<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1439587437352_3707"><span>I have resolved the issue by removing '--local' from clientlaunch.cfg.</span></div><div id="yui_3_16_0_1_1439587437352_4952"><span><br></span></div><div id="yui_3_16_0_1_1439587437352_4954"><span id="yui_3_16_0_1_1439587437352_4953">Sorry for the repeated emails -- I don't know why this is happenings.<br></span></div> <br><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Friday, August 14, 2015 3:28 PM, usa ims via Xymon <xymon@xymon.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container"><div id="yiv4978376633"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div id="yiv4978376633yui_3_16_0_1_1439579813912_2812" dir="ltr">Hello,<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2750">I'll try not to span this time.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2752"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2754">I just installed '4.3.21' server on a Raspberry Pi Debian.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2756">Additionally, I just compiled '4.3.21' as a client on a Raspberry Pi Debian.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2758"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2760">Xymon is going to be used to monitor one server, a network intrusion software called snort.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2762">I'm going to monitor one log file which has all the detected alerts. If an alert comes in, I want Xymon to be red.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2764"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2766">So, I went to the xymon server and modified the 'client-local.cfg':<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2768">[snort]<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2770">log:/var/log/snort/alert:4096<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2772"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2774">'snort' is the name of the sniffer server and I only want to monitor '/var/log/snort/alert' file.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2776"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2778">Then I went to the 'analysis.cfg' on the xymon server and added:<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2780"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2782">HOST=snort<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2784"> LOG /var/log/snort/alert ERROR COLOR=red<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2786"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2788">I waited 20 minutes and I'm getting:<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2790"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2792">No log data available<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2794">The client did not report any logfile data<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2796"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2798">I do see green happy faces on conn, disk, info, memory but 'msgs' is white.<br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2800"><br class="yiv4978376633" id="yiv4978376633yui_3_16_0_1_1439579813912_2802">I had this working on a very old version of 'xymon' a while ago but this is the first time I'm using the latest and greatest.</div><div id="yiv4978376633yui_3_16_0_1_1439579813912_2861" dir="ltr"><br></div><div id="yiv4978376633yui_3_16_0_1_1439579813912_2862" dir="ltr">Please help.</div><div id="yiv4978376633yui_3_16_0_1_1439579813912_2863" dir="ltr"><br></div><div id="yiv4978376633yui_3_16_0_1_1439579813912_2864" dir="ltr">usaims<br></div></div></div></div><br>_______________________________________________<br>Xymon mailing list<br><a ymailto="mailto:Xymon@xymon.com" href="mailto:Xymon@xymon.com">Xymon@xymon.com</a><br><a href="http://lists.xymon.com/mailman/listinfo/xymon" target="_blank">http://lists.xymon.com/mailman/listinfo/xymon</a><br><br><br></div> </div> </div> </div></div></body></html>