LOG not triggering

[Bill Hart]

I'm hoping this is something obvious.

My Hobbit server (4.2.0, patched on Friday) has the following entry in
the hobbit-clients.cfg file :


HOST=hobbit
        PROC arpwatch 1
        LOG /var/log/messages "arpwatch" COLOR=yellow


That is all I've changed, the default section remains the same

The PROC line works fine, but the LOG seems to be ignored.

I have entries in the messages file showing up on the hobbit server :



System logs at Tue Feb 13 11:40:27 CST 2007

No entries in /var/log/messages

Full log /var/log/messages
Feb 13 11:09:07 hobbit arpwatch: bogon 0.0.0.0 
Feb 13 11:25:34 hobbit arpwatch: bogon 169.254.49.204 
Feb 13 11:25:36 hobbit last message repeated 2 times
Feb 13 11:30:47 hobbit arpwatch: new station xx.xx.xx.xx 
Feb 13 11:34:51 hobbit arpwatch: new station xx.xx.xx.xx 


As you can see it's not triggering on the arpwatch entries there.

I've tried arpwatch, "arpwatch:", and "arpwatch", as well as %.* in
place of /var/log/messages, none of it seems to cause a yellow
condition.

Anyone have any pointers on what I'm doing wrong ?  The logs all look
clean in /var/log/hobbit, only entries for an external script I'm
running that has nothing to do with this.

Thanks,
Bill Hart

Computer Support Supervisor

 

Burke Corporation

1516 South D Avenue

PO Box 209

Nevada, IA 50201-0209

(515) 382-3575 x8406

www.BurkeCorp.com

 

Always make it your best(r)