Re: [hobbit] Logfile monitoring - I'd like some comments

[Charles Jones <jonescr (at) cisco.com>]

Henrik,

How will it handle monitoring files that get rotated out?  For example 
if the hobbit client is monitoring /var/log/messages, and a cron rotate 
script moves messages to messages.1 and gzips it, will the hobbit client 
be smart enough to reseek to the end of the newly created file?

Some log rotation setups move/rename the file to another (which keeps 
the inode), and then recreate a new file with the same name as the 
origional., Some copy the file to a new file and truncate the old one, 
and other variations.

*** Partially off-topic ***
While looking at another groups monitoring setup, they were using a 
program called ****** (name doesnt matter), which I found to be inferior 
to Hobbit, but it did have one nice feature, which was the ability to 
test the checksum of a list of files, and send an alert if the file 
changed (default examples were /etc/passwd, /vmlinuz, 
/etc/syslog.conf).  I suppose this functionality could be achieved via a 
client-side external script, but I mention it here because it might be 
easy to add in now while you are working on the file scanning code :)

-Charles