<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1439579813912_2812" dir="ltr">Hello,<br class="" id="yui_3_16_0_1_1439579813912_2750">I'll try not to span this time.<br class="" id="yui_3_16_0_1_1439579813912_2752"><br class="" id="yui_3_16_0_1_1439579813912_2754">I just installed '4.3.21' server on a Raspberry Pi Debian.<br class="" id="yui_3_16_0_1_1439579813912_2756">Additionally, I just compiled '4.3.21' as a client on a Raspberry Pi Debian.<br class="" id="yui_3_16_0_1_1439579813912_2758"><br class="" id="yui_3_16_0_1_1439579813912_2760">Xymon is going to be used to monitor one server, a network intrusion software called snort.<br class="" id="yui_3_16_0_1_1439579813912_2762">I'm going to monitor one log file which has all the detected alerts. If an alert comes in, I want Xymon to be red.<br class="" id="yui_3_16_0_1_1439579813912_2764"><br class="" id="yui_3_16_0_1_1439579813912_2766">So, I went to the xymon server and modified the 'client-local.cfg':<br class="" id="yui_3_16_0_1_1439579813912_2768">[snort]<br class="" id="yui_3_16_0_1_1439579813912_2770">log:/var/log/snort/alert:4096<br class="" id="yui_3_16_0_1_1439579813912_2772"><br class="" id="yui_3_16_0_1_1439579813912_2774">'snort' is the name of the sniffer server and I only want to monitor '/var/log/snort/alert' file.<br class="" id="yui_3_16_0_1_1439579813912_2776"><br class="" id="yui_3_16_0_1_1439579813912_2778">Then I went to the 'analysis.cfg' on the xymon server and added:<br class="" id="yui_3_16_0_1_1439579813912_2780"><br class="" id="yui_3_16_0_1_1439579813912_2782">HOST=snort<br class="" id="yui_3_16_0_1_1439579813912_2784"> LOG /var/log/snort/alert ERROR COLOR=red<br class="" id="yui_3_16_0_1_1439579813912_2786"><br class="" id="yui_3_16_0_1_1439579813912_2788">I waited 20 minutes and I'm getting:<br class="" id="yui_3_16_0_1_1439579813912_2790"><br class="" id="yui_3_16_0_1_1439579813912_2792">No log data available<br class="" id="yui_3_16_0_1_1439579813912_2794">The client did not report any logfile data<br class="" id="yui_3_16_0_1_1439579813912_2796"><br class="" id="yui_3_16_0_1_1439579813912_2798">I do see green happy faces on conn, disk, info, memory but 'msgs' is white.<br class="" id="yui_3_16_0_1_1439579813912_2800"><br class="" id="yui_3_16_0_1_1439579813912_2802">I had this working on a very old version of 'xymon' a while ago but this is the first time I'm using the latest and greatest.</div><div id="yui_3_16_0_1_1439579813912_2861" dir="ltr"><br></div><div id="yui_3_16_0_1_1439579813912_2862" dir="ltr">Please help.</div><div id="yui_3_16_0_1_1439579813912_2863" dir="ltr"><br></div><div id="yui_3_16_0_1_1439579813912_2864" dir="ltr">usaims<br></div></div></body></html>