[hobbit] LOG not triggering

[Morsiani, Massimo]

Hi Bill,

you have to use:

HOST=hobbit
        PROC arpwatch 1
        LOG /var/log/messages %arpwatch COLOR=yellow

I'm using this syntax in my Hobbit installation and it works fine.


Regards.

Massimo Morsiani
Information Technology Dept.
------
Gilbarco S.p.a.
via de' Cattani, 220/G
50145 Firenze
tel:	+39-055-30941
fax:	+39-055-318603
email:	massimo.morsiani at gilbarco.com
web:	http://www.gilbarco.it



-----Original Message-----
From: Bill Hart [mailto:bill.hart at burkecorp.com] 
Sent: martedì 13 febbraio 2007 18.51
To: hobbit at hswn.dk
Subject: [hobbit] LOG not triggering

I'm hoping this is something obvious.

My Hobbit server (4.2.0, patched on Friday) has the following entry in the hobbit-clients.cfg file :


HOST=hobbit
        PROC arpwatch 1
        LOG /var/log/messages "arpwatch" COLOR=yellow


That is all I've changed, the default section remains the same

The PROC line works fine, but the LOG seems to be ignored.

I have entries in the messages file showing up on the hobbit server :



System logs at Tue Feb 13 11:40:27 CST 2007

No entries in /var/log/messages

Full log /var/log/messages
Feb 13 11:09:07 hobbit arpwatch: bogon 0.0.0.0 Feb 13 11:25:34 hobbit arpwatch: bogon 169.254.49.204 Feb 13 11:25:36 hobbit last message repeated 2 times Feb 13 11:30:47 hobbit arpwatch: new station xx.xx.xx.xx Feb 13 11:34:51 hobbit arpwatch: new station xx.xx.xx.xx 


As you can see it's not triggering on the arpwatch entries there.

I've tried arpwatch, "arpwatch:", and "arpwatch", as well as %.* in place of /var/log/messages, none of it seems to cause a yellow condition.

Anyone have any pointers on what I'm doing wrong ?  The logs all look clean in /var/log/hobbit, only entries for an external script I'm running that has nothing to do with this.

Thanks,
Bill Hart

Computer Support Supervisor

 

Burke Corporation

1516 South D Avenue

PO Box 209

Nevada, IA 50201-0209

(515) 382-3575 x8406

www.BurkeCorp.com

 

Always make it your best(r)


To unsubscribe from the hobbit list, send an e-mail to hobbit-unsubscribe at hswn.dk



This message (including any attachments) contains confidential 
and/or proprietary information intended only for the addressee.  
Any unauthorized disclosure, copying, distribution or reliance on 
the contents of this information is strictly prohibited and may 
constitute a violation of law.  If you are not the intended 
recipient, please notify the sender immediately by responding to 
this e-mail, and delete the message from your system.  If you 
have any questions about this e-mail please notify the sender 
immediately.