<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 9 September 2014 10:16, Kris Springer <span dir="ltr"><<a href="mailto:kspringer@innovateteam.com" target="_blank">kspringer@innovateteam.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
I've got a hobbit client that I installed from a FreeBSD Package
running on a pfSense firewall.</div></blockquote><div><br></div><div>Time to upgrade to Xymon? Even so, should work for you.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF">It's working fine other than it
trying to read /var/log/messages instead of /var/log/system.log. I
can't seem to figure out how to define the log file.</div></blockquote><div><br></div><div>This is defined on the server (assuming you're in central mode) in the file client-local.cfg, like so:</div><div><br></div><div><div>[freebsd]</div><div>log:/var/log/messages:10240</div></div><div><br></div><div>On my FreeBSD boxes the log file is in /var/log/messages, so that's probably the standard location, and your installation might be unusual (or newer than mine). You can either just edit the filename in client-local.cfg, or create a section with the hostname of your server, so that it overrides the [freebsd] definition:</div><div><br></div><div>[myhostname]</div><div>log:/var/log/messages:10240</div><div><br></div><div>Please note that the file needs to be defined twice, once in client-local.cfg to tell the client to sent the log messages, and a second time in analysis.cfg (which I think was hobbit-clients.cfg in Hobbit) to tell Xymon what to alert on. So if you change the filename in client-local.cfg, you need to make sure there's a "LOG" definition that matches in analysis.cfg if you want any, well, analysis done. Example:</div><div><br></div><div>HOST=myhostname</div><div> LOG /var/log/messages "kernel: .* segfault " COLOR=red</div><div><br></div><div>I think the default file has no LOG entries at all, so you'll have to add something here if you want any alerting.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div text="#000000" bgcolor="#FFFFFF"> In the client
/xymon/client/etc/hobbitclient.cfg I've set the CONFIGCLASS
definition to "darwin" which is the only ostype that has the
system.log type file (listed on the server in
/xymon/server/etc/client-local.cfg).</div></blockquote><div><br></div><div>Yep, this won't affect the log collection (again, assuming central mode). Instead, the log definition gets pulled from the server each time the client sends its client data, and stored in a file in $XYMONTMP/logfetch.<hostname>.cfg. You might like to have a look at that file and you'll probably see the "log:/var/log/messages:10240" definition from the relevant section of client-local.cfg.</div><div><br></div><div>J</div><div><br></div></div></div></div>