<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2876" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=562305600-02112007><FONT face=Arial
color=#0000ff size=2>check your ghosts report to see if foo.bar.com is reporting
in as foo.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=562305600-02112007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=562305600-02112007><FONT face=Arial
color=#0000ff size=2>And when are you going to change GREEN to
"COLOR=green"?</FONT></SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=562305600-02112007></SPAN><FONT face=Arial><FONT
color=#0000ff><FONT size=2>G<SPAN
class=562305600-02112007>LH</SPAN></FONT></FONT></FONT><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Josh Luthman
[mailto:josh@imaginenetworksllc.com] <BR><B>Sent:</B> Thursday, November 01,
2007 5:13 PM<BR><B>To:</B> hobbit@hswn.dk<BR><B>Subject:</B> Re: [hobbit] Re:
New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV></DIV>I'm basing my changes on Greg. These still do not work,
though I believe they're a step towards the right
direction:<BR><BR>#hobbit-clients.cfg<BR>HOST=<A
href="http://foo.bar.com">foo.bar.com</A><BR> FILE "/etc/passwd" GREEN
NOEXIST TRACK <BR><BR>#client-local.cfg<BR>[<A
href="http://foo.bar.com">foo.bar.com</A>]<BR>file:/etc/passwd<BR><BR>I do
notice that on my main machine running the server and client that there is
Client Data available if you click on the Files test. There is no client
data from the <A href="http://foo.bar.com">foo.bar.com</A> files test,
however. I think my problem right now is that I'm not getting the data
from <A href="http://foo.bar.com">foo.bar.com</A> to BBD. Any ideas at
this point?<BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B class=gmail_sendername>Hubbard,
Greg L</B> <<A
href="mailto:greg.hubbard@eds.com">greg.hubbard@eds.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Here is
something I use that works. This is a "bookend" problem -- both parts
have to be done correctly. Hobbit tends to silently ignore errors in
configuration files.</FONT></SPAN></DIV></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>In
client-local.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>[<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://myserver.mydomain.com"
target=_blank>myserver.mydomain.com</A>]<BR>file:/opt2/log/syslog.log
<BR>file:/opt2/log/security.log<BR>file:/opt2/log/snmptrap.log<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>---------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>in
hobbit-clients.cfg</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>HOST=<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="http://myserver.mydomain.com"
target=_blank>myserver.mydomain.com</A><BR>
FILE /opt2/log/syslog.log mtime<600 size<2G
TRACK<BR> FILE
/opt2/log/security.log TRACK<BR>
FILE /opt2/log/snmptrap.log mtime<600 size<2G
TRACK<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2>----------------------------------------------------</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Some
things to note</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>a) the
host names match exactly, and they are not enclosed in double
quotes.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>b) the
file names match exactly</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>c) this
example is lifted from my running system, with the host name changed to
protect the guilty. I have some other examples that use color in the
"COLOR=color" format, which I believe is required, but I would have to edit
them more before I can post them.</FONT></SPAN><SPAN><FONT face=Arial
color=#0000ff size=2></FONT></SPAN></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN>d) the client-local.cfg
file has some predefined sections in it. Don't use them. Make
new ones. Only one section can be applied to a host, so cut and paste
will</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2><SPAN>be your
friend.</SPAN></FONT></DIV>
<DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV>
<DIV><BR></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><SPAN class=q><B>From:</B> Scott Mohnkern
[mailto:<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>mohnkern@gmail.com</A>]
<BR></SPAN><B>Sent:</B> Thursday, November 01, 2007 4:00 PM</FONT>
<DIV><SPAN class=e id=q_115fd16e93396b5b_3><FONT face=Tahoma
size=2><BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk" target=_blank>hobbit@hswn.dk</A>
<BR><B>Subject:</B> Re: [hobbit] Re: New to Hobbit --- file
monitoring<BR></FONT></SPAN></DIV><BR></DIV>
<DIV><SPAN class=e id=q_115fd16e93396b5b_5>
<DIV></DIV>Nope, no joy there either. the man page seems to think it
should be:<BR><BR>FILE <full path to file><color>
<condition><BR><BR>and that's pretty consistent with the other
things I've put into the same file, which come up. <BR><BR>I also
tried:<BR><BR>FILE "/etc/passwd" green noexist TRACK<BR><BR>and
<BR><BR>FILE "/etc/passwd" green noexist<BR><BR><BR>Scott<BR><BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com"
target=_blank>greg.hubbard@eds.com</A>> wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>Try
this</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN><FONT face=Arial color=#0000ff size=2>FILE
/etc/passwd noexist COLOR=green TRACK</FONT></SPAN></DIV><BR>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV lang=en-us dir=ltr align=left>
<HR>
<FONT face=Tahoma size=2><SPAN><B>From:</B> Scott Mohnkern [mailto:<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>mohnkern@gmail.com</A>]
<BR></SPAN><B>Sent:</B> Thursday, November 01, 2007 3:39
PM<BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> Re: [hobbit] Re:
New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN>
<DIV></DIV>Well, at least its
replicatable.<BR><BR><BR>Scott<BR><BR><BR>
<DIV><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Scott Mohnkern</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com" target=_blank>
mohnkern@gmail.com</A>> wrote: </SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Thanks
for the help. I edited /etc/hobbit/hobbit-clients.cfg so the
line reads:<BR><BR>FILE /etc/passwd GREEN noexist<BR><BR>still no
joy. <BR><BR>Is there anyone on the list that has an example
of a FILE line in their hobbit-clients.cfg file?<BR><BR>
<DIV><SPAN><SPAN class=gmail_quote>On 11/1/07, <B
class=gmail_sendername>Hubbard, Greg L</B> <<A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:greg.hubbard@eds.com" target=_blank>
greg.hubbard@eds.com</A>> wrote:</SPAN></SPAN>
<DIV><SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">
<DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>Try removing the TRACK keyword, and then change NOEXIST to lower case. I think Henrik has reported that there are a few bugs in this code,
</FONT></FONT></FONT></DIV>
<DIV><SPAN></SPAN><FONT face=Arial><FONT color=#0000ff><FONT
size=2>a<SPAN>nd it is not always clear when case matters and when
it doesn't, or when the order of the arguments
matters.</SPAN></FONT></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT color=#0000ff><FONT
size=2><SPAN></SPAN></FONT></FONT></FONT><SPAN><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV>
<HR>
</DIV>
<DIV><FONT face=Tahoma size=2><SPAN><B>From:</B> Scott Mohnkern
[mailto:<A onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:mohnkern@gmail.com"
target=_blank>mohnkern@gmail.com</A>] <BR></SPAN><B>Sent:</B>
Thursday, November 01, 2007 3:10 PM<BR><B>To:</B> <A
onclick="return top.js.OpenExtLink(window,event,this)"
href="mailto:hobbit@hswn.dk"
target=_blank>hobbit@hswn.dk</A><BR><B>Subject:</B> [hobbit] Re:
New to Hobbit --- file monitoring<BR></FONT><BR></DIV>
<DIV><SPAN>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
<DIV></DIV>When all else fails, nuke it and start over. I
did an apt-get remove hobbit, and then a dpkg -- purge.
Then I removed any files I could find. Then I downloaded
the Ubuntu deb file and installed it. It put the
configuration files in /etc/hobbit and it started fine <BR><BR>I
edited /etc/hobbit/hobbit-clients.cfg and added the following
line:<BR><BR>PROC ntpd 1 99 green "TEXT=NTPD is
up"<BR><BR><BR>Restarted hobbit, and in a few minutes, it
started reporting as expected.<BR><BR>Then I added:<BR><BR>PORT
"LOCAL=%(:8888)" TEXT="Gnump is up"<BR><BR>To the same file,
(/etc/hobbit/hobbit-clients.cfg) and restared hobbit.<BR><BR>A
few minutes later, the ports section started reporting, as
expected. <BR><BR>(Though I realize that its a bit off, which I
need to fix)<BR><BR><BR>Then I added:<BR><BR>FILE /etc/passwd
GREEN NOEXIST track<BR><BR>Reading the documentation inside
hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and
added the following line:<BR>file:/etc/passwd<BR><BR>restarted
hobbit, waited 5 minutes. No luck.<BR><BR><BR>I'm pretty
convinced that either:<BR><BR>1. the format of the line in
/etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg
is incorrect, or<BR>2. There's something else I need to
edit.<BR><BR></BLOCKQUOTE></SPAN></DIV></DIV></BLOCKQUOTE></SPAN></DIV></DIV><BR></BLOCKQUOTE></DIV><BR></SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR></SPAN></DIV></BLOCKQUOTE></DIV></BLOCKQUOTE></DIV><BR><BR
clear=all><BR>-- <BR>Josh Luthman<BR>Office: 937-552-2340<BR>Direct:
937-552-2343<BR>1100 Wayne St<BR>Suite 1337<BR>Troy, OH 45373<BR><BR>Those who
don't understand UNIX are condemned to reinvent it, poorly. <BR>--- Henry
Spencer </BLOCKQUOTE></BODY></HTML>