that's pretty consistent with the other things
I've put into the same file, which come up. <BR><BR>I also tried:<BR><BR>FILE
"/etc/passwd" green noexist TRACK<BR><BR>and <BR><BR>FILE "/etc/passwd" green
noexist<BR><BR><BR>Scott<BR><BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B class=gmail_sendername>Hubbard,
Greg L</B> <<A
href="mailto:greg.hubbard@eds.com">greg.hubbard@eds.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Try
this</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>FILE
/etc/passwd noexist COLOR=green TRACK</FONT></SPAN></DIV><BR>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><SPAN class=q><B>From:</B> Scott Mohnkern
[mailto:<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>mohnkern@gmail.com</A>]
<BR></SPAN><B>Sent:</B> Thursday, November 01, 2007 3:39 PM<BR><B>To:</B>
<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> Re: [hobbit] Re: New
to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN class=e id=q_115fcfaeb9b1e852_3>
<DIV></DIV>Well, at least its replicatable.<BR><BR><BR>Scott<BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B class=gmail_sendername>Scott
Mohnkern</B> <<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank> mohnkern@gmail.com</A>>
wrote: </SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Thanks
for the help. I edited /etc/hobbit/hobbit-clients.cfg so the line
reads:<BR><BR>FILE /etc/passwd GREEN noexist<BR><BR>still no joy.
<BR><BR>Is there anyone on the list that has an example of a FILE line
in their hobbit-clients.cfg file?<BR><BR>
<DIV><SPAN><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com" target=_blank>
greg.hubbard@eds.com</A>> wrote:</SPAN></SPAN>
<DIV><SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code,</FONT>
</FONT></FONT></DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>a<SPAN>nd it is not always clear when case matters and when it
doesn't, or when the order of the arguments
matters.</SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT><SPAN><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV>
<HR>
</DIV>
<DIV><FONT face=Tahoma size=2><SPAN><B>From:</B> Scott Mohnkern
[mailto:<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>mohnkern@gmail.com</A>]
<BR></SPAN><B>Sent:</B> Thursday, November 01, 2007 3:10
PM<BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> [hobbit] Re: New
to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>When all else fails, nuke it and start over. I did
an apt-get remove hobbit, and then a dpkg -- purge. Then I
removed any files I could find. Then I downloaded the Ubuntu
deb file and installed it. It put the configuration files in
/etc/hobbit and it started fine <BR><BR>I edited
/etc/hobbit/hobbit-clients.cfg and added the following
line:<BR><BR>PROC ntpd 1 99 green "TEXT=NTPD is
up"<BR><BR><BR>Restarted hobbit, and in a few minutes, it started
reporting as expected.<BR><BR>Then I added:<BR><BR>PORT
"LOCAL=%(:8888)" TEXT="Gnump is up"<BR><BR>To the same file,
(/etc/hobbit/hobbit-clients.cfg) and restared hobbit.<BR><BR>A few
minutes later, the ports section started reporting, as expected.
<BR><BR>(Though I realize that its a bit off, which I need to
fix)<BR><BR><BR>Then I added:<BR><BR>FILE /etc/passwd GREEN NOEXIST
track<BR><BR>Reading the documentation inside hobbit-clients.cfg I
edited /etc/hobbit/client- local.cfg and added the following
line:<BR>file:/etc/passwd<BR><BR>restarted hobbit, waited 5
minutes. No luck.<BR><BR><BR>I'm pretty convinced that
either:<BR><BR>1. the format of the line in
/etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is
incorrect, or<BR>2. There's something else I need to
edit.<BR><BR></BLOCKQUOTE></SPAN></DIV></DIV></BLOCKQUOTE></SPAN></DIV></DIV><BR></BLOCKQUOTE></DIV><BR></SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR></BLOCKQUOTE></BODY></HTML>