[hobbit] Re: New to Hobbit --- file monitoring
Hubbard, Greg L
greg.hubbard at eds.com
Fri Nov 2 02:59:44 CET 2007
Well, well. A "ghost" is a Hobbit client reporting in with a name that
is not in the bb-hosts file.
Two ways to fix it.
a) on the client, there is a way to make the client use an arbitrary
name. I think it is the "--client foo.bar.com" option, but I could be
wrong.
b) on the server, you can add a "client:wrong.host.name" entry for the
client that is reporting in with a bad name.
I could be wrong on both counts about the syntax -- you can check the
man pages.
________________________________
From: Josh Luthman [mailto:josh at imaginenetworksllc.com]
Sent: Thursday, November 01, 2007 8:45 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file monitoring
Ghost reports doesn't have foo.bar.com but it does have
something else - an old hostname that I changed a while back, can you
tell me how to fix this?
Greg - making that change didn't fix it. I still have "no files
checked" =(
Josh
On 11/1/07, Hubbard, Greg L <greg.hubbard at eds.com> wrote:
check your ghosts report to see if foo.bar.com is
reporting in as foo.
And when are you going to change GREEN to "COLOR=green"?
GLH
________________________________
From: Josh Luthman
[mailto:josh at imaginenetworksllc.com]
Sent: Thursday, November 01, 2007 5:13 PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit --- file
monitoring
I'm basing my changes on Greg. These still do
not work, though I believe they're a step towards the right direction:
#hobbit-clients.cfg
HOST=foo.bar.com
FILE "/etc/passwd" GREEN NOEXIST TRACK
#client-local.cfg
[foo.bar.com]
file:/etc/passwd
I do notice that on my main machine running the
server and client that there is Client Data available if you click on
the Files test. There is no client data from the foo.bar.com files
test, however. I think my problem right now is that I'm not getting the
data from foo.bar.com to BBD. Any ideas at this point?
On 11/1/07, Hubbard, Greg L
<greg.hubbard at eds.com> wrote:
Here is something I use that works.
This is a "bookend" problem -- both parts have to be done correctly.
Hobbit tends to silently ignore errors in configuration files.
---------------------------------------------------
In client-local.cfg
[myserver.mydomain.com]
file:/opt2/log/syslog.log
file:/opt2/log/security.log
file:/opt2/log/snmptrap.log
---------------------------------------------------
in hobbit-clients.cfg
HOST=myserver.mydomain.com
FILE /opt2/log/syslog.log
mtime<600 size<2G TRACK
FILE /opt2/log/security.log
TRACK
FILE /opt2/log/snmptrap.log
mtime<600 size<2G TRACK
----------------------------------------------------
Some things to note
a) the host names match exactly, and
they are not enclosed in double quotes.
b) the file names match exactly
c) this example is lifted from my
running system, with the host name changed to protect the guilty. I
have some other examples that use color in the "COLOR=color" format,
which I believe is required, but I would have to edit them more before I
can post them.
d) the client-local.cfg file has some
predefined sections in it. Don't use them. Make new ones. Only one
section can be applied to a host, so cut and paste will
be your friend.
________________________________
From: Scott Mohnkern
[mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 4:00
PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit
--- file monitoring
Nope, no joy there either. the man page
seems to think it should be:
FILE <full path to file><color>
<condition>
and that's pretty consistent with the
other things I've put into the same file, which come up.
I also tried:
FILE "/etc/passwd" green noexist TRACK
and
FILE "/etc/passwd" green noexist
Scott
On 11/1/07, Hubbard, Greg L
<greg.hubbard at eds.com > wrote:
Try this
FILE /etc/passwd noexist COLOR=green
TRACK
________________________________
From: Scott Mohnkern
[mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 3:39
PM
To: hobbit at hswn.dk
Subject: Re: [hobbit] Re: New to Hobbit
--- file monitoring
Well, at least its replicatable.
Scott
On 11/1/07, Scott Mohnkern <
mohnkern at gmail.com <mailto:mohnkern at gmail.com> > wrote:
Thanks for the help. I edited
/etc/hobbit/hobbit-clients.cfg so the line reads:
FILE /etc/passwd GREEN noexist
still no joy.
Is there anyone on the list that has an
example of a FILE line in their hobbit-clients.cfg file?
On 11/1/07, Hubbard, Greg L <
greg.hubbard at eds.com <mailto:greg.hubbard at eds.com> > wrote:
Try removing the TRACK keyword, and then
change NOEXIST to lower case. I think Henrik has reported that there
are a few bugs in this code,
and it is not always clear when case
matters and when it doesn't, or when the order of the arguments matters.
________________________________
From: Scott Mohnkern
[mailto:mohnkern at gmail.com]
Sent: Thursday, November 01, 2007 3:10
PM
To: hobbit at hswn.dk
Subject: [hobbit] Re: New to Hobbit ---
file monitoring
When all else fails, nuke it and start
over. I did an apt-get remove hobbit, and then a dpkg -- purge. Then I
removed any files I could find. Then I downloaded the Ubuntu deb file
and installed it. It put the configuration files in /etc/hobbit and it
started fine
I edited /etc/hobbit/hobbit-clients.cfg
and added the following line:
PROC ntpd 1 99 green "TEXT=NTPD is up"
Restarted hobbit, and in a few minutes,
it started reporting as expected.
Then I added:
PORT "LOCAL=%(:8888)" TEXT="Gnump is up"
To the same file,
(/etc/hobbit/hobbit-clients.cfg) and restared hobbit.
A few minutes later, the ports section
started reporting, as expected.
(Though I realize that its a bit off,
which I need to fix)
Then I added:
FILE /etc/passwd GREEN NOEXIST track
Reading the documentation inside
hobbit-clients.cfg I edited /etc/hobbit/client- local.cfg and added the
following line:
file:/etc/passwd
restarted hobbit, waited 5 minutes. No
luck.
I'm pretty convinced that either:
1. the format of the line in
/etc/hobbit/client-local.cfg or /etc/hobbit/hobbit-clients.cfg is
incorrect, or
2. There's something else I need to
edit.
--
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
Those who don't understand UNIX are condemned to
reinvent it, poorly.
--- Henry Spencer
--
Josh Luthman
Office: 937-552-2340
Direct: 937-552-2343
1100 Wayne St
Suite 1337
Troy, OH 45373
Those who don't understand UNIX are condemned to reinvent it,
poorly.
--- Henry Spencer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20071101/4ad5d57f/attachment.html>
More information about the Xymon
mailing list