monitoring logs

["Johan Booysen" <johan (at) matrix-data.co.uk>]

I'm trying to get hobbit to monitor /var/log/messages for specific
entries ("somestring" in my example below) on server1.

 

In hobbit-clients.cfg I've added (above DEFAULT):

 

 HOST=server1

        LOG /var/log/messages somestring COLOR=red

 

And in client-local.cfg, I've added:

 

  server1

  log:/var/log/messages:10240

  ignore MARK

 

My understanding is that server1 should now collect data from
/var/log/messages, and the hobbit server will then, if it finds
"somestring" in the log file, flag it as red in the msgs column.

 

I can now see the entire log for server1 on the web interface, but the
msgs icon doesn't change to red.

 

What am I missing?

 

Also, does any of the defaults in client-local.cfg  match RHEL5
machines, e.g.

[redhat]

log:/var/log/messages:10240

ignore MARK

 

or

 

[redhatES]

log:/var/log/messages:10240

ignore MARK

 

 

Thanks.