[hobbit] Hobbit not recognizing certain tests?

[FARRIOR, Andy]

I haven't modified trap.pl in a very *long* time.  Hmm...  (I'm still
using it.)


Going back over the code, I'm running hobbitdboard so I can get the
validtime field for the test:
  "$BB $BBDISP \"hobbitdboard test=trap
fields=hostname,validtime,color\" "

In case there's a host that doesn't send a trap that often, I wanted to
change the color to green instead of having it go purple and generate an
alert.  So to get the time left for a test, I needed the hobbitdboard
results.  A side-effect is that the column won't appear until the device
sends it's first trap.



For the problem device, is the log from SEC showing a hostname or IP
address for the device sending the trap?


There may be a problem if it's sending a status message to Hobbit with
an IP address instead of a hostname.  I don't think trap.pl does a good
job (or at all) of trying to resolve an IP address to a hostname that's
in bb-hosts.




Hope that helps,
Andy



 

-----Original Message-----
From: Henrik Stoerner [mailto:henrik at hswn.dk] 
Sent: Monday, July 16, 2007 3:41 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Hobbit not recognizing certain tests?

On Mon, Jul 16, 2007 at 12:43:55PM -0400, Eric Jacobs wrote:
> The trap.pl uses hobbitboard to find all the hosts that have the 
> "trap" test defined.

Bad idea - there's a chicken-and-egg problem here.

Columns do not appear in the hobbitdboard output until they exist,
i.e. a status has been reported to Hobbit. So if *something* must 
report a "trap" status to Hobbit before the trap.pl script sees 
that it should do the "trap" thing ... well, I guess you can tell
where I'm going.

Scripts that implement custom tests should use the "bbhostgrep"
utility to scan the bb-hosts file for the hosts that have a
specific tag defined.

There is actually another way it can be done, but it's not yet
documented: You can send a "hostinfo" command to hobbitd, and it
will return a pre-parsed version of the bb-hosts file - one line
per hosts, with the fields delimited by '|' characters, eg:
mail.hswn.dk|172.16.10.2|NET:intern|COMMENT:Internal mail
server|smtp|pop3|imap


Regards,
Henrik


To unsubscribe from the hobbit list, send an e-mail to
hobbit-unsubscribe at hswn.dk