[hobbit] Not getting alerts for log entries on Solaris 10 Update 3 (SPARC)

[Dominique Frise]

Kenneth Bourn wrote:
> Dominique,
> 
> I tried this and am now getting alerts!  Is there a known issue where I 
> can't just specify the string I want and expect it to be searched 
> exactly as I have it entered in the hobbit-clients.cfg file?  Turning 
> off case insensitive matching works...
> 
> Thanks!
> -Ken
> 
> Dominique Frise wrote:
>> Kenneth Bourn wrote:
>>> I am having issues with getting Hobbit to report log entries from 
>>> client log files.  The server is getting the log data but, despite a 
>>> valid string entry in the log file, no alerts are generated.
>>>
>>> Here is an excerpt from my client-local.cfg file:
>>>
>>> [hosta-z1]
>>> log:/var/adm/messages:10240
>>>
>>> And a corresponding entry from the hobbit-clients.cfg file:
>>>
>>> HOST=hosta-z1
>>>     LOG /var/adm/messages sshd COLOR=red
>>>
>>
>> Have you tried this (turn off case insensitive matching):
>>
>>     LOG /var/adm/messages %(?-i)sshd COLOR=red
>>
>>
>> Dominique
>> UNIL - University of Lausanne
>>
>> To unsubscribe from the hobbit list, send an e-mail to
>> hobbit-unsubscribe at hswn.dk
>>
>>
> 
Hobbit defaults to case insensitive pattern matching.
See man hobbit-clients.cfg(5) for details.


Dominique
UNIL - University of Lausanne